Traffic shaping with tc - Revision history

Poiuty at 00:12, 12 December 2013

2013-12-12T00:12:41Z

Show changes

79.151.191.115: /* An alternate approch using HTB */ approch -> approach

2013-03-16T16:24:54Z

‎An alternate approch using HTB: approch -> approach

Kir: Reverted edits by 190.12.44.180 (talk) to last revision by Kir

2011-11-28T05:27:30Z

Reverted edits by 190.12.44.180 (talk) to last revision by Kir

190.12.44.180: hYaKOcJVWzNGfWBE

2011-11-28T04:09:44Z

hYaKOcJVWzNGfWBE

Kir: Reverted edits by 77.121.217.121 (Talk) to last revision by Kir

2011-02-12T09:03:27Z

Reverted edits by 77.121.217.121 (Talk) to last revision by Kir

77.121.217.121: Very nice post, good luck! ;-)

2011-02-12T08:37:49Z

Very nice post, good luck! ;-)

Kir: VE -> container, CT

2008-03-11T12:59:30Z

VE -> container, CT

Kir: /* Limiting packets per second rate from VE */ use source tag

2007-12-25T05:23:29Z

‎Limiting packets per second rate from VE: use source tag

Kir: /* An alternate approch using HTB */ use source tag

2007-12-25T05:22:38Z

‎An alternate approch using HTB: use source tag

BillW: /* An alternate approch using HTB */

2007-06-05T13:37:14Z

‎An alternate approch using HTB

@@ Line 60: / Line 60: @@
 Here <code>X.X.X.X</code> is an IP address of container.
-== An alternate approch using HTB ==
+== An alternate approach using HTB ==
 For details refer to the [http://luxik.cdi.cz/~devik/qos/htb/ HTB Home Page]

← Older revision		Revision as of 05:27, 28 November 2011
Line 1:		Line 1:
−	~~I was really confused~~, and this ~~answered all my qeustonis~~.	+	Sometimes it's necessary to limit traffic bandwidth from and to a [[container]].
		+	You can do it using ordinary <code>tc</code> tool.
		+
		+	== Packet routes ==
		+	First of all, a few words about how packets travel from and to a [[container]].
		+	Suppose we have [[Hardware Node]] (HN) with a container (CT) on it, and this
		+	container talks to some Remote Host (RH). HN has one "real" network interface
		+	<tt>eth0</tt> and,
		+	thanks to OpenVZ, there is also "virtual" network interface <tt>venet0</tt>.
		+	Inside the container we have interface <tt>venet0:0</tt>.
		+
		+	<pre>
		+	venet0:0 venet0 eth0
		+	CT >------------->-------------> HN >--------->--------> RH
		+
		+	venet0:0 venet0 eth0
		+	CT <-------------<-------------< HN <---------<--------< RH
		+	</pre>
		+
		+	== Limiting outgoing bandwidth ==
		+	We can limit container outgoing bandwidth by setting the <tt>tc</tt> filter on <tt>eth0</tt>.
		+	<pre>
		+	DEV=eth0
		+	tc qdisc del dev $DEV root
		+	tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 100mbit
		+	tc class add dev $DEV parent 1: classid 1:1 cbq rate 256kbit allot 1500 prio 5 bounded isolated
		+	tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip src X.X.X.X flowid 1:1
		+	tc qdisc add dev $DEV parent 1:1 sfq perturb 10
		+	</pre>
		+	X.X.X.X is an IP address of container.
		+
		+	== Limiting incoming bandwidth ==
		+	This can be done by setting the <code>tc</code> filter on <code>venet0</code>:
		+	<pre>
		+	DEV=venet0
		+	tc qdisc del dev $DEV root
		+	tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 100mbit
		+	tc class add dev $DEV parent 1: classid 1:1 cbq rate 256kbit allot 1500 prio 5 bounded isolated
		+	tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst X.X.X.X flowid 1:1
		+	tc qdisc add dev $DEV parent 1:1 sfq perturb 10
		+	</pre>
		+	Note that <code>X.X.X.X</code> is an IP address of container.
		+
		+	== Limiting CT to HN talks ==
		+	As you can see, two filters above don't limit [[container]] to [[HN]] talks.
		+	I mean a [[container]] can emit as much traffic as it wishes. To make such a limitation from the [[HN]],
		+	it is necessary to use <tt>tc</tt> police on <tt>venet0</tt>:
		+	<pre>
		+	DEV=venet0
		+	tc filter add dev $DEV parent 1: protocol ip prio 20 u32 match u32 1 0x0000 police rate 2kbit buffer 10k drop flowid :1
		+	</pre>
		+
		+	== Limiting packets per second rate from container ==
		+	To prevent dos atacks from the container you can limit packets per second rate using iptables.
		+	<source lang="bash">
		+	DEV=eth0
		+	iptables -I FORWARD 1 -o $DEV -s X.X.X.X -m limit --limit 200/sec -j ACCEPT
		+	iptables -I FORWARD 2 -o $DEV -s X.X.X.X -j DROP
		+	</source>
		+	Here <code>X.X.X.X</code> is an IP address of container.
		+
		+	== An alternate approch using HTB ==
		+
		+	For details refer to the [http://luxik.cdi.cz/~devik/qos/htb/ HTB Home Page]
		+
		+	<source lang="bash">
		+	#!/bin/sh
		+	#
		+	# Incoming traffic control
		+	#
		+	CT_IP1=$1
		+	CT_IP2=$2
		+	DEV=venet0
		+	#
		+	tc qdisc del dev $DEV root
		+	#
		+	tc qdisc add dev $DEV root handle 1: htb default 10
		+	#
		+	tc class add dev $DEV parent 1: classid 1:1 htb rate 100mbit burst 15k
		+	tc class add dev $DEV parent 1:1 classid 1:10 htb rate 10mbit ceil 10mbit burst 15k
		+	tc class add dev $DEV parent 1:1 classid 1:20 htb rate 20mbit ceil 20mbit burst 15k
		+	tc class add dev $DEV parent 1:1 classid 1:30 htb rate 30mbit ceil 30mbit burst 15k
		+	#
		+	tc qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10
		+	tc qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10
		+	tc qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10
		+	#
		+	if [ ! -z $CT_IP1 ]; then
		+	tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip dst "$CT_IP1" flowid 1:20
		+	fi
		+	if [ ! -z $CT_IP2 ]; then
		+	tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip dst "$CT_IP2" flowid 1:30
		+	fi
		+	#
		+	echo;echo "tc configuration for $DEV:"
		+	tc qdisc show dev $DEV
		+	tc class show dev $DEV
		+	tc filter show dev $DEV
		+	#
		+	# Outgoing traffic control
		+	#
		+	DEV=eth0
		+	#
		+	tc qdisc del dev $DEV root
		+	#
		+	tc qdisc add dev $DEV root handle 1: htb default 10
		+	#
		+	tc class add dev $DEV parent 1: classid 1:1 htb rate 100mbit burst 15k
		+	tc class add dev $DEV parent 1:1 classid 1:10 htb rate 10mbit ceil 10mbit burst 15k
		+	tc class add dev $DEV parent 1:1 classid 1:20 htb rate 20mbit ceil 20mbit burst 15k
		+	tc class add dev $DEV parent 1:1 classid 1:30 htb rate 30mbit ceil 30mbit burst 15k
		+	#
		+	tc qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10
		+	tc qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10
		+	tc qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10
		+	#
		+	if [ ! -z $CT_IP1 ]; then
		+	tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip src "$CT_IP1" flowid 1:20
		+	fi
		+	if [ ! -z $CT_IP2 ]; then
		+	tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip src "$CT_IP2" flowid 1:30
		+	fi
		+	#
		+	echo;echo "tc configuration for $DEV:"
		+	tc qdisc show dev $DEV
		+	tc class show dev $DEV
		+	tc filter show dev $DEV
		+	</source>
		+
		+	== External links ==
		+	* [http://lartc.org/howto/ Linux Advanced Routing & Traffic Control HOWTO]
		+
		+	[[Category: HOWTO]]
		+	[[Category: Networking]]

← Older revision		Revision as of 04:09, 28 November 2011
Line 1:		Line 1:
−	~~Sometimes it's necessary to limit traffic bandwidth from and to a [[container]].~~	+	I was really confused, and this answered all my qeustonis.
−	~~You can do it using ordinary <code>tc</code> tool.~~
−
−	~~== Packet routes ==~~
−	~~First of all, a few words about how packets travel from and to a [[container]].~~
−	~~Suppose we have [[Hardware Node]] (HN) with a container (CT) on it~~, and this
−	~~container talks to some Remote Host (RH). HN has one "real" network interface~~
−	~~<tt>eth0</tt> and,~~
−	~~thanks to OpenVZ, there is also "virtual" network interface <tt>venet0</tt>.~~
−	~~Inside the container we have interface <tt>venet0:0</tt>.~~
−
−	~~<pre>~~
−	~~venet0:0 venet0 eth0~~
−	~~CT >------------->-------------> HN >--------->--------> RH~~
−
−	~~venet0:0 venet0 eth0~~
−	~~CT <-------------<-------------< HN <---------<--------< RH~~
−	~~</pre>~~
−
−	~~== Limiting outgoing bandwidth ==~~
−	~~We can limit container outgoing bandwidth by setting the <tt>tc</tt> filter on <tt>eth0</tt>.~~
−	~~<pre>~~
−	~~DEV=eth0~~
−	~~tc qdisc del dev $DEV root~~
−	~~tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 100mbit~~
−	~~tc class add dev $DEV parent 1: classid 1:1 cbq rate 256kbit allot 1500 prio 5 bounded isolated~~
−	~~tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip src X.X.X.X flowid 1:1~~
−	~~tc qdisc add dev $DEV parent 1:1 sfq perturb 10~~
−	~~</pre>~~
−	~~X.X.X.X is an IP address of container.~~
−
−	~~== Limiting incoming bandwidth ==~~
−	~~This can be done by setting the <code>tc</code> filter on <code>venet0</code>:~~
−	~~<pre>~~
−	~~DEV=venet0~~
−	~~tc qdisc del dev $DEV root~~
−	~~tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 100mbit~~
−	~~tc class add dev $DEV parent 1: classid 1:1 cbq rate 256kbit allot 1500 prio 5 bounded isolated~~
−	~~tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst X.X.X.X flowid 1:1~~
−	~~tc qdisc add dev $DEV parent 1:1 sfq perturb 10~~
−	~~</pre>~~
−	~~Note that <code>X.X.X.X</code> is an IP address of container.~~
−
−	~~== Limiting CT to HN talks ==~~
−	~~As you can see, two filters above don't limit [[container]] to [[HN]] talks.~~
−	~~I mean a [[container]] can emit as much traffic as it wishes. To make such a limitation from the [[HN]],~~
−	~~it is necessary to use <tt>tc</tt> police on <tt>venet0</tt>:~~
−	~~<pre>~~
−	~~DEV=venet0~~
−	~~tc filter add dev $DEV parent 1: protocol ip prio 20 u32 match u32 1 0x0000 police rate 2kbit buffer 10k drop flowid :1~~
−	~~</pre>~~
−
−	~~== Limiting packets per second rate from container ==~~
−	~~To prevent dos atacks from the container you can limit packets per second rate using iptables.~~
−	~~<source lang="bash">~~
−	~~DEV=eth0~~
−	~~iptables -I FORWARD 1 -o $DEV -s X.X.X.X -m limit --limit 200/sec -j ACCEPT~~
−	~~iptables -I FORWARD 2 -o $DEV -s X.X.X.X -j DROP~~
−	~~</source>~~
−	~~Here <code>X.X.X.X</code> is an IP address of container.~~
−
−	~~== An alternate approch using HTB ==~~
−
−	~~For details refer to the [http://luxik.cdi.cz/~devik/qos/htb/ HTB Home Page]~~
−
−	~~<source lang="bash">~~
−	~~#!/bin/sh~~
−	#
−	~~# Incoming traffic control~~
−	#
−	~~CT_IP1=$1~~
−	~~CT_IP2=$2~~
−	~~DEV=venet0~~
−	#
−	~~tc qdisc del dev $DEV root~~
−	#
−	~~tc qdisc add dev $DEV root handle 1: htb default 10~~
−	#
−	~~tc class add dev $DEV parent 1: classid 1:1 htb rate 100mbit burst 15k~~
−	~~tc class add dev $DEV parent 1:1 classid 1:10 htb rate 10mbit ceil 10mbit burst 15k~~
−	~~tc class add dev $DEV parent 1:1 classid 1:20 htb rate 20mbit ceil 20mbit burst 15k~~
−	~~tc class add dev $DEV parent 1:1 classid 1:30 htb rate 30mbit ceil 30mbit burst 15k~~
−	#
−	~~tc qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10~~
−	~~tc qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10~~
−	~~tc qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10~~
−	#
−	~~if [ ! -z $CT_IP1 ]; then~~
−	~~tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip dst "$CT_IP1" flowid 1:20~~
−	fi
−	~~if [ ! -z $CT_IP2 ]; then~~
−	~~tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip dst "$CT_IP2" flowid 1:30~~
−	fi
−	#
−	~~echo;echo "tc configuration for $DEV:"~~
−	~~tc qdisc show dev $DEV~~
−	~~tc class show dev $DEV~~
−	~~tc filter show dev $DEV~~
−	#
−	~~# Outgoing traffic control~~
−	#
−	~~DEV=eth0~~
−	#
−	~~tc qdisc del dev $DEV root~~
−	#
−	~~tc qdisc add dev $DEV root handle 1: htb default 10~~
−	#
−	~~tc class add dev $DEV parent 1: classid 1:1 htb rate 100mbit burst 15k~~
−	~~tc class add dev $DEV parent 1:1 classid 1:10 htb rate 10mbit ceil 10mbit burst 15k~~
−	~~tc class add dev $DEV parent 1:1 classid 1:20 htb rate 20mbit ceil 20mbit burst 15k~~
−	~~tc class add dev $DEV parent 1:1 classid 1:30 htb rate 30mbit ceil 30mbit burst 15k~~
−	#
−	~~tc qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10~~
−	~~tc qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10~~
−	~~tc qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10~~
−	#
−	~~if [ ! -z $CT_IP1 ]; then~~
−	~~tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip src "$CT_IP1" flowid 1:20~~
−	fi
−	~~if [ ! -z $CT_IP2 ]; then~~
−	~~tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip src "$CT_IP2" flowid 1:30~~
−	fi
−	#
−	~~echo;echo "tc configuration for $DEV:"~~
−	~~tc qdisc show dev $DEV~~
−	~~tc class show dev $DEV~~
−	~~tc filter show dev $DEV~~
−	~~</source>~~
−
−	~~== External links ==~~
−	* [http://lartc.~~org/howto/ Linux Advanced Routing & Traffic Control HOWTO]~~
−
−	~~[[Category: HOWTO]]~~
−	~~[[Category: Networking]]~~

@@ Line 2: / Line 2: @@
 You can do it using ordinary <code>tc</code> tool.
-Very nice post, good luck! ;-)
+== Packet routes ==
 == Limiting outgoing bandwidth ==

@@ Line 2: / Line 2: @@
 You can do it using ordinary <code>tc</code> tool.
-== Packet routes ==
+Very nice post, good luck! ;-)
 == Limiting outgoing bandwidth ==

@@ Line 1: / Line 1: @@
-Sometimes it's necessary to limit traffic bandwidth from and to a [[VE]].
+Sometimes it's necessary to limit traffic bandwidth from and to a [[container]].
 You can do it using ordinary <code>tc</code> tool.
 == Packet routes ==
-First of all, a few words about how packets travel from and to a [[VE]].
+First of all, a few words about how packets travel from and to a [[container]].
-Suppose we have [[Hardware Node]] (HN) with a VE on it, and this VE talks
+Suppose we have [[Hardware Node]] (HN) with a container (CT) on it, and this
-to some Remote Host (RH). HN has one "real" network interface <tt>eth0</tt> and,
+container talks to some Remote Host (RH). HN has one "real" network interface
 thanks to OpenVZ, there is also "virtual" network interface <tt>venet0</tt>.
-Inside the VE we have interface <tt>venet0:0</tt>.
+Inside the container we have interface <tt>venet0:0</tt>.
 <pre>
      venet0:0               venet0    eth0
-VE >------------->-------------> HN >--------->--------> RH
+CT >------------->-------------> HN >--------->--------> RH
      venet0:0               venet0    eth0
-VE <-------------<-------------< HN <---------<--------< RH
+CT <-------------<-------------< HN <---------<--------< RH
 </pre>
 == Limiting outgoing bandwidth ==
-We can limit VE outgoing bandwidth by setting the <tt>tc</tt> filter on <tt>eth0</tt>.
+We can limit container outgoing bandwidth by setting the <tt>tc</tt> filter on <tt>eth0</tt>.
 <pre>
 DEV=eth0
@@ Line 27: / Line 28: @@
 tc qdisc add dev $DEV parent 1:1 sfq perturb 10
 </pre>
-X.X.X.X is an IP address of VE.
+X.X.X.X is an IP address of container.
 == Limiting incoming bandwidth ==
@@ Line 39: / Line 40: @@
 tc qdisc add dev $DEV parent 1:1 sfq perturb 10
 </pre>
-Note that <code>X.X.X.X</code> is an IP address of VE.
+Note that <code>X.X.X.X</code> is an IP address of container.
-== Limiting VE to HN talks ==
+== Limiting CT to HN talks ==
-As you can see, two filters above don't limit [[VE]] to [[HN]] talks.
+As you can see, two filters above don't limit [[container]] to [[HN]] talks.
-I mean a [[VE]] can emit as much traffic as it wishes. To make such a limitation from the [[HN]],
+I mean a [[container]] can emit as much traffic as it wishes. To make such a limitation from the [[HN]],
 it is necessary to use <tt>tc</tt> police on <tt>venet0</tt>:
 <pre>
@@ Line 50: / Line 51: @@
 </pre>
-== Limiting packets per second rate from VE ==
+== Limiting packets per second rate from container ==
-To prevent dos atacks from the VE you can limit packets per second rate using iptables.
+To prevent dos atacks from the container you can limit packets per second rate using iptables.
 <source lang="bash">
 DEV=eth0
@@ Line 57: / Line 58: @@
 iptables -I FORWARD 2 -o $DEV -s X.X.X.X -j DROP
 </source>
-Here <code>X.X.X.X</code> is an IP address of VE
+Here <code>X.X.X.X</code> is an IP address of container.
 == An alternate approch using HTB ==
@@ Line 68: / Line 69: @@
 # Incoming traffic control
+#
-VE_IP1=$1
+CT_IP1=$1
-VE_IP2=$2
+CT_IP2=$2
 DEV=venet0
+#
@@ Line 85: / Line 86: @@
 tc qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10
+#
-if [ ! -z $VE_IP1 ]; then
+if [ ! -z $CT_IP1 ]; then
-     tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip dst "$VE_IP1" flowid 1:20
+     tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip dst "$CT_IP1" flowid 1:20
 fi
-if [ ! -z $VE_IP2 ]; then
+if [ ! -z $CT_IP2 ]; then
-     tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip dst "$VE_IP2" flowid 1:30
+     tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip dst "$CT_IP2" flowid 1:30
 fi
+#
@@ Line 114: / Line 115: @@
 tc qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10
+#
-if [ ! -z $VE_IP1 ]; then
+if [ ! -z $CT_IP1 ]; then
-     tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip src "$VE_IP1" flowid 1:20
+     tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip src "$CT_IP1" flowid 1:20
 fi
-if [ ! -z $VE_IP2 ]; then
+if [ ! -z $CT_IP2 ]; then
-     tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip src "$VE_IP2" flowid 1:30
+     tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip src "$CT_IP2" flowid 1:30
 fi
+#

@@ Line 63: / Line 63: @@
 For details refer to the [http://luxik.cdi.cz/~devik/qos/htb/ HTB Home Page]
-<pre>
+<source lang="bash">
 #!/bin/sh
+#
@@ Line 125: / Line 125: @@
 tc class show dev $DEV
 tc filter show dev $DEV
-</pre>
+</source>
 == External links ==