Re: Problem to priorize SSH traffic
Ludovic Leroy <[email protected]>
| Newsgroups | org.kernel.vger.lartc |
|---|---|
| Message-ID | <[email protected]> |
Thanks for replying. The script is attached. Hope this helps. Ludovic Le 16/12/2016 21:34, Alan Goodman a écrit : > It might help if you provide the script you are using to build your tc > queues... I find this more readable than the output from the tc stats. > > Alan > > > On 16/12/16 16:50, Ludovic Leroy wrote: >> Hello LARTC community, >> >> I am building a TC policy at home that answers my needs for a small >> DSL uplink 800kbit: >> * High UDP responsiveness for DNS queries and ping (Leaf 1:10 prio 1) >> * SSH traffic gets higher priority. I view my camera remotely via ssh >> tunnel (Leaf 1:20 prio 2) >> * Guarantied http(s)/IMAP (Leaf 1:30 prio 3) >> * Torrent seeding (Leaf 1:40 prio 4) >> * Default (Leaf 1:99 prio 5) >> * Gigabit local network (Leaf 1:1000 prio 1000) >> >> The problem is torrent traffic consumes all the bandwidth leaving >> little room for SSH traffic (<100kbit). See attached picture. >> SSH traffic class with higher priority than torrent class should be >> offered excess bandwidth first, but that is not the case. >> The only solution I found is to reduce the torrent ceil value. >> Could you help me? >> >> Regards, >> Ludovic L. >> >> # tc -d class show dev eth1 >> class htb 1:99 parent 1:1 leaf 199: prio 5 quantum 1650 rate 66Kbit >> ceil 800Kbit linklayer ethernet burst 16Kb/1 mpu 0b overhead 0b >> cburst 1599b/1 mpu 0b overhead 0b level 0 >> class htb 1:10 parent 1:1 leaf 110: prio 1 quantum 1650 rate 66Kbit >> ceil 200Kbit linklayer ethernet burst 16Kb/1 mpu 0b overhead 0b >> cburst 1599b/1 mpu 0b overhead 0b level 0 >> class htb 1:1000 root prio 0 quantum 200000 rate 100Mbit ceil 100Mbit >> linklayer ethernet burst 1600b/1 mpu 0b overhead 0b cburst 1600b/1 >> mpu 0b overhead 0b level 0 >> class htb 1:1 root rate 800Kbit ceil 800Kbit linklayer ethernet burst >> 16Kb/1 mpu 0b overhead 0b cburst 1599b/1 mpu 0b overhead 0b level 7 >> class htb 1:20 parent 1:1 leaf 120: prio 2 quantum 9900 rate 396Kbit >> ceil 800Kbit linklayer ethernet burst 16Kb/1 mpu 0b overhead 0b >> cburst 1599b/1 mpu 0b overhead 0b level 0 >> class htb 1:30 parent 1:1 leaf 130: prio 3 quantum 4950 rate 198Kbit >> ceil 800Kbit linklayer ethernet burst 16Kb/1 mpu 0b overhead 0b >> cburst 1599b/1 mpu 0b overhead 0b level 0 >> class htb 1:40 parent 1:1 leaf 140: prio 4 quantum 1650 rate 66Kbit >> ceil 800Kbit linklayer ethernet burst 16Kb/1 mpu 0b overhead 0b >> cburst 1599b/1 mpu 0b overhead 0b level 0 >> class sfq 140:22 parent 140: >> class sfq 140:34 parent 140: >> class sfq 140:3b parent 140: >> class sfq 140:6c parent 140: >> class sfq 140:a9 parent 140: >> class sfq 140:149 parent 140: >> class sfq 140:287 parent 140: >> class sfq 140:2fd parent 140: >> class sfq 140:318 parent 140: >> class sfq 140:376 parent 140: >> class sfq 140:3d6 parent 140: >> class sfq 140:3e3 parent 140: >> >> # tc -d qdisc show dev eth1 >> qdisc htb 1: root refcnt 2 r2q 5 default 99 direct_packets_stat 2 ver >> 3.17 direct_qlen 1000 >> qdisc pfifo 110: parent 1:10 limit 1000p >> qdisc pfifo 120: parent 1:20 limit 1000p >> qdisc pfifo 130: parent 1:30 limit 1000p >> qdisc sfq 140: parent 1:40 limit 127p quantum 1514b depth 127 flows >> 128/1024 divisor 1024 perturb 10sec >> qdisc sfq 199: parent 1:99 limit 127p quantum 1514b depth 127 flows >> 128/1024 divisor 1024 perturb 10sec >> >> # tc -d filter show dev eth1 >> filter parent 1: protocol all pref 1 fw >> filter parent 1: protocol all pref 1 fw handle 0xa classid 1:10 >> filter parent 1: protocol all pref 2 fw >> filter parent 1: protocol all pref 2 fw handle 0x14 classid 1:20 >> filter parent 1: protocol all pref 3 fw >> filter parent 1: protocol all pref 3 fw handle 0x1e classid 1:30 >> filter parent 1: protocol all pref 4 fw >> filter parent 1: protocol all pref 4 fw handle 0x28 classid 1:40 >> filter parent 1: protocol all pref 99 fw >> filter parent 1: protocol all pref 99 fw handle 0x63 classid 1:99 >> filter parent 1: protocol all pref 1000 fw >> filter parent 1: protocol all pref 1000 fw handle 0x3e8 classid 1:1000 >> >> # tc -s class show dev eth1 >> class htb 1:99 parent 1:1 leaf 199: prio 5 rate 66Kbit ceil 800Kbit >> burst 16Kb cburst 1599b >> Sent 1705141 bytes 10742 pkt (dropped 0, overlimits 0 requeues 0) >> rate 8048bit 6pps backlog 0b 0p requeues 0 >> lended: 10742 borrowed: 0 giants: 0 >> tokens: 29290142 ctokens: 198864 >> >> class htb 1:10 parent 1:1 leaf 110: prio 1 rate 66Kbit ceil 200Kbit >> burst 16Kb cburst 1599b >> Sent 20229 bytes 229 pkt (dropped 0, overlimits 0 requeues 0) >> rate 48bit 0pps backlog 0b 0p requeues 0 >> lended: 229 borrowed: 0 giants: 0 >> tokens: 30859841 ctokens: 943734 >> >> class htb 1:1000 root prio 0 rate 100Mbit ceil 100Mbit burst 1600b >> cburst 1600b >> Sent 79426 bytes 563 pkt (dropped 0, overlimits 0 requeues 0) >> rate 784bit 1pps backlog 0b 0p requeues 0 >> lended: 563 borrowed: 0 giants: 0 >> tokens: 1917 ctokens: 1917 >> >> class htb 1:1 root rate 800Kbit ceil 800Kbit burst 16Kb cburst 1599b >> Sent 164307843 bytes 134601 pkt (dropped 0, overlimits 0 requeues 0) >> rate 796440bit 78pps backlog 0b 0p requeues 0 >> lended: 108779 borrowed: 0 giants: 0 >> tokens: 2192729 ctokens: -117287 >> >> class htb 1:20 parent 1:1 leaf 120: prio 2 rate 396Kbit ceil 800Kbit >> burst 16Kb cburst 1599b >> Sent 5042698 bytes 4448 pkt (dropped 0, overlimits 0 requeues 0) >> rate 64032bit 6pps backlog 0b 0p requeues 0 >> lended: 4448 borrowed: 0 giants: 0 >> tokens: 5142031 ctokens: 235296 >> >> class htb 1:30 parent 1:1 leaf 130: prio 3 rate 198Kbit ceil 800Kbit >> burst 16Kb cburst 1599b >> Sent 32111 bytes 216 pkt (dropped 0, overlimits 0 requeues 0) >> rate 0bit 0pps backlog 0b 0p requeues 0 >> lended: 216 borrowed: 0 giants: 0 >> tokens: 10309330 ctokens: 241546 >> >> class htb 1:40 parent 1:1 leaf 140: prio 4 rate 66Kbit ceil 800Kbit >> burst 16Kb cburst 1599b >> Sent 157507664 bytes 118966 pkt (dropped 0, overlimits 0 requeues 0) >> rate 724312bit 65pps backlog 0b 27p requeues 0 >> lended: 10187 borrowed: 108779 giants: 0 >> tokens: -2031932 ctokens: -222767 >> >> class sfq 140:56 parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 2814b 2p requeues 0 >> allot 1520 >> >> class sfq 140:63 parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 7570b 5p requeues 0 >> allot 1520 >> >> class sfq 140:9a parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 6056b 4p requeues 0 >> allot 1448 >> >> class sfq 140:f8 parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 1310b 2p requeues 0 >> allot 528 >> >> class sfq 140:1c7 parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 3028b 2p requeues 0 >> allot 1520 >> >> class sfq 140:269 parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 4542b 3p requeues 0 >> allot 1304 >> >> class sfq 140:2ff parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 6056b 4p requeues 0 >> allot -72 >> >> class sfq 140:30d parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 1514b 1p requeues 0 >> allot 1520 >> >> class sfq 140:326 parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 1502b 1p requeues 0 >> allot 1520 >> >> class sfq 140:3ad parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 1514b 1p requeues 0 >> allot 1520 >> >> class sfq 140:3c5 parent 140: >> (dropped 0, overlimits 0 requeues 0) >> backlog 1560b 2p requeues 0 >> allot 1520 >
qos.sh
(application/x-shellscript, 5 KB)
#!/bin/sh
#
### BEGIN INIT INFO
# Provides: qos.sh
# Required-Start: $remote_fs $network $syslog
# Required-Stop: $remote_fs $network $syslog
# Should-Start: $local_fs
# Should-Stop: $local_fs
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: starts/stops qos
# Description: load or stop the Traffic Control rules on the network interface
### END INIT INFO
ETH_UPRATE=100 # mbits/s
DSL_UPRATE=800 # kbits/s
BURST="16kb"
NETCARD=eth1 # network card to apply the QoS to
TC=/sbin/tc
IPT=/sbin/iptables
case "$1" in
start)
echo "~~~~ LOADING TRAFFIC CONTROL RULES ON $NETCARD `uname -n` ~~~~"
echo
echo "#-Cleaning"
$TC qdisc del dev $NETCARD root
echo "#-Root"
$TC qdisc add dev $NETCARD root handle 1: htb default 99 r2q 5
echo "#--------uplink internet"
$TC class add dev $NETCARD parent 1:0 classid 1:1 htb rate ${DSL_UPRATE}kbit ceil ${DSL_UPRATE}kbit burst ${BURST}
echo "#--------megabit local"
$TC class add dev $NETCARD parent 1:0 classid 1:1000 htb rate ${ETH_UPRATE}mbit ceil ${ETH_UPRATE}mbit
echo "# == lan filter"
$TC filter add dev $NETCARD parent 1:0 protocol all prio 1000 handle 1000 fw flowid 1:1000
echo "#----------------interactive"
$TC class add dev $NETCARD parent 1:1 classid 1:10 htb rate $(( $DSL_UPRATE / 12 ))kbit ceil 200kbit burst ${BURST} prio 1
echo "#----------------------------sub interactive: pfifo"
$TC qdisc add dev $NETCARD parent 1:10 handle 110: pfifo limit 1000
echo "# == interactive filter"
$TC filter add dev $NETCARD parent 1:0 protocol all prio 1 handle 10 fw flowid 1:10
echo "#----------------ssh"
$TC class add dev $NETCARD parent 1:1 classid 1:20 htb rate $(( $DSL_UPRATE / 12 * 6 ))kbit ceil ${DSL_UPRATE}kbit burst ${BURST} prio 2
echo "#----------------------------sub ssh: pfifo"
$TC qdisc add dev $NETCARD parent 1:20 handle 120: pfifo limit 1000
echo "# == ssh filter"
$TC filter add dev $NETCARD parent 1:0 protocol all prio 2 handle 20 fw flowid 1:20
echo "#----------------http(s)/IMAP"
$TC class add dev $NETCARD parent 1:1 classid 1:30 htb rate $(( $DSL_UPRATE / 12 * 3 ))kbit ceil ${DSL_UPRATE}kbit burst ${BURST} prio 3
echo "#----------------------------sub http(s)/IMAP: pfifo"
$TC qdisc add dev $NETCARD parent 1:30 handle 130: pfifo limit 1000
echo "# == http(s)/IMAP filter"
$TC filter add dev $NETCARD parent 1:0 protocol all prio 3 handle 30 fw flowid 1:30
echo "#----------------torrent"
$TC class add dev $NETCARD parent 1:1 classid 1:40 htb rate $(( $DSL_UPRATE / 12 * 1 ))kbit ceil ${DSL_UPRATE}kbit burst ${BURST} prio 4
#$TC class add dev $NETCARD parent 1:1 classid 1:40 htb rate 100kbit ceil 200kbit burst ${BURST} prio 4
echo "#----------------------------sub default: sfq"
$TC qdisc add dev $NETCARD parent 1:40 handle 140: sfq perturb 10
echo "# == torrent filter"
$TC filter add dev $NETCARD parent 1:0 protocol all prio 4 handle 40 fw flowid 1:40
echo "#----------------default"
$TC class add dev $NETCARD parent 1:1 classid 1:99 htb rate $(( $DSL_UPRATE / 12 * 1 ))kbit ceil ${DSL_UPRATE}kbit burst ${BURST} prio 5
echo "#----------------------------sub default: sfq"
$TC qdisc add dev $NETCARD parent 1:99 handle 199: sfq perturb 10
echo "# == default filter"
$TC filter add dev $NETCARD parent 1:0 protocol all prio 99 handle 99 fw flowid 1:99
# local
iptables -t mangle -A POSTROUTING -o eth1.100 -d 192.168.27.0/28 -j CONNMARK --set-mark 1000
iptables -t mangle -A POSTROUTING -o eth1 -d 212.27.38.253/32 -j CONNMARK --set-mark 1000
# interactive
iptables -t mangle -A POSTROUTING -o eth1 -p udp -m multiport --dports 53,123 -j CONNMARK --set-mark 10
iptables -t mangle -A POSTROUTING -o eth1 -p icmp -j MARK --set-mark 10
iptables -t mangle -A POSTROUTING -o eth1 -p icmp -j RETURN
# ssh + ssl
iptables -t mangle -A POSTROUTING -o eth1 -p tcp --tcp-flags SYN,ACK SYN,ACK --sport 22 -j CONNMARK --set-mark 20
iptables -t mangle -A POSTROUTING -o eth1 -p tcp --tcp-flags SYN,ACK SYN,ACK --sport 443 -j CONNMARK --set-mark 20
# http(s)/IMAP
iptables -t mangle -A POSTROUTING -o eth1 -p tcp --tcp-flags SYN,RST,ACK SYN -m multiport --dports 80,443,465,993 -j CONNMARK --set-mark 30
# torrent
iptables -t mangle -A POSTROUTING -o eth1 -p tcp --tcp-flags SYN SYN -m owner --uid-owner ludo -j CONNMARK --set-mark 40
iptables -t mangle -A POSTROUTING -j CONNMARK --restore-mark
;;
stop)
$IPT -t mangle -F
$IPT -t mangle -X
echo "iptables rules removed"
$TC qdisc del dev $NETCARD root handle 1
echo "traffic control rules removed"
exit 0
;;
restart)
$0 stop
$0 start
exit 0
;;
show)
echo;echo " ---- qdiscs details -----"
$TC -d qdisc show dev $NETCARD
echo;echo " ---- qdiscs statistics --"
$TC -s qdisc show dev $NETCARD
exit 0
;;
*)
echo;echo "usage:$0 {start|stop|restart|show}"
echo "load or stop the Traffic Control rules on the network interface"
echo;
;;
esac