alex wrote: > If i right understand, Shorewall (4.0.3, perl) can configure 'tc' only >for >outgoing traffic of the interfaces. But if i want to shape incoming traffic >i >can to shape on another interface outgoing traffic that is incoming on first >interface. > ------------------ > | | > ----> interface-1 Firewall interface-2 ----> > | | > ------------------ > Am i right?
Yes, but ... > And yet question. > How can i shape incoming traffic for self firewall (e.g. i running >ftp-server on firewall). You can't ! So in effect, you can only shape inbound traffic on i/f1 as it exits i/f2 IFF there is minimal traffic coming for the firewall itself. Internal traffic from the firewall to i/f2 can be dealt with by sufficiently complicated tc setup ! If you have inbound traffic to the firewall, then really the best you can do is police the inbound rate on i/f1. The alternative is to move the externally visible service to an internal server so there is no 'missing' traffic when you shape the traffic out of i/f2 ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
