Traffic control: iptables + tc

Article title: Traffic Control: iptables + tc. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

Set the external address eth0: 192.168.1.223 in eth0 on the server.

Eth1 helps set the internal address eth1: 1 192.168.2.1

The function to be implemented now is to limit the entire exit to 512 kbit (upload traffic), and download traffic from the 192.168.2 network segment to 512 Kbit.

The method is as follows:

First, help to set the corresponding address: (not detailed)

Implement route settings using iptables.

Iptables? A input-F

Iptables-A output-F

Iptables-A forward-F

Echo 1>/proc/sys/net/ipv4/ip_forward

# Forwarding permitted

Iptables-A input? J accept

Iptables-A output-j accept

Iptables-A forward-j accept

Iptables-t nat-a postrouting-s 192.168.2.0/24-j MASQUERADE

# Mask IP addresses so that packets of internal hosts can be connected to the outside world through the server.

Manage traffic

Tc qdisc add dev eth0 root tbf rate 512 k lantency 50 ms burst 1540.

# Use the TokenBucket Filter (tbf) to Filter the queue on the eth0 Nic. the outbound traffic is limited to 512 kbit, the delay is 50 ms, and the burst data is 1540. the specified rate value is the limited bandwidth.

Continue to limit eth1.

Tc qdisc add dev eth1 root handle 1:0 cbq bandwidth 100 Mbit avpkt 1000 cell 8

# Create a queue and specify the NIC as a M Nic. this is irrelevant to the traffic limit and is used for computing.

Tc class add dev eth1 parent 1:0 classid cbq bandwidth 100 Mbit rate 5 Mbit weight 6 Mbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded

# Create a root category. the bandwidth is limited to 5 Mbit and other bandwidths cannot be borrowed. The parameters following Prio are priority values, indicating the order in which data packets are processed.

Tc class add dev eth1 parent classid cbq bandwidth 100 Mbit rate 512 kbit weight 5 Mbit prio 5 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded

# Under the same class, create a class with a bandwidth limit of 512 kbit at and do not allow the borrow bandwidth for the 192.168.2 network segment.

Tc qdisc add dev eth1 parent :3 handle 30: sfq

# Create a queue under each category, and use sfq (Stochastic Fareness Queueing) to then fair the queue.

Tc filter add dev eth1 parent 1:0 protocol ip prio 1 u32 match ip dst 172.17.0.0/16 flowid :3

# Use The u32 filter to classify the destination address and match the created queue.

Through the above method, simple traffic control is implemented to limit the upload traffic at the exit and the download traffic at the internal port.

The download speed from 192.168.2.20 is 512 kbit, and the download speed is 64-65kB.

The download speed from 192.168.2.20 is 128 kbit. the download speed is 14-16kB.

Note: If the data packet does not match any rule, the rule set by root is sent.