Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two NICs. eth0 is connected to the internet and eth1 is connected to the LAN.

I want to restrict the download limit using iptables and linux tc.

So I wrote a test script to verify if it is working.

My iptables configuration is as below.

iptables -t mangle -N INBOUND
iptables -t mangle -I PREROUTING -i eth0 -j INBOUND
iptables -t mangle -A INBOUND  -j MARK --set-mark 60

My ingress configuration is as below.

tc qdisc add dev eth0 handle 1: ingress
tc filter add dev eth0 parent 1: protocol ip prio 1 handle 60 fw police rate 100kbit burst 20kbit drop flowid :1

Can you please tell me what I am missing here ?

share|improve this question
up vote 3 down vote accepted

Traffic in netfilter fall after pass ingress discipline at the interface so that your mark not care.

Use 'tc filter ... u32'.

share|improve this answer
Thanks! the diagram cleared my confusion. I used u32 to redirect this to a IFB interface and then applied egress rules. – Supratik Jan 31 '11 at 13:06
By using IFB for your ingress traffic, did you manage to use iptables to mark your trafic and apply egress rules on your ingress traffic? Do you mean that when using "mirred egress redirect", you must mark packets in iptables mangle-POSTROUTING? Could you please share your solution? Thanks a lot. – MiniQuark Aug 19 '11 at 22:35

Take a look at Wonder Shaper:

It is a fantastic use of 'tc' to control upload/download rates.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.