>> If i right understand, Shorewall (4.0.3, perl) can configure 'tc' only
>>for
>>outgoing traffic of the interfaces. But if i want to shape incoming traffic
>>i
>>can to shape on another interface outgoing traffic that is incoming on
>>first
>>interface.
>> ------------------
>> | |
>> ----> interface-1 Firewall interface-2 ---->
>> | |
>> ------------------
>> Am i right?
>
> Yes, but ...
>
>> And yet question.
>> How can i shape incoming traffic for self firewall (e.g. i running
>>ftp-server on firewall).
>
> You can't !
>
> So in effect, you can only shape inbound traffic on i/f1 as it exits
> i/f2 IFF there is minimal traffic coming for the firewall itself.
> Internal traffic from the firewall to i/f2 can be dealt with by
> sufficiently complicated tc setup !
No, only inbound traffic from i/f1 to firewall itself interesting
to me (not from firewall to i/f2). So as i have 1Gbit ethernet on i/f2
and ADSL on i/f1.
> If you have inbound traffic to the firewall, then really the best you
> can do is police the inbound rate on i/f1.
With 'ifb' module only and 'tcstart' file or not?
> The alternative is to move the externally visible service to an
> internal server so there is no 'missing' traffic when you shape the
> traffic out of i/f2
--------
Горячее предложение от курсов иностранных языков “Streamline”!
Всем, кто успеет записаться на курсы до 7 сентября, будет предоставлена
неделя бесплатных занятий в первом семестре обучения! http://www.str.by/
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
