diff --git a/docs/traffic_shaping.xml b/docs/traffic_shaping.xml index 0012fb676..bb61a405f 100644 --- a/docs/traffic_shaping.xml +++ b/docs/traffic_shaping.xml @@ -922,7 +922,7 @@ ppp0 6000kbit 500kbit packets arriving on eth2 and eth3 should be marked with 2. All packets originating on the firewall itself should be marked with 3. - #ACTION SOURCE DESTINATION PROTOCOL PORT(S) + #ACTION SOURCE DEST PROTO DPORT MARK(1) eth1 0.0.0.0/0 all MARK(2) eth2 0.0.0.0/0 all MARK(2) eth3 0.0.0.0/0 all @@ -935,7 +935,7 @@ MARK(3) $FW 0.0.0.0/0 all All GRE (protocol 47) packets destined for 155.186.235.151 should be marked with 12. - #ACTION SOURCE DESTINATION PROTOCOL PORT(S) + #ACTION SOURCE DEST PROTO DPORT MARK(12):T 0.0.0.0/0 155.182.235.151 47 @@ -945,7 +945,7 @@ MARK(12):T 0.0.0.0/0 155.182.235.151 47 All SSH request packets originating in 192.168.1.0/24 and destined for 155.186.235.151 should be marked with 22. - #ACTION SOURCE DESTINATION PROTOCOL PORT(S) + #ACTION SOURCE DEST PROTO DPORT MARK(22):T 192.168.1.0/24 155.182.235.151 tcp 22 @@ -956,8 +956,7 @@ MARK(22):T 192.168.1.0/24 155.182.235.151 tcp 22 /etc/shorewall/tcdevices should be assigned to the class with mark value 10. - #ACTION SOURCE DESTINATION PROTOCOL PORT(S) CLIENT -# PORT(S) + #ACTION SOURCE DEST PROTO DPORT SPORT CLASSIFY(1:110) 0.0.0.0/0 0.0.0.0/0 tcp 22 CLASSIFY(1:110) 0.0.0.0/0 0.0.0.0/0 tcp - 22 @@ -975,8 +974,7 @@ CLASSIFY(1:110) 0.0.0.0/0 0.0.0.0/0 tcp - 22 - #ACTION SOURCE DESTINATION PROTOCOL PORT(S) CLIENT USER/ TEST -# PORT(S) GROUP + #ACTION SOURCE DEST PROTO DPORT SPORT USER TEST MARK(1) 0.0.0.0/0 0.0.0.0/0 icmp echo-request MARK(1) 0.0.0.0/0 0.0.0.0/0 icmp echo-reply @@ -1002,8 +1000,7 @@ SAVE 0.0.0.0/0 0.0.0.0/0 all - - ensure that all VOIP packets also receive that mark (assumes that nf_conntrack_sip is loaded). - #ACTION SOURCE DESTINATION PROTOCOL PORT(S) CLIENT USER/ TEST CONNBYTES TOS HELPER -# PORT(S) GROUP + #ACTION SOURCE DEST PROTO DPORT SPORT USER TEST CONNBYTES TOS HELPER RESTORE 0.0.0.0/0 0.0.0.0/0 all - - - 0 CONTINUE 0.0.0.0/0 0.0.0.0/0 all - - - !0 1 0.0.0.0/0 0.0.0.0/0 all - - - - - - sip @@ -1235,7 +1232,7 @@ Source IP address is 192.168.4.3 = 0xc0a80403 /etc/shorewall/tcdevices: - #INTERFACE IN-BANDWIDTH OUT-BANDWIDTH + #INTERFACE IN_BANDWIDTH OUT_BANDWIDTH eth0 100mbit 100mbit /etc/shorewall/tcclasses: @@ -1293,7 +1290,7 @@ IPMARK(src,0xff,0x10100):F 192.168.1.0/29 eth0
tcdevices file - #INTERFACE IN-BANDWITH OUT-BANDWIDTH + #INTERFACE IN_BANDWITH OUT_BANDWIDTH ppp0 5000kbit 500kbit
@@ -1309,8 +1306,7 @@ ppp0 3 2*full/10 8*full/10 2
mangle file - #ACTION SOURCE DEST PROTO PORT(S) CLIENT USER -# PORT(S) + #ACTION SOURCE DEST PROTO DPORT SPORT USER MARK(1):F 0.0.0.0/0 0.0.0.0/0 icmp echo-request MARK(1):F 0.0.0.0/0 0.0.0.0/0 icmp echo-reply # mark traffic which should have a lower priority with a 3: @@ -1347,23 +1343,14 @@ NOPRIOPORTDST="6662 6663" This would result in the following additional settings to the mangle file: - MARK(3) 192.168.1.128/25 0.0.0.0/0 all + #ACTION SOURCE DEST PROTO DPORT SPORT USER +MARK(3) 192.168.1.128/25 0.0.0.0/0 all MARK(3) 192.168.3.28 0.0.0.0/0 all MARK(3) 0.0.0.0/0 60.0.0.0/24 all MARK(3) 0.0.0.0/0 0.0.0.0/0 udp 6662,6663 MARK(3) 0.0.0.0/0 0.0.0.0/0 udp - 6662,6663 MARK(3) 0.0.0.0/0 0.0.0.0/0 tcp 6662,6663 MARK(3) 0.0.0.0/0 0.0.0.0/0 tcp - 6662,6663 - - Corresponding tcrules file entries are: - - 3 192.168.1.128/25 0.0.0.0/0 all -3 192.168.3.28 0.0.0.0/0 all -3 0.0.0.0/0 60.0.0.0/24 all -3 0.0.0.0/0 0.0.0.0/0 udp 6662,6663 -3 0.0.0.0/0 0.0.0.0/0 udp - 6662,6663 -3 0.0.0.0/0 0.0.0.0/0 tcp 6662,6663 -3 0.0.0.0/0 0.0.0.0/0 tcp - 6662,6663
@@ -1378,7 +1365,7 @@ MARK(3) 0.0.0.0/0 0.0.0.0/0 tcp - 6662,666
tcdevices file - #INTERFACE IN-BANDWITH OUT-BANDWIDTH + #INTERFACE IN_BANDWITH OUT_BANDWIDTH ppp0 6000kbit 700kbit We have 6mbit down and 700kbit upstream. @@ -1403,8 +1390,7 @@ ppp0 4 90kbit 200kbit 3 default mangle file - #ACTION SOURCE DEST PROTO PORT(S) SOURCE USER -# PORT(S) + #ACTION SOURCE DEST PROTO DPORT SPORT USER MARK(1):F 0.0.0.0/0 0.0.0.0/0 icmp echo-request MARK(1):F 0.0.0.0/0 0.0.0.0/0 icmp echo-reply MARK(2):F 192.168.2.23 0.0.0.0/0 all @@ -1412,8 +1398,7 @@ MARK(3):F 192.168.2.42 0.0.0.0/0 all Corresponding tcrules file: - #ACTION SOURCE DEST PROTO PORT(S) CLIENT USER -# PORT(S) + #ACTION SOURCE DEST PROTO DPORT SPORT USER 1:F 0.0.0.0/0 0.0.0.0/0 icmp echo-request 1:F 0.0.0.0/0 0.0.0.0/0 icmp echo-reply 2:F 192.168.2.23 0.0.0.0/0 all @@ -1472,13 +1457,12 @@ MARK(3):F 192.168.2.42 0.0.0.0/0 all /etc/shorewall/tcdevices: - #INTERFACE IN-BANDWITH OUT-BANDWIDTH OPTIONS + #INTERFACE IN_BANDWITH OUT_BANDWIDTH OPTIONS eth0 - 1000kbit hfsc /etc/shorewall/tcclasses: - #INTERFACE:CLASS MARK RATE: CEIL PRIORITY OPTIONS -# DMAX:UMAX + #INTERFACE MARK RATE CEIL PRIORITY OPTIONS 1:10 1 500kbit full 1 1:20 2 500kbit full 1 1:10:11 3 400kbit:53ms:1500b full 2 @@ -1649,8 +1633,7 @@ ip link set ifb0 up Example: /etc/shorewall/rules: - #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL -# PORT(S) PORT(S) DEST + #ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST DNAT net dmz:192.168.4.5 tcp 80 - 206.124.146.177 Requests redirected by this rule will have destination IP @@ -1721,7 +1704,7 @@ eth0 192.168.1.0/24 206.124.146.179 - DEST PORT(S) + DPORT Comma-separated list of destination port names or numbers. @@ -1731,7 +1714,7 @@ eth0 192.168.1.0/24 206.124.146.179 - SOURCE PORT + SPORT Comma-separated list of source port names or numbers. May @@ -1810,8 +1793,7 @@ qt ip link set dev ifb0 up /etc/shorewall/tcdevices: -#INTERFACE IN-BANDWITH OUT-BANDWIDTH OPTIONS REDIRECTED -# INTERFACES +#INTERFACE IN_BANDWITH OUT_BANDWIDTH OPTIONS REDIRECT 1:eth0 - 384kbit classify 2:ifb0 - 1300kbit - eth0 /etc/shorewall/tcclasses:#INTERFACE MARK RATE CEIL PRIORITY OPTIONS @@ -1820,8 +1802,7 @@ qt ip link set dev ifb0 up 1:130 - 2*full/10 6*full/10 3 2:110 - 5*full/10 full 1 tcp-ack,tos-minimize-delay 2:120 - 2*full/10 6*full/10 2 default -2:130 - 2*full/10 6*full/10 3/etc/shorewall/tcfilters:#INTERFACE: SOURCE DEST PROTO DEST SOURCE -#CLASS PORT(S) PORT(S) +2:130 - 2*full/10 6*full/10 3/etc/shorewall/tcfilters:#INTERFACE: SOURCE DEST PROTO DPORT SPORT # # OUTGOING TRAFFIC #