I am looking to start up a new open-source mirror for my enterprise, but would also be interested in opening it up for external clients as well. However, for obvious reasons, I would like to limit the outgoing bandwidth to anyone not in one of my local subnets (e.g. traffic headed for one of the border routers).
I was originally looking at apache mod_bw, however there will likely be FTP access to this mirror as well. I've seen a number of promising options using 'tc', however that looks like it will match a pattern based on subnet. But I want the negation of that -- I have a list of a few (5 or 6) internal subnets which should have no restrictions, and everything else should go through the traffic shaper. Complicating things somewhat is I'll also need to match both v4 and v6 subnets.
I was experimenting with this, but again, I basically need the inverse of that, so "don't shape these subnets; apply policy to everything else". Perhaps 2 classes, one with a rate limiter and one which doesn't? I'm still unclear though on how the processing order goes with 'tc' -- is processing terminated after a match is found, or will it continue until the end? (e.g., will a catch-all at the end truly catch everything, or just what hasn't been matched yet?)