0

Currently I police the rate on my download speed with

tc filter add dev ppp0 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 police rate 9900kbit burst 10k drop flowid :1

I've got one client on my LAN let's say his IP is 192.168.200.200

I tried this, but it didn't limit his download speed.

tc filter add dev ppp0 parent ffff: protocol ip prio 50 u32 match ip dst 192.168.200.200 police rate 10kbit burst 10k drop flowid :1

1 Answer 1

0

I have a theory.

You're limiting ingres (parent ffff) based on dst IP. If this is on a NAT box,the destination IP in the packet is the external IP of the NAT box, not the internal non-routable IP of the actual destination. The packet doesn't get that destination until the NAT box has done it's mangling.

I think you want an out-bound handle, not ingres. Here's the example from the lartc howto:

  tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 10mbit 

  tc class add dev $DEV parent 1: classid 1:1 cbq rate 512kbit \
  allot 1500 prio 5 bounded isolated 

  tc filter add dev $DEV parent 1: protocol ip prio 16 u32 \
  match ip dst 195.96.96.97 flowid 1:1

http://lartc.org/howto/lartc.ratelimit.single.html

Hope that helps! -Dylan

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .