Another machine on my LAN is uploading to Dropbox and saturating my internet connection's upload bandwidth. When that happens my pings to 8.8.8.8 take 3000-6000ms. When dropbox is not uploading my pings to 8.8.8.8 are 45ms.

I'm trying to simply slow down and de-prioritize forwarded traffic to/from Dropbox on my linux router.

I've tried 2 slightly different guides and have not had any success with either. I think one factor that makes it confusing is that the Dropbox traffic seems to speed up and slow down every minute or two. I don't have access to the machine doing the Dropbox uploads so I can't see why the traffic is high for a few mins, then low for a few seconds, oscillating. Maybe it's uploading many files and there is a pause between each file.

I've made 3 attempts based on 3 slightly different guides online.

It's my understanding that 1:30 is the lowest priority traffic class, which is what I want Dropbox to be.

Update: I adapted this slightly to shape a download that I ran from my own computer. The rate-limiting worked as expected. However now I must test uploading.

Attempt 1

#!/bin/bash
tc qdisc add dev br0 root handle 1:0 htb default 1
tc class add dev br0 parent 1:0 classid 1:30 htb rate 64kbps ceil 128kbps prio 0
tc filter add dev br0 parent 1:0 prio 0 protocol ip handle 30 fw flowid 1:30
iptables -I FORWARD -t mangle -s 162.125.0.0/16,199.47.216.0/22,108.160.160.0/20,205.189.0.0/24,64.124.102.192/29,209.99.70.0/24,45.58.64.0/20,208.185.144.160/27 -j MARK --set-mark 30
iptables -I FORWARD -t mangle -d 162.125.0.0/16,199.47.216.0/22,108.160.160.0/20,205.189.0.0/24,64.124.102.192/29,209.99.70.0/24,45.58.64.0/20,208.185.144.160/27 -j MARK --set-mark 30

iptables-save -c shows the relevant traffic is being marked

[145:212599] -A FORWARD -d 162.125.0.0/16 -j MARK --set-xmark 0x1e/0xffffffff
[72:2880] -A FORWARD -s 162.125.0.0/16 -j MARK --set-xmark 0x1e/0xffffffff

Attempt 2

#!/bin/bash
#tc qdisc add dev br0 root handle 1: htb
#tc class add dev br0 parent 1: classid 1:30 htb rate 32kbps ceil 64kbps
#tc filter add dev br0 parent 1: prio 0 protocol ip handle 30 fw flowid 1:30
#iptables -I FORWARD -t mangle -s 162.125.0.0/16,199.47.216.0/22,108.160.160.0/20,205.189.0.0/24,64.124.102.192/29,209.99.70.0/24,45.58.64.0/20,208.185.144.160/27 -j MARK --set-mark 30
#iptables -I FORWARD -t mangle -d 162.125.0.0/16,199.47.216.0/22,108.160.160.0/20,205.189.0.0/24,64.124.102.192/29,209.99.70.0/24,45.58.64.0/20,208.185.144.160/27 -j MARK --set-mark 30

Attempt 3

tc qdisc add dev br0 root handle 1: htb default 1
#Second add a class (bucket) with bandwidth restrictions
tc class add dev br0 parent 1: classid 1:30 htb rate 512kbit
#Then add a filter to force packets through the class
tc filter add dev br0 protocol ip parent 1:0 prio 1 handle 1 fw classid 1:30
iptables -I FORWARD -t mangle -s 162.125.0.0/16,199.47.216.0/22,108.160.160.0/20,205.189.0.0/24,64.124.102.192/29,209.99.70.0/24,45.58.64.0/20,208.185.144.160/27 -j MARK --set-mark 0x1
iptables -I FORWARD -t mangle -d 162.125.0.0/16,199.47.216.0/22,108.160.160.0/20,205.189.0.0/24,64.124.102.192/29,209.99.70.0/24,45.58.64.0/20,208.185.144.160/27 -j MARK --set-mark 0x1

If you got it working for download side of traffic, then your config is good. Traffic shaping works only for egress traffic. This is because shaping controls the send buffers of the interface and it has no effect on the receiving side (ingress traffic).

There are two possible solutions: one is to use IFB (mentioned in linked post), or to configure egress shaping on another interface (non-facing to your clients). To clarify the second point:

Clients <=> (download limit) [Server] (upload limit) <=> [Edge router]

You want to shape traffic on "Server" by applying download and upload limits on different interfaces as shown. Uploaded data is egress traffic to second interface (non-facing) your clients.

Here are similar posts: post1, and post2.

  • Thanks for your reply. I would like to clarify my situation. There is a PC on my LAN that is uploading data to Dropbox through my MASQUERADEing router. My Router is FORWARDing the traffic from the local PC out to Dropbox (I am referring to this as Uploading). So my router should be capable of limiting the upload rate. The above example works for limiting the download rate only. Can you tell me why it is not limiting upload speed? My iptables rules are matching both the send and receive traffic, so I would expect it to limit upload and download speed. – Josh Apr 8 '17 at 15:39

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.