mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-23 16:13:18 +01:00
104 lines
3.8 KiB
XML
104 lines
3.8 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
<refentry>
|
|
<refmeta>
|
|
<refentrytitle>shorewall6-tcinterfaces</refentrytitle>
|
|
|
|
<manvolnum>5</manvolnum>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>tcinterfaces</refname>
|
|
|
|
<refpurpose>Shorewall6 file</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>/etc/shorewall6/tcinterfaces</command>
|
|
</cmdsynopsis>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para>This file lists the interfaces that are subject to simple traffic
|
|
shaping. Simple traffic shaping is enabled by setting TC_ENABLED=Simple in
|
|
<ulink url="shorewall6.conf.html">shorewall6.conf</ulink>(5).</para>
|
|
|
|
<para>The columns in the file are as follows.</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><emphasis role="bold">INTERFACE</emphasis></term>
|
|
|
|
<listitem>
|
|
<para>The logical name of an interface. If you run both IPv4 and
|
|
IPv6 Shorewall firewalls, a given interface should only be listed in
|
|
one of the two configurations.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><emphasis role="bold">TYPE</emphasis> - [<emphasis
|
|
role="bold">external</emphasis>|<emphasis
|
|
role="bold">internal</emphasis>]</term>
|
|
|
|
<listitem>
|
|
<para>Optional. If given specifies whether the interface is
|
|
<emphasis role="bold">external</emphasis> (facing toward the
|
|
Internet) or <emphasis role="bold">internal</emphasis> (facing
|
|
toward a local network) and enables SFQ flow classification.</para>
|
|
|
|
<note>
|
|
<para>Simple traffic shaping is only useful on interfaces where
|
|
queuing occurs. As a consequence, internal interfaces seldom
|
|
benefit from simple traffic shaping. VPN interfaces are an
|
|
exception because the encapsulated packets are later transferred
|
|
over a slower external link.</para>
|
|
</note>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term>IN-BANDWIDTH - [<replaceable>rate</replaceable>]</term>
|
|
|
|
<listitem>
|
|
<para>Optional. If specified, enables ingress policing on the
|
|
interface. If incoming traffic exceeds the given
|
|
<replaceable>rate</replaceable>, received packets are dropped
|
|
randomly. With some DSL and Cable links, large queues can build up
|
|
in the ISP's gateway router. While this insures maximum throughput,
|
|
it kills interactive response time. By setting IN-BANDWIDTH, you can
|
|
eliminate these queues.</para>
|
|
|
|
<para>To pick an appropriate setting, we recommend that you start by
|
|
setting it significantly below your measured download bandwidth (20%
|
|
or so). While downloading, measure the ping response time from the
|
|
firewall to the upstream router as you gradually increase the
|
|
setting.The optimal setting is at the point beyond which the ping
|
|
time increases sharply as you increase the setting.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>FILES</title>
|
|
|
|
<para>/etc/shorewall6/tcinterfaces.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See ALSO</title>
|
|
|
|
<para>shorewall6(8), shorewall6-accounting(5), shorewall6-actions(5),
|
|
shorewall6-blacklist(5), shorewall6-hosts(5), shorewall6-maclist(5),
|
|
shorewall6-params(5), shorewall6-policy(5), shorewall6-providers(5),
|
|
shorewall6-route_rules(5), shorewall6-routestopped(5),
|
|
shorewall6-rules(5), shorewall6.conf(5), shorewall6-tcpri,
|
|
shorewall6-tos(5), shorewall6-tunnels(5), shorewall6-zones(5)</para>
|
|
</refsect1>
|
|
</refentry>
|