Limit bandwidth of a network interface : tc and iptables doesn't work ?

MathX · 10-10-2010, 03:26 PM

Hi,

I try to limit the bandwidth of my eth0 interface. I have read several articles about it and i have tried the followings commands :

Quote:

tc qdisc add dev eth0 root handle 1: htb default 30
tc class add dev eth0 parent 1: classid 1:1 htb rate 100kbit
tc filter add dev eth0 parent 1:0 prio 1 protocol ip handle 5 fw flowid 1:1
iptables -A INPUT -t mangle -j MARK --set-mark 5

But it doesn't work. I have tried several others scripts too, again without success.
I'm running on Archlinux and I test the download speed with wget after these commands, but I always arrive at the maximum speed of my ADSL connection, and not the restricted speed.

My script is correct ? In all cases, it doesn't return an error. Or is it something else ?

Thanks.

rayfordj · 10-11-2010, 08:16 AM

You police ingress (inbound) and shape(limit) egress (outbound). There is not much in the way of policing short of just dropping packets. If eth0 is your WAN/ISP uplink, you can try something like this to see if you get the results you expect...

Code:

# clear it
/sbin/tc qdisc del dev eth0 ingress 
# police it
/sbin/tc qdisc add dev eth0 handle ffff: ingress
/sbin/tc filter add dev eth0 protocol ip parent ffff: prio 50 u32 match ip \
     src 0.0.0.0/0 police rate 128kbit burst 15k drop flowid :1

Where 128 is the number, in Kilobits, you want to police incoming traffic.

MathX · 10-11-2010, 11:04 AM

It works fine, thanks !

But I've two others questions :
- It works with virtual interfaces (like with eth0:1 par example) ?
- Is there a method to restrict the uplink and the downlink together at 128kbit ? It works well for the down, but not for the up.

Thank you again

EDIT : I have readed this article which says

Quote:

For traffic accepted on an interface, the ingress qdisc is traversed. With its limited utility, it allows no child class to be created, and only exists as an object onto which a filter can be attached. For practical purposes, the ingress qdisc is merely a convenient object onto which to attach a policer to limit the amount of traffic accepted on a network interface.

If I understand correctly, the police on ingress limits the uplink too ? So I made a mistake in my uplink tests ?

rayfordj · 10-12-2010, 08:44 AM

Quote:

Originally Posted by MathX

- It works with virtual interfaces (like with eth0:1 par example) ?

I do not know.

Quote:

Originally Posted by MathX

- Is there a method to restrict the uplink and the downlink together at 128kbit ?

No, but you may limit them separately at the same rate. Personally, I don't use iptables' MARK. For a quick test you could try something like...

Code:

# clear it
/sbin/tc qdisc del dev eth0 root
# shape it
/sbin/tc qdisc add dev eth0 root handle 1: htb default 1
/sbin/tc class add dev eth0 parent 1: classid 1:1 htb rate 128kbit \
     quantum 3000 burst 15k
/sbin/tc qdisc add dev eth0 parent 1:1 handle 10: sfq perturb 10

Quote:

Originally Posted by MathX

If I understand correctly, the police on ingress limits the uplink too ? So I made a mistake in my uplink tests ?

police on ingress limits the incoming (download) on that interface. shaping on egress is what will limit the outgoing (upload) on that interface.

MathX · 10-12-2010, 02:41 PM

Works fine too, thanks !