LinuxQuestions.org - help with imq device and iptables

hell there

i am trying to setup traffic control on eth0 (external interface) and the imq

my firewall script looks like this:

#!/bin/bash
. /etc/rc.d/init.d/firewall.conf
#
#firewallFirewall startup/shutdown script
#
#Version: @(#) /etc/rc.d/init.d/firewall.iptables 5-oct-2003
#
#Copyright Linux Solutions Nigeria Limited 2003
#
#
#description: Starts shell processes for Kernel Services
#

# Enable ip forwarding and check against ip spoofing
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

# Enable IMQ module
/sbin/modprobe imq

echo "Starting firewall on Linuxbox"
echo "....."
echo "..........."
echo "......................"

# Flush Chains
$IPTABLES -F
$IPTABLES -t mangle -F
$IPTABLES -t nat -F

#Configure routing and firewall rules
# Set default policies
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT

# Enable internal connections to this box
$IPTABLES -A INPUT -i ${INTERNAL_INTERFACE} -j ACCEPT
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A INPUT -i ${INTERNAL_INTERFACE} -p udp --dport 137 -j DROP
$IPTABLES -A INPUT -i ${EXTERNAL_INTERFACE} -m state --state ESTABLISHED,RELATED
-j ACCEPT
$IPTABLES -A FORWARD -i ${EXTERNAL_INTERFACE} -p tcp --dport 135:139 -j DROP
$IPTABLES -A FORWARD -i ${EXTERNAL_INTERFACE} -p udp --dport 135:139 -j DROP
$IPTABLES -A INPUT -i ${EXTERNAL_INTERFACE} -p tcp --dport ${DPORT1} -j ACCEPT
$IPTABLES -A INPUT -i ${EXTERNAL_INTERFACE} -p tcp --dport ${DPORT2} -j ACCEPT

# Enable NAT

$IPTABLES -t nat -A POSTROUTING -s ${INTERNAL_NETWORK} -o ${EXTERNAL_INTERFACE} -j SNAT --to-source ${EXTERNAL_IP}

# Mark packets for shaping
$IPTABLES -t mangle -A PREROUTING -i ${INTERNAL_INTERFACE} --src ${PHONE_IP} -j MARK --set-mark 1
$IPTABLES -t mangle -A PREROUTING -i ${EXTERNAL_INTERFACE} -p tcp -j MARK --set-mark 2
#$IPTABLES -t mangle -A PREROUTING -i ${EXTERNAL_INTERFACE} -p tcp --sport 10000:20000 -j MARK --set-mark 2
$IPTABLES -t mangle -A PREROUTING -i ${EXTERNAL_INTERFACE} -p udp --sport 1:53 -j MARK --set-mark 2
$IPTABLES -t mangle -A PREROUTING -i ${EXTERNAL_INTERFACE} -p udp --dport 1:53 -j MARK --set-mark 2
$IPTABLES -t mangle -A PREROUTING -i ${EXTERNAL_INTERFACE} -p udp --dport 5000 -j MARK --set-mark 2

#Drop invalid nat requests
$IPTABLES -t nat -A PREROUTING -i ${INTERNAL_INTERFACE} --dst 169.254.0.0/16 -j DROP
$IPTABLES -t nat -A PREROUTING -i ${INTERNAL_INTERFACE} -p tcp --dport 443 --dst ! 217.107.162.88/32 -j DROP
$IPTABLES -t nat -A PREROUTING -i ${INTERNAL_INTERFACE} --src 169.254.0.0/16 -j DROP
$IPTABLES -t nat -A PREROUTING -i ${INTERNAL_INTERFACE} -p icmp -s ${PHONE_IP} -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i ${INTERNAL_INTERFACE} -p icmp -j DROP

#Disable SMTP
$IPTABLES -A INPUT -p tcp --dport 25 -j DROP
$IPTABLES -A FORWARD -p tcp --dport 25 -j DROP

# Run transparent proxy
$IPTABLES -t nat -A PREROUTING -i ${INTERNAL_INTERFACE} -p tcp --dport ${BROWSE} -j REDIRECT --to-port ${PROXY}
#$IPTABLES -t nat -A PREROUTING -i ${INTERNAL_INTERFACE} -p tcp --dport ${FTP} -j REDIRECT --to-port ${PROXY}
$IPTABLES -t nat -A PREROUTING -i ${INTERNAL_INTERFACE} -p tcp --dport ${SSL} -j REDIRECT --to-port ${PROXY}

#Send Traffic to IMQ device
$IPTABLES -A PREROUTING -t mangle -i ${EXTERNAL_INTERFACE} -j IMQ --todev 0
ip link set imq0 up
echo "Linuxbox is now secure!"
echo
echo
echo

And my traffic control script looks like this:

#!/bin/bash

##description: A light utility to simulate system load processes for optimal ada
ptation
# Bandwidth Shaping / Limiting section
##notes
##kbps = kilobyte/s
##kb = kilobyte
##kbit = kilobit/s or kilobit

#clean existing down and uplink qdiscs on all interfaces, hide errors
tc qdisc del dev eth0 root 2> /dev/null > /dev/null
tc qdisc del dev imq0 root 2> /dev/null > /dev/null

#Create root IMQ and regular tc device and specify default class
TCQ="tc qdisc add dev"
$TCQ imq0 root handle 1: htb default 10
$TCQ eth0 root handle 1: prio

# Classes
####Uplink
$TCQ eth0 parent 1:1 handle 10: sfq perturb
$TCQ eth0 parent 1:2 handle 20: sfq perturb 10

##Filters
TCF="tc filter add dev"
##filters
#phone
$TCF eth0 protocol ip parent 1:0 prio 1 handle 1 fw classid 1:1

###Downlink
#Parent-Vsat downlink speed
$TCC imq0 parent 1: classid 1:1 htb rate 48kbit burst 15k

##Phone
$TCC imq0 parent 1:1 classid 1:10 htb rate 18kbit ceil 30kbit prio 1
##Browsing
$TCC imq0 parent 1:1 classid 1:11 htb rate 14kbit ceil 48kbit prio 2

##fairness within each class
$TCQ imq0 parent 1:10 handle 10: sfq perturb 10
$TCQ imq0 parent 1:11 handle 11: sfq perturb 10

##Filters
$TCF imq0 protocol ip parent 1:0 prio 1 handle 2 fw classid 1:11

$TCF imq0 parent 1:0 protocol ip prio 2 u32 match ip dst 192.168.0.2 flowid 1:10

The firewall.conf scripts wch the first scripts refers to looks like this:

#!/bin/bash
#Global variables
IPTABLES=/sbin/iptables

EXTERNAL_INTERFACE=eth0
INTERNAL_INTERFACE=eth1

INTERNAL_NETWORK=192.168.0.0/24
EXTERNAL_NETWORK=213.255.192.96/28

EXTERNAL_IP=213.255.192.99

PHONE_IP=192.168.0.2

#Internal Connections
DPORT1=22
DPORT2=10000

#Enabling Safe Ports
BROWSE=80
PROXY=8080
FTP=21
SSL=556

When i run the bandwidth.conf script, the error is

/etc/rc.d/init.d/bandwidth.conf start
Command line is not complete. Try option "help"
/etc/rc.d/init.d/bandwidth.conf: line 34: imq0: command not found
/etc/rc.d/init.d/bandwidth.conf: line 37: imq0: command not found
/etc/rc.d/init.d/bandwidth.conf: line 39: imq0: command not found
RTNETLINK answers: Invalid argument
RTNETLINK answers: Invalid argument

when i restart the firewall script, the error is

[root@linuxbox init.d]# /etc/rc.d/init.d/firewall.ipt restart
Starting firewall on Linuxbox
.....
...........
......................
.........................................
iptables v1.2.8: Unknown arg `--todev'
Try `iptables -h' or 'iptables --help' for more information.
Linuxbox is now secure!

i feel the imq module was not properly loaded but it appears when i do

ip link show

it gives

5: imq0: <NOARP,UP> mtu 1500 qdisc htb qlen 30
link/void

pls what cud be wrong?