On Jan-26 2004, Mon, 16:55 +0300
Vladimir B. Savkin <master@xxxxxxxxxxxxxx> wrote:
> +---------+ +-ppp0- ... - client0
> | +-eth1-<+-ppp1- ... - client1
> Internet ----- eth0-+ router | . . . . . . . .
> | +-eth2-< . . . . . .
> +---------+ +-pppN- ... - clientN
Actually, this is very much like what we're using IMQ for:
+-----------+ eth1 --- \
| shaper + eth2 ---
Internet --- eth0 + in bridge + . --- ... WAN (10 C's of customer IPs)
| setup + . ---
+-----------+ ethN --- /
We're shaping single IPs and groups of IPs, applying tariff rates
on the sum of inbound and outbound flow (this last point, I'm told,
is the primary reason for our use of IMQ). The machine also does
IP accounting (through custom userland software based on libpcap)
and has to be an ethernet bridge so that it can be replaced by
a piece of wire should it fail and there was no backup hardware left.
At this moment we're on sfq/u32/htb/IMQ/mangle. We've figured out
that unless we mess with iptable_nat, IMQ-enabled kernels will work
perfectly reliably (SNAT in particular seems deadly). We don't
insist on IMQ. In fact, we would be very grateful if somebody
could point us to an alternative mechanism to IMQ that would allow
us to effectively shape by the sum of both traffic directions of
a given IP, as we'd like to deploy "shaping firewalls" that would
also do SNAT.
--
Tomas Szepe <szepe@xxxxxxxxxxxxxxx>
|