Dear All,

I have changed our settings as following.
I can guarantee the download speed of PC1's http service around 200kbit.
However, I can't guarantee 200kbit to PC1 when PC2 or PC3 started to download.
Perhaps I am writing the settings wrong? Thanks for your help in advance.

Environment:
[PC1, PC2, PC3] <-->eth0[QoS with Bridage Mode]eth1<--> [NAT]<--> [Internet]
PC1 IP: 192.168.200.11/32
PC2 IP: 192.168.200.22/32
PC3 IP: 192.168.200.33/32


[QoS: tc script]
#!/bin/sh
PATH=$PATH:/usr/local/sbin:/sbin

###### Download setting ######
#Del DL/UL device
tc qdisc del dev eth0 root
tc qdisc del dev eth1 root

#Create DL Device information
tc qdisc add dev eth0 root handle 1: htb default 7
tc class add dev eth0 parent 1: classid 1:1 htb rate 512kbit ceil 512kbit

#Default DL flow
tc class add dev eth0 parent 1:1 classid 1:7 htb rate 10kbit ceil 512kbit prio 7
tc qdisc add dev eth0 parent 1:7 handle 77: sfq perturb 10

#or rate 200kbit ceil 512kbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 200kbit ceil 200kbit prio 0
tc qdisc add dev eth0 parent 1:10 handle 10: sfq


##### Upload setting ######
#Create UL Device information
tc qdisc add dev eth1 root handle 1000: htb default 8
tc class add dev eth1 parent 1000: classid 1000:1 htb rate 512kbit ceil 512kbit

#Default UL flow
tc class add dev eth1 parent 1000:1 classid 1000:8 htb rate 10kbit ceil 512kbit prio 7
tc qdisc add dev eth1 parent 1000:8 handle 88: sfq perturb 10


# tc filter add dev eth0 parent 1:0 protocol ip prio 0 handle 10000 fw flowid 1:10
tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dst 192.168.200.11/32 match ip sport 80 0xffff flowid 1:10


Best regards,


Dias

For the rate 200kbit ceil 200kbit case, using prio parameter is not necessary since the 'high prio' class does not have to borrow anyway. I don't recall exactly how many prio levels there are in HTB, but they were not many, so maybe prio 7 is too high a value already?

You also should be aware of the shaping download traffic problems. You actually don't have any influence on the packets that are sent to you. All you can do (so far) is drop packets and hope that the other side is using a TCP/IP implementation that tries to send slower in this case.

Also, you are using SFQ. Be aware that SFQ works by reordering packets, which means they are queued (standard queue 128 packets per SFQ) and then shuffled. This can cause delays, thus you should not use SFQ for interactive traffic.

This setup is incomplete. Class 1000:8 is an only child. You only have one leaf class you can put traffic into. In other words, there is no other traffic than default traffic. It actually has always 512kbit worth of traffic, because there is no other class that could borrow that bandwidth away. So all this setup does is limit upload to 512kbit, nothing else.

In HTB, only childs never make sense!

Thank you very much for your help.

I have changed our settings as following.
I'd like to borrow remaining bandwidth from 1:7 to 1:10.
How do I fix my settings?

prio 0 : High priority
prio 7 : Low priority


[TC script]
#Del DL device
tc qdisc del dev eth0 root

#Create DL Device information
tc qdisc add dev eth0 root handle 1: htb r2q 1 default 7
tc class add dev eth0 parent 1: classid 1:11 htb rate 512kbit ceil 512kbit

#HTTP service
tc class add dev eth0 parent 1:11 classid 1:10 htb rate 350kbit ceil 512kbit prio 0
tc qdisc add dev eth0 parent 1:10 handle 10: pfifo

#Default DL flow
tc class add dev eth0 parent 1:11 classid 1:7 htb rate 150kbit ceil 512kbit prio 7
tc qdisc add dev eth0 parent 1:7 handle 77: pfifo

tc filter add dev eth1 parent 1000:0 protocol ip prio 0 handle 10000 fw flowid 1000:10

#Do I need following settings?
#tc qdisc add dev eth0 handle ffff: ingress
#tc filter add dev eth0 parent ffff: protocol ip prio 7 u32 match ip dst 0.0.0.0/0 police rate 512kbit burst 10k drop flowid :7


[iptables script]
iptables -A FORWARD -t mangle -j CONNMARK --restore-mark
iptables -A FORWARD -t mangle -m mark ! --mark 0 -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -j MARK --set-mark 10000 -m state --state ESTABLISHED,RELATED -s 192.168.200.115/32 -d 0.0.0.0/0 -t man
gle
iptables -A FORWARD -t mangle -j CONNMARK --save-mark



Best regards,


Dias