Qos porta 80 (www)

[piciccia]

prima marchi il traffico da ip/firewall/magle
marchi tutto il traffico come altro in passthroug, e marchi il traffico tcp 80 come http
poi crei delle code su queue/tree, partendo nel definire la banda a disposizione "max-limit" fai 2 code "in" (download) e "out" (upload) creando delle code che hanno come parent le ethernet relative (il traffico si regola solo in uscita, tienilo bene a mente).
Poi sotto queste code ne crei altre 2 ognuna una per "altro" con prorità 8 e una "http" con priorità 1, ripeti il tutto sia per In che Out. Se vuoi anche su queste code regoli la banda, sia come max-limit, ma sopratutto come limit-at (minima banda garantita).

Saluti
C.

[raffaelema]

ciao piccicia,
mi intrometto nel post per alcuni chiarimenti,
la mia gestione e come l'hai descritta, ho marcato il traffico con chain forward e se imposto la coda principale in queue/tree come parent la ethernet non filtra il traffico, ho impostato la coda per il download global-out e upload la ethernet del gatway, così sembra funzionare.
uso nat masquerade e come autenticazione pppoe.
dove sbaglio?
comunque con questa configurazione non mi funzionano le code semplici se imposto i limiti per utente ( o meglio non funziona solo il limite nel download l'upload funziona).
ti posto un po del mio codice
è un server di test
ciao
grazie

Codice: Seleziona tutto

/ip firewall mangle
add action=change-mss chain=forward comment="Change MSS" disabled=no new-mss=clamp-to-pmtu protocol=tcp tcp-flags=syn
add action=mark-routing chain=prerouting comment="Riuting mark Utenti Standard" disabled=no new-routing-mark=Routing_Standard passthrough=yes \
    src-address-list=Utenti_Standard
add action=mark-routing chain=prerouting comment="Riuting mark Utenti Gaiano" disabled=no new-routing-mark=Routing_Secondario passthrough=yes \
    src-address-list=Utenti_Gaiano
add action=mark-packet chain=forward comment="SpeedTest Download" disabled=no new-packet-mark=SpeedTest passthrough=no src-address-list=SpeedTest
add action=mark-packet chain=forward comment="SpeedTest Upload" disabled=no dst-address-list=SpeedTest new-packet-mark=SpeedTest passthrough=no
add action=mark-packet chain=forward comment="---------------  ALL TRAFFIC NO MARK" disabled=no new-packet-mark=ALL out-interface=2-Wan passthrough=yes
add action=mark-packet chain=forward comment=HTTP disabled=no dst-port=80 new-packet-mark=http passthrough=no protocol=tcp
add action=mark-packet chain=prerouting comment=ICMP disabled=no new-packet-mark=icmp passthrough=no protocol=icmp
add action=jump chain=forward comment="-----------------------TCP   --------   UTENTI " disabled=no jump-target=tcp protocol=tcp
add action=mark-connection chain=tcp comment="0 - 1M" connection-bytes=0-1000000 disabled=no new-connection-mark=0-1M_conn passthrough=yes protocol=tcp
add action=mark-packet chain=tcp comment="" connection-mark=0-1M_conn disabled=no new-packet-mark=0-1M passthrough=yes
add action=mark-connection chain=tcp comment="1M - 3M" connection-bytes=1000000-3000000 disabled=no new-connection-mark=1M-3M_conn passthrough=yes protocol=\
    tcp
add action=mark-packet chain=tcp comment="" connection-mark=1M-3M_conn disabled=no new-packet-mark=1M-3M passthrough=yes
add action=mark-connection chain=tcp comment="3M - 10M" connection-bytes=3000000-10000000 disabled=no new-connection-mark=3M-10M_conn passthrough=yes \
    protocol=tcp
add action=mark-packet chain=tcp comment="" connection-mark=3M-10M_conn disabled=no new-packet-mark=3M-10M passthrough=yes protocol=tcp
add action=mark-connection chain=tcp comment="10M - 50M" connection-bytes=10000000-50000000 disabled=no new-connection-mark=10M-50M_conn passthrough=yes \
    protocol=tcp
add action=mark-packet chain=tcp comment="" connection-mark=10M-50M_conn disabled=no new-packet-mark=10M-50M passthrough=yes protocol=tcp
add action=mark-connection chain=tcp comment=50M-Infinito connection-bytes=50000000-0 disabled=no new-connection-mark=50M-Infinito_conn passthrough=yes \
    protocol=tcp
add action=mark-packet chain=tcp comment="" connection-mark=50M-Infinito_conn disabled=no new-packet-mark=50M-Infinito passthrough=no protocol=tcp
add action=return chain=tcp comment="--------- FINE TCP" disabled=no
add action=mark-packet chain=prerouting comment=UDP disabled=no new-packet-mark=udp passthrough=yes protocol=udp


Codice: Seleziona tutto

/queue tree
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=6M name=Download-1-Standard parent=global-out priority=5
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=5M name=P1-down1 parent=Download-1-Standard priority=1
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=700k name=P5-down1 parent=Download-1-Standard priority=5
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=300k name=P8-down1 parent=Download-1-Standard priority=8
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=http-50M packet-mark=10M-50M parent=P5-down1 priority=1 \
    queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=6M name=Upload-1-Standard parent=2-Wan priority=5
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=4M name=P1-up1 parent=Upload-1-Standard priority=1
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=800k name=P5-up1 parent=Upload-1-Standard priority=5
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=200k name=P8-up1 parent=Upload-1-Standard priority=8
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=http-50M-up packet-mark=10M-50M parent=P5-up1 priority=1 \
    queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=1-http-1M-up packet-mark=0-1M parent=P1-up1 priority=2 \
    queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=2-http-3M-up packet-mark=1M-3M parent=P1-up1 priority=3 \
    queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=http-Infinito-up packet-mark=50M-Infinito parent=P8-up1 \
    priority=1 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=3-http-10M-up packet-mark=3M-10M parent=P1-up1 priority=\
    4 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=SpeedTest-down packet-mark=SpeedTest parent=P1-down1 \
    priority=1 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=SpeedTest-up packet-mark=SpeedTest parent=P1-up1 \
    priority=1 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=1-http-1M packet-mark=0-1M parent=P1-down1 priority=2 \
    queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=2-http-3M packet-mark=1M-3M parent=P1-down1 priority=3 \
    queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=3-http-10M packet-mark=3M-10M parent=P1-down1 priority=4 \
    queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
    max-limit=0 name=http-Infinito packet-mark=50M-Infinito parent=P8-down1 \
    priority=1 queue=default

[piciccia]

Probabilmente non vedi il traffico in forward perchè non c'è routing ??
Sulla chain forward ci va solo se c'è routing.
Altrimenti sbagli a marchiare nel mangle, per esempio su questa:
add action=mark-packet chain=forward comment="--------------- ALL TRAFFIC NO MARK" disabled=no new-packet-mark=ALL out-interface=2-Wan passthrough=yes
Nel mangle non devi specificare l'interfaccia di uscita o entrata, quello dipende dalle code.
Le global-in e global-out non sono chain ma particolari simple-queue dinamiche HTB (Hierarchical Token Bucket) http://en.wikipedia.org/wiki/Token_bucket
L'approccio standard è individuare dove il traffico esce dal router sia in up che down.
Al limite puoi provare a marchiare nella chain prerouting al posto della forward.

Saluti
C.

[raffaelema]

Grazie per la risposta,

Probabilmente non vedi il traffico in forward perchè non c'è routing ??

in che senso non c'è routing?
ciao

[piciccia]

Gli IP che si trovano sulla LAN e quelli che si trovano sulla WAN, sono in 2 classi diverse ??

Saluti
C.

[raffaelema]

si nella lan sono 192.168.20.0/24 dopo l'autenticazione del server pppoe
la wan 192.168.1.0/24 gatway 192.168.1.1
ma ho creato una regola di nat per il masquerade
e una rotta statica
add dst-address=0.0.0.0/0 gateway=192.168.1.1 scope=30 target-scope=10

ciao