Blog

Debian – Traffic Control: Linux Advanced Traffic Control

Traffic Control е може би най трудната част от администриране на linux системи. Преди да се занимавате с трафик контрол трябва да сте наясно с мерните единици.

Mbps = 1024 kbps = 1024 * 1024 bps => byte/s
Mbit = 1024 kbit => kilo bit/s.
Mb = 1024 kb = 1024 * 1024 b => byte

Ограничаване на upload трафика с tbf и download с ingress на един интерфейс. Често намира приложение на машина с много интерфеиси или виртуални такива като ppp и vlan. Тук не упражняваме трафик контрол на логически ип адрес или мрежа а правим това на физически интерфейс като eth0, ppp0, vlan0 например.

/sbin/tc qdisc del dev eth0 root
/sbin/tc qdisc add dev eth0 root tbf rate 1024Kbit latency 50ms burst 10k

/sbin/tc qdisc del dev eth0 handle ffff: ingress
/sbin/tc qdisc add dev eth0 handle ffff: ingress
/sbin/tc filter add dev eth0 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 \
police rate 1024Kbit burst 10k drop flowid :1

Ограничаване само на upload трафика с HTB, u32 класификаторите и две приоритетни групи. Често намира приложение в сървъри за споделяне на файлове или някакъв друг ресурс. Първата група може да тегли с 512kbit на ип адрес от възможните 2048kbit а втората с по нисък приоритет 2 може да тегли с 256kbit на ип адрес от възможните 1024kbit.

/sbin/tc qdisc del dev eth0 root
/sbin/tc qdisc add dev eth0 root handle 1: htb

/sbin/tc class add dev eth0 parent 1: classid 1:1 htb rate 512kbit ceil 2048kbit burst 10k
/sbin/tc filter add dev eth0 parent 1: protocol ip prio 1 u32 match ip dst 192.168.0.2 classid 1:1
/sbin/tc filter add dev eth0 parent 1: protocol ip prio 1 u32 match ip dst 192.168.0.3 classid 1:1
/sbin/tc filter add dev eth0 parent 1: protocol ip prio 1 u32 match ip dst 192.168.0.4 classid 1:1
/sbin/tc filter add dev eth0 parent 1: protocol ip prio 1 u32 match ip dst 192.168.0.5 classid 1:1

/sbin/tc class add dev eth0 parent 1: classid 1:2 htb rate 256kbit ceil 1024kbit burst 10k
/sbin/tc filter add dev eth0 parent 1: protocol ip prio 2 u32 match ip dst 192.168.0.10 classid 1:2
/sbin/tc filter add dev eth0 parent 1: protocol ip prio 2 u32 match ip dst 192.168.0.11 classid 1:2
/sbin/tc filter add dev eth0 parent 1: protocol ip prio 2 u32 match ip dst 192.168.0.12 classid 1:2
/sbin/tc filter add dev eth0 parent 1: protocol ip prio 2 u32 match ip dst 192.168.0.13 classid 1:2

Ограничаване само на upload трафика по порт с пример за http, ftp и smb протоколи.

/sbin/tc qdisc del dev eth2 root
/sbin/tc qdisc add dev eth2 root handle 3: htb

/sbin/tc class add dev eth2 parent 3: classid 3:1 htb rate 50Mbit ceil 100Mbit
/sbin/tc filter add dev eth2 parent 3: protocol ip prio 1 u32 match ip sport 80 0xffff flowid 3:1 # web
/sbin/tc filter add dev eth2 parent 3: protocol ip prio 1 u32 match ip sport 20 0xffff flowid 3:1 # ftp
/sbin/tc filter add dev eth2 parent 3: protocol ip prio 1 u32 match ip sport 21 0xffff flowid 3:1 # ftp
/sbin/tc filter add dev eth2 parent 3: protocol ip prio 1 u32 match ip sport 139 0xffff flowid 3:1 # samba
/sbin/tc filter add dev eth2 parent 3: protocol ip prio 1 u32 match ip sport 445 0xffff flowid 3:1 # samba

Ограничаване на трафика в двете посоки с помоща на iptables чрез маркиране на пакети, маскиране зад публичен адрес и MAC контрол. Това е един от добрите варианти за упражняване на трафик контрол. От една страна правилата на маркираните пакети важат само за тези два интерфейса и контрола се упражнява само между тях. Това значи, че ако имате и eth1 интерфейс и маршрут през него ограниечнието няма да работи. От друга страна контрола е и в двете посоки, така може да се променя upload и download за всеки отделен клиент. Разбира се това са прости правила и е само пример за построяването на един Bandwidth Router.

tc qdisc del dev eth0 root
tc qdisc add dev eth0 root handle 1: cbq avpkt 1000 bandwidth 100mbit
tc class add dev eth0 parent 1: classid 1:1 cbq rate 100mbit allot 1500 prio 4 bounded isolated

tc qdisc del dev vlan149 root
tc qdisc add dev vlan149 root handle 1: cbq avpkt 1000 bandwidth 100mbit
tc class add dev vlan149 parent 1: classid 1:1 cbq rate 100mbit allot 1500 prio 4 bounded isolated

iptables -t nat -A POSTROUTING -s 172.16.11.2 -o vlan149 -j SNAT --to 212.70.158.90
iptables -A FORWARD -s 172.16.11.3 -m mac --mac-source ! 00:22:15:0a:7b:d4 -j DROP
iptables -t mangle -A FORWARD -i vlan149 -o eth0 -d 172.16.11.2 -j MARK --set-mark 0x20
iptables -t mangle -A FORWARD -o vlan149 -i eth0 -s 172.16.11.2 -j MARK --set-mark 0x21
tc class add dev eth0 parent 1: classid 1:20 cbq rate 4Mbit allot 1500 prio 1 bounded isolated
tc filter add dev eth0 parent 1: protocol ip prio 16 handle 0x20 fw classid 1:20
tc class add dev vlan149 parent 1: classid 1:20 cbq rate 4Mbit allot 1500 prio 5 bounded isolated
tc filter add dev vlan149 parent 1: protocol ip prio 16 handle 0x21 fw classid 1:20

iptables -t nat -A POSTROUTING -s 172.16.11.3 -o vlan149 -j SNAT --to 212.70.158.90
iptables -A FORWARD -s 172.16.11.3 -m mac --mac-source ! 00:22:15:0a:7b:d5 -j DROP
iptables -t mangle -A FORWARD -i vlan149 -o eth0 -d 172.16.11.3 -j MARK --set-mark 0x22
iptables -t mangle -A FORWARD -o vlan149 -i eth0 -s 172.16.11.3 -j MARK --set-mark 0x23
tc class add dev eth0 parent 1: classid 1:21 cbq rate 2Mbit allot 1500 prio 1 bounded isolated
tc filter add dev eth0 parent 1: protocol ip prio 16 handle 0x22 fw classid 1:21
tc class add dev vlan149 parent 1: classid 1:21 cbq rate 2Mbit allot 1500 prio 5 bounded isolated
tc filter add dev vlan149 parent 1: protocol ip prio 16 handle 0x23 fw classid 1:21

Ограничаване на трафика в двете посоки с помоща на iptables чрез маркиране на пакети с HTB

DEVIN=eth1
DEVOUT=tun0
SPEEDIN1=10Mbit
SPEEDDOWN1=2Mbit
SPEEDIN2=5Mbit
SPEEDDOWN2=1Mbit
BURST=100k
iptables -t mangle -A FORWARD -d 192.168.166.2 -j MARK --set-mark 0x3
iptables -t mangle -A FORWARD -s 192.168.166.2 -j MARK --set-mark 0x4
iptables -t mangle -A FORWARD -d 192.168.166.3 -j MARK --set-mark 0x5
iptables -t mangle -A FORWARD -s 192.168.166.3 -j MARK --set-mark 0x6
iptables -t mangle -A FORWARD -d 192.168.166.4 -j MARK --set-mark 0x7
iptables -t mangle -A FORWARD -s 192.168.166.4 -j MARK --set-mark 0x8
iptables -t mangle -A FORWARD -d 192.168.166.5 -j MARK --set-mark 0x9
iptables -t mangle -A FORWARD -s 192.168.166.5 -j MARK --set-mark 0x10
iptables -t mangle -A FORWARD -d 192.168.166.6 -j MARK --set-mark 0x11
iptables -t mangle -A FORWARD -s 192.168.166.6 -j MARK --set-mark 0x12
tc qdisc del dev $DEVIN root
tc qdisc add dev $DEVIN root handle 1: htb
tc class add dev $DEVIN parent 1: classid 1:2 htb rate $SPEEDIN1 burst $BURST
tc class add dev $DEVIN parent 1: classid 1:3 htb rate $SPEEDIN1 burst $BURST
tc class add dev $DEVIN parent 1: classid 1:4 htb rate $SPEEDIN2 burst $BURST
tc class add dev $DEVIN parent 1: classid 1:5 htb rate $SPEEDIN2 burst $BURST
tc class add dev $DEVIN parent 1: classid 1:6 htb rate $SPEEDIN2 burst $BURST
tc filter add dev $DEVIN parent 1: protocol ip prio 1 handle 0x3 fw classid 1:2
tc filter add dev $DEVIN parent 1: protocol ip prio 1 handle 0x5 fw classid 1:3
tc filter add dev $DEVIN parent 1: protocol ip prio 1 handle 0x7 fw classid 1:4
tc filter add dev $DEVIN parent 1: protocol ip prio 1 handle 0x9 fw classid 1:5
tc filter add dev $DEVIN parent 1: protocol ip prio 1 handle 0x11 fw classid 1:6
tc qdisc del dev $DEVOUT root
tc qdisc add dev $DEVOUT root handle 1: htb
tc class add dev $DEVOUT parent 1: classid 1:2 htb rate $SPEEDIN1 burst $BURST
tc class add dev $DEVOUT parent 1: classid 1:3 htb rate $SPEEDIN1 burst $BURST
tc class add dev $DEVOUT parent 1: classid 1:4 htb rate $SPEEDIN2 burst $BURST
tc class add dev $DEVOUT parent 1: classid 1:5 htb rate $SPEEDIN2 burst $BURST
tc class add dev $DEVOUT parent 1: classid 1:6 htb rate $SPEEDIN2 burst $BURST
tc filter add dev $DEVOUT parent 1: protocol ip prio 1 handle 0x4 fw classid 1:2
tc filter add dev $DEVOUT parent 1: protocol ip prio 1 handle 0x6 fw classid 1:3
tc filter add dev $DEVOUT parent 1: protocol ip prio 1 handle 0x8 fw classid 1:4
tc filter add dev $DEVOUT parent 1: protocol ip prio 1 handle 0x10 fw classid 1:5
tc filter add dev $DEVOUT parent 1: protocol ip prio 1 handle 0x12 fw classid 1:6

Малък NAT скрипт който взима информация от /et/ipclient със синтаксис ИП адрес на потребителя две точки ИП адрес на NAT маршрутизатора (192.168.0.2:93.155.130.10)

DEVIN=vlan100
DEVOUT=vlan149
DEVOUT2=tun0
SPEEDIN1=10Mbit
SPEEDDOWN1=1Mbit
SPEEDIN2=20Mbit
SPEEDDOWN2=2Mbit
CEIL=200Mbit
BURST=200k

tc qdisc del dev $DEVIN root
tc qdisc add dev $DEVIN root handle 1: htb default 10
tc qdisc del dev $DEVOUT root
tc qdisc add dev $DEVOUT root handle 1: htb default 20

	#IPCLIENT=`cat '/etc/ipclient'`;
IPCLIENT=`grep -v \# '/etc/ipclient'`;
for IPCLIENT in $IPCLIENT; do
IPCLIENT=(${IPCLIENT//:/ });
userid=`echo ${IPCLIENT[0]} | cut -d"." -f3`
userid1=`echo ${IPCLIENT[0]} | cut -d"." -f4`
iptables -t nat -A POSTROUTING -s ${IPCLIENT[0]} -o $DEVOUT -j SNAT --to ${IPCLIENT[1]}
tc class add dev $DEVIN parent 1: classid 1:${userid}${userid1} htb rate $SPEEDIN1 ceil $CEIL burst $BURST
tc filter add dev $DEVIN parent 1: protocol ip prio 1 u32 match ip dst ${IPCLIENT[0]} classid 1:${userid}${userid1}
tc class add dev $DEVOUT parent 1: classid 1:${userid}${userid1} htb rate $SPEEDDOWN1 ceil $CEIL burst $BURST
tc filter add dev $DEVOUT parent 1: protocol ip prio 1 handle 0x${userid}${userid1} fw classid 1:${userid}${userid1}
iptables -t mangle -A FORWARD -s ${IPCLIENT[0]} -j MARK --set-mark 0x${userid}${userid1};
done;

IPCLIENT="10.18.5.12:93.155.162.201 10.18.5.33:93.155.162.201 10.18.5.40:93.155.162.201 10.18.5.55:93.155.162.201 \
10.18.5.76:93.155.162.23 10.18.6.17:93.155.162.201 10.18.6.32:93.155.162.201 10.18.6.36:93.155.162.201 \
10.18.6.59:93.155.162.201 10.18.6.84:93.155.162.201";
for IPCLIENT in $IPCLIENT; do
IPCLIENT=(${IPCLIENT//:/ });
userid=`echo ${IPCLIENT[0]} | cut -d"." -f3`
userid1=`echo ${IPCLIENT[0]} | cut -d"." -f4`
iptables -t nat -A POSTROUTING -s ${IPCLIENT[0]} -o $DEVOUT -j SNAT --to ${IPCLIENT[1]}
tc class add dev $DEVIN parent 1: classid 1:${userid}${userid1} htb rate $SPEEDIN2 ceil $CEIL burst $BURST
tc filter add dev $DEVIN parent 1: protocol ip prio 1 u32 match ip dst ${IPCLIENT[0]} classid 1:${userid}${userid1}
tc class add dev $DEVOUT parent 1: classid 1:${userid}${userid1} htb rate $SPEEDDOWN2 ceil $CEIL burst $BURST
tc filter add dev $DEVOUT parent 1: protocol ip prio 1 handle 0x${userid}${userid1} fw classid 1:${userid}${userid1}
iptables -t mangle -A FORWARD -s ${IPCLIENT[0]} -j MARK --set-mark 0x${userid}${userid1};
done;

Подобни публикации:

  1. Debian – iptables + tc защитна стена с трафик контрол
  2. Debian – iptables – защитна стена
  3. Debian – Policy Routing – iptables mark routing
  4. Debian – Policy Routing – iptables mark port and protocol
  5. Vyatta – QOS – Quality of service
Tags: , , , , , , , , ,

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.