0

Currently I police the rate on my download speed with

tc filter add dev ppp0 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 police rate 9900kbit burst 10k drop flowid :1

I've got one client on my LAN let's say his IP is 192.168.200.200

I tried this, but it didn't limit his download speed.

tc filter add dev ppp0 parent ffff: protocol ip prio 50 u32 match ip dst 192.168.200.200 police rate 10kbit burst 10k drop flowid :1
0

I have a theory.

You're limiting ingres (parent ffff) based on dst IP. If this is on a NAT box,the destination IP in the packet is the external IP of the NAT box, not the internal non-routable IP of the actual destination. The packet doesn't get that destination until the NAT box has done it's mangling.

I think you want an out-bound handle, not ingres. Here's the example from the lartc howto:

  tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 10mbit 

  tc class add dev $DEV parent 1: classid 1:1 cbq rate 512kbit \
  allot 1500 prio 5 bounded isolated 

  tc filter add dev $DEV parent 1: protocol ip prio 16 u32 \
  match ip dst 195.96.96.97 flowid 1:1

http://lartc.org/howto/lartc.ratelimit.single.html

Hope that helps! -Dylan

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.