linux filters and queuing discipline

TC is used to configure traffic control in Linux kernel. Traffic control consists of the following:

1) Shaping: Shaping is done at the outgoing interface, and includes throttling the bandwidth and/or smoothing the traffic bursts of the outgoing flows.

2) Scheduling: Scheduling is also done at the outgoing interface and makes it possible to improve interactivity for traffic that needs it while still guaranteeing bandwidth to bulk transfers.

3) Policing: Policing is done at the ingress and is primarily used for throttling the rate at which flows may arrive. Dropping is a severe form of policing.

BRIDGE HTB EBTABLES

Bridging

1.1 - Installa

1.2 - Configure

1.3 - Status

QOS htb queueing

2.1 - Configuratie

2.3 - Status

Ebtables filter

3.1 - Configuratie

3.3 - Status

---

1.1 - Installatie

Add atrpms repository bij yum en installeer

echo "[atrpms]
 name=Fedora Core $releasever - $basearch - ATrpms
 baseurl=http://dl.atrpms.net/fc$releasever-$basearch/atrpms/stable" >> /etc/yum.conf
 
 [root@bridge ~]# yum install ebtables bridge-utils
 Setting up Install Process
 Setting up Repos
 atrpms                    100% |=========================|  951 B    00:00
 base                      100% |=========================| 1.1 kB    00:00
 updates-released          100% |=========================|  951 B    00:00
 Reading repository metadata in from local files
 atrpms    : ################################################## 1078/1078
 base      : ################################################## 2622/2622
 updates-re: ################################################## 970/970
 Parsing package install arguments
 No Match for argument: ebtables
 Resolving Dependencies
 --> Populating transaction set with selected packages. Please wait.
 ---> Package bridge-utils.i386 0:1.0.4-4 set to be updated
 --> Running transaction check
 --> Processing Dependency: libsysfs.so.1 for package: bridge-utils
 --> Restarting Dependency Resolution with new changes.
 --> Populating transaction set with selected packages. Please wait.
 ---> Package sysfsutils.i386 0:1.2.0-1 set to be updated
 --> Running transaction check
 
 Dependencies Resolved
 Transaction Listing:
   Install: bridge-utils.i386 0:1.0.4-4 - base
 
 Performing the following to resolve dependencies:
   Install: sysfsutils.i386 0:1.2.0-1 - base
 Total download size: 83 k
 Is this ok [y/N]: y
 Downloading Packages:
 (1/2): bridge-utils-1.0.4 100% |=========================|  27 kB    00:00
 (2/2): sysfsutils-1.2.0-1 100% |=========================|  56 kB    00:00
 Running Transaction Test
 Finished Transaction Test
 Transaction Test Succeeded
 Running Transaction
 Installing: sysfsutils 100 % done 1/2
 Installing: bridge-utils 100 % done 2/2
 
 Installed: bridge-utils.i386 0:1.0.4-4
 Dependency Installed: sysfsutils.i386 0:1.2.0-1
 Complete!

1.2 - Configuratie

Edit de volgende files

file /etc/sysconfig/network-scripts/ifcfg-br0
 DEVICE=br0
 TYPE=Bridge
 BOOTPROTO=static
 IPADDR=192.168.1.2
 NETMASK=255.255.255.0
 GATEWAY=192.168.1.1
 ONBOOT=yes
 DELAY=30
 STP=ON

 file /etc/sysconfig/network-scripts/ifcfg-eth0
 DEVICE=eth0
 TYPE=ETHER
 BRIDGE=br0
 ONBOOT=yes
 
 file /etc/sysconfig/network-scripts/ifcfg-eth1
 DEVICE=eth1
 TYPE=ETHER
 BRIDGE=br0
 ONBOOT=yes

1.3 - Status

[root@bridge root]# brctl showstp br0
br0
 bridge id              8000.0010a403d44a
 designated root        0001.00d003db8401
 root port                 1                    path cost                101
 max age                  20.00                 bridge max age            20.00
 hello time                2.00                 bridge hello time          2.00
 forward delay            15.00                 bridge forward delay      15.00
 ageing time             300.00                 gc interval                4.00
 hello timer               0.00                 tcn timer                  0.00
 topology change timer     0.00                 gc timer                   2.92
 flags


eth0 (1)
 port id                8001                    state                   forwarding
 designated root        0001.00d003db8401       path cost                100
 designated bridge      c000.0002fd81cc01       message age timer          2.40
 designated port        8089                    forward delay timer        0.00
 designated cost           1                    hold timer                 0.00
 flags

eth1 (2)
 port id                8002                    state                   forwarding
 designated root        0001.00d003db8401       path cost                100
 designated bridge      8000.0010a403d44a       message age timer          0.00
 designated port        8002                    forward delay timer        0.00
 designated cost         101                    hold timer                 0.00
 flags

---

2.1 Configuratie

file path/htb.sh (ik plaats scripts altijd in /scripts/htb.sh)
 if [ "$1" = "status" ]
 then
 /sbin/tc -s class ls dev eth0
 /sbin/tc -s class ls dev eth1
 exit
        fi
 if [ "$1" = "stop" ]
         then
                 /sbin/tc qdisc del dev eth0 root    2> /dev/null > /dev/null
                 /sbin/tc qdisc del dev eth1 root    2> /dev/null > /dev/null
                 echo "STOP = OK"
                 exit
         fi
 if [ "$1" = "start" ]
         then
 # RULES
 # cleanup
 /sbin/tc qdisc del dev eth0 root    2> /dev/null > /dev/null
 /sbin/tc qdisc del dev eth1 root    2> /dev/null > /dev/null
 
 # eth0 (external)
 tc qdisc add dev eth0 root handle 1: htb
 tc class add dev eth0 parent 1: classid 1:1 htb rate 10000kbit ceil 10000kbit
 tc class add dev eth0 parent 1:1 classid 1:2 htb rate 2000kbit ceil 2000kbit prio 1
 tc class add dev eth0 parent 1:1 classid 1:3 htb rate 2000kbit ceil 2000kbit prio 1
 tc class add dev eth0 parent 1:1 classid 1:4 htb rate 512kbit ceil 512kbit prio 1
 tc class add dev eth0 parent 1:4 classid 1:41 htb rate 256kbit ceil 384kbit prio 1 burst 2kbit
 tc class add dev eth0 parent 1:4 classid 1:42 htb rate 128kbit ceil 450kbit prio 2 burst 2kbit
 tc class add dev eth0 parent 1:4 classid 1:43 htb rate 128kbit ceil 450kbit prio 3 burst 2kbit
 
 # eth1 (internal)
 tc qdisc add dev eth1 root handle 2: htb
 tc class add dev eth1 parent 2: classid 2:1 htb rate 10000kbit ceil 10000kbit
 tc class add dev eth1 parent 2:1 classid 2:2 htb rate 2000kbit ceil 2000kbit prio 1
 tc class add dev eth1 parent 2:1 classid 2:3 htb rate 2000kbit ceil 2000kbit prio 1
 tc class add dev eth1 parent 2:1 classid 2:4 htb rate 512kbit ceil 512kbit prio 1
 tc class add dev eth1 parent 2:4 classid 2:41 htb rate 256kbit ceil 384kbit prio 1 burst 2kbit
 tc class add dev eth1 parent 2:4 classid 2:42 htb rate 128kbit ceil 450kbit prio 2 burst 2kbit
 tc class add dev eth1 parent 2:4 classid 2:43 htb rate 128kbit ceil 450kbit prio 3 burst 2kbit
 
 # filters
 tc filter add dev eth0 parent 1: protocol ip prio 1 handle 0x12 fw classid 1:2
 tc filter add dev eth0 parent 1: protocol ip prio 1 handle 0x13 fw classid 1:3
 tc filter add dev eth0 parent 1: protocol ip prio 1 handle 0x141 fw classid 1:41
 tc filter add dev eth0 parent 1: protocol ip prio 1 handle 0x142 fw classid 1:42
 tc filter add dev eth0 parent 1: protocol ip prio 1 handle 0x143 fw classid 1:43
 
 tc filter add dev eth1 parent 2: protocol ip prio 1 handle 0x22 fw classid 2:2
 tc filter add dev eth1 parent 2: protocol ip prio 1 handle 0x23 fw classid 2:3
 tc filter add dev eth1 parent 2: protocol ip prio 1 handle 0x241 fw classid 2:41
 tc filter add dev eth1 parent 2: protocol ip prio 1 handle 0x242 fw classid 2:42
 tc filter add dev eth1 parent 2: protocol ip prio 1 handle 0x243 fw classid 2:43
 ####### END
 exit
 fi

2.2 Status

path/htb.sh status
 class htb 1:1 root rate 10Mbit ceil 10Mbit burst 2848b cburst 2848b
  Sent 2233403355 bytes 10596183 pkts (dropped 0, overlimits 0 requeues 0)
  rate 9541bit 66pps
  lended: 0 borrowed: 0 giants: 0
  tokens: 2296 ctokens: 2296
 
 class htb 1:2 parent 1:1 prio 1 rate 2Mbit ceil 2Mbit burst 1849b cburst 1849b
  Sent 65253934 bytes 565473 pkts (dropped 0, overlimits 0 requeues 0)
  rate 95bit 1pps
  lended: 565473 borrowed: 0 giants: 0
  tokens: 7217 ctokens: 7217
 
 class htb 1:3 parent 1:1 prio 1 rate 2Mbit ceil 2Mbit burst 1849b cburst 1849b
  Sent 435637962 bytes 2681434 pkts (dropped 0, overlimits 0 requeues 0)
  rate 6009bit 42pps
  lended: 2681434 borrowed: 0 giants: 0
  tokens: 7315 ctokens: 7315
 
 class htb 1:4 parent 1:1 rate 512Kbit ceil 512Kbit burst 1663b cburst 1663b
  Sent 1732511459 bytes 7349276 pkts (dropped 0, overlimits 0 requeues 0)
  rate 3771bit 23pps
  lended: 1055164 borrowed: 0 giants: 0
  tokens: 25856 ctokens: 25856
 
 class htb 1:41 parent 1:4 prio 1 rate 256Kbit ceil 384Kbit burst 255b cburst 1647b
  Sent 108119387 bytes 888473 pkts (dropped 0, overlimits 0 requeues 0)
  rate 63bit
  lended: 865360 borrowed: 23113 giants: 0
  tokens: 6654 ctokens: 34134
 
 class htb 1:42 parent 1:4 prio 2 rate 128Kbit ceil 450Kbit burst 255b cburst 1655b
  Sent 569607767 bytes 2244715 pkts (dropped 0, overlimits 0 requeues 0)
  rate 2745bit 17pps
  lended: 1914731 borrowed: 329984 giants: 0
  tokens: 12286 ctokens: 29273
 
 class htb 1:43 parent 1:4 prio 3 rate 128Kbit ceil 450Kbit burst 255b cburst 1655b
  Sent 1054784305 bytes 4216088 pkts (dropped 0, overlimits 0 requeues 0)
  rate 983bit 5pps
  lended: 3514021 borrowed: 702067 giants: 0
  tokens: -4098 ctokens: 24322
 
 class htb 2:1 root rate 10Mbit ceil 10Mbit burst 2848b cburst 2848b
  Sent 7775491380 bytes 12322177 pkts (dropped 0, overlimits 0 requeues 0)
  rate 302Kbit 73pps
  lended: 0 borrowed: 0 giants: 0
  tokens: 2296 ctokens: 2296
 
 class htb 2:2 parent 2:1 prio 1 rate 2Mbit ceil 2Mbit burst 1849b cburst 1849b
  Sent 316055870 bytes 561775 pkts (dropped 0, overlimits 0 requeues 0)
  rate 31bit
  lended: 561775 borrowed: 0 giants: 0
  tokens: 6857 ctokens: 6857
 
 class htb 2:3 parent 2:1 prio 1 rate 2Mbit ceil 2Mbit burst 1849b cburst 1849b
  Sent 1812476557 bytes 3159408 pkts (dropped 0, overlimits 0 requeues 0)
  rate 31491bit 50pps
  lended: 3159408 borrowed: 0 giants: 0
  tokens: 1384 ctokens: 1384
 
 class htb 2:4 parent 2:1 rate 512Kbit ceil 512Kbit burst 1663b cburst 1663b
  Sent 5646958953 bytes 8600994 pkts (dropped 0, overlimits 0 requeues 0)
  rate 6591bit 22pps
  lended: 3719768 borrowed: 0 giants: 0
  tokens: 25856 ctokens: 25856
 
 class htb 2:41 parent 2:4 prio 1 rate 256Kbit ceil 384Kbit burst 255b cburst 1647b
  Sent 436207585 bytes 1135807 pkts (dropped 0, overlimits 0 requeues 0)
  rate 147bit 1pps
  lended: 920005 borrowed: 215802 giants: 0
  tokens: 1278 ctokens: 30548
 
 class htb 2:42 parent 2:4 prio 2 rate 128Kbit ceil 450Kbit burst 255b cburst 1655b
  Sent 874495734 bytes 2302671 pkts (dropped 0, overlimits 0 requeues 0)
  rate 5602bit 17pps
  lended: 1680038 borrowed: 622633 giants: 0
  tokens: 12286 ctokens: 29273
 
 class htb 2:43 parent 2:4 prio 3 rate 128Kbit ceil 450Kbit burst 255b cburst 1655b
  Sent 4336255634 bytes 5162516 pkts (dropped 0, overlimits 0 requeues 0)
  rate 1555bit 3pps
  lended: 2281183 borrowed: 2881333 giants: 0
  tokens: -1538 ctokens: 25050
 

---

3.1 Configuratie

A="/sbin/ebtables"

if [ "$1" = "status" ]
        then
        $A -L --Lc
        exit
fi
if [ "$1" = "stop" ]
        then
        $A -F
        exit
fi
if [ "$1" = "start" ]
        then
        $A -F
 $A -A FORWARD -p IPv4 --ip-src 192.168.1.0/24 -o eth1 -j mark --set-mark 0x23 --mark-target ACCEPT
 $A -A FORWARD -p IPv4 --ip-dst 192.168.1.0/24 -o eth0 -j mark --set-mark 0xr13 --mark-target ACCEPT
 $A -A FORWARD -o eth0 -j mark --set-mark 0x143 --mark-target ACCEPT
 $A -A FORWARD -o eth1 -j mark --set-mark 0x243 --mark-target ACCEPT
        exit
fi

3.2 status

ebtables.sh status
-p IPv4 -o eth1 --ip-src 192.168.1.0/24 -j mark --set-mark 0x23, pcnt = 0 -- bcnt = 0
-p IPv4 -o eth0 --ip-dst 192.168.1.0/24 -j mark --set-mark 0x13, pcnt = 0 -- bcnt = 0
-o eth0 -j mark --set-mark 0x143, pcnt = 222 -- bcnt = 42202
-o eth1 -j mark --set-mark 0x243, pcnt = 156 -- bcnt = 43603

Differentiated Service on Linux HOWTO

1.0. Differentiated Service Theory

1.1 Introduction 1.2 The specifications 1.3 The DS field 1.4 The architecture 1.5 Assure Forwarding PHB Group 1.6 Expedited Forwarding PHB

2.0. Linux Queuing Disciplines

2.1.- Linux Traffic Control 2.2.- FIFO queuing disciple 2.3.- PRIO queuing disciple 2.4.- TBF queuing discipline 2.5.- SFQ queuing discipline 2.6.- RED queuing discipline   2.7.- GRED queuing discipline   2.8.- HTB queuing discipline   2.9.- DSMARK queuing discipline   2.10.- TCINDEX classifier   2.11.- Policing

3.0. Differentiated Service on Linux distribution

3.1.- Edge1 3.2.- Edge2   3.3.- Edge31-ca-u32   3.4.- Edge32-ca-u32   3.5.- Edge31-cb-tables   3.6.- Edge32-cb-tables   3.7.- Edge32-cb-u32   3.8.- Afhtb   3.9. ef-prio   3.10.- ef-htb

??. References

tc iptables marking (htb shape)

# Script to shape up and downlink with traffic that is already MARKed

# Delete all old stuff first
tc qdisc del dev ppp0 root    2> /dev/null > /dev/null
tc qdisc del dev ifb0 root   2> /dev/null > /dev/null
tc qdisc del dev ifb0 ingress   2> /dev/null > /dev/null
tc qdisc del dev ppp0 root 2> /dev/null > /dev/null
tc qdisc del dev ifb0 root 2> /dev/null > /dev/null
tc qdisc del dev ppp0 ingress 2> /dev/null > /dev/null
tc qdisc del dev eth0 root 2> /dev/null > /dev/null
tc qdisc del dev eth0 ingress 2> /dev/null > /dev/null

# Set variables
# The downlink should be slightly less than the ADSL line
# All the classes below should add up to this
DOWNLINK=2200
# Same for the uplink
UPLINK=330

##############################################################################
## downlink via eth0 ##

# A qdisc is a whole set of shaping rules that we apply
# Here we add a HTB qdisc to the interface eth0
# This is known as the root for the interface
# We don't set a default class to stop us shaping local eth0 traffic
# We have to shape at eth0 and not ppp0 as we can only do egress shaping
tc qdisc add dev eth0 root handle 1: htb

# Then we add to the root some overall rate limits
tc class add dev eth0 parent 1: classid 1:1 htb rate ${DOWNLINK}kbit

# Then we go through and add a number of classes to the
# root qdisc. With some qdiscs the classes are automatically
# created. With HTB they are not so we add 4 in total
# with different rate limits for each

# interactive traffic
tc class add dev eth0 parent 1:1  classid 1:10 htb \
 rate 100kbit ceil 100kbit prio 0

# web browsing
tc class add dev eth0 parent 1:1  classid 1:30 htb \
 rate 1000kbit ceil 1000kbit prio 1

# default traffic
tc class add dev eth0 parent 1:1  classid 1:40 htb \
 rate 1000kbit ceil 1000kbit prio 2

# bad boys
tc class add dev eth0 parent 1:1  classid 1:60 htb \
 rate 100kbit ceil 100kbit prio 3

# Next we add some more qdiscs. These are different priority
# qdiscs but they each sit on top of the classes already created.
# So the root qdisc dumps traffic in each class, and the qdisc
# here prioritises within that class
tc qdisc add dev eth0 parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev eth0 parent 1:30 handle 30: sfq perturb 10 #flow hash keys dst divisor 1024 #hash ctorigsrc
tc qdisc add dev eth0 parent 1:40 handle 40: sfq perturb 10 #hash ctorigsrc
tc qdisc add dev eth0 parent 1:60 handle 60: sfq perturb 10 #hash ctorigsrc

# Finally we attach some filters to each class
# A filter is what sends a particular packet to a particular class
# This filter uses the iptables marks to allocate them
tc filter add dev eth0 parent 1:0 protocol ip handle 10 fw flowid 1:10
tc filter add dev eth0 parent 1:0 protocol ip handle 30 fw flowid 1:30
tc filter add dev eth0 parent 1:0 protocol ip handle 40 fw flowid 1:40
tc filter add dev eth0 parent 1:0 protocol ip handle 60 fw flowid 1:60

# These are additional filters that hash based on the client IP
# This means that rather than bandwidth being shared between
# several connections (so that one client could get several times
# the bandwidth), each client gets an equal slice of the bandwidth
# regardless of the number of connections they have
tc filter add dev eth0 parent 10: protocol ip handle 10 flow hash keys nfct-dst divisor 1024
tc filter add dev eth0 parent 30: protocol ip handle 30 flow hash keys nfct-dst divisor 1024
tc filter add dev eth0 parent 40: protocol ip handle 40 flow hash keys nfct-dst divisor 1024
tc filter add dev eth0 parent 60: protocol ip handle 60 flow hash keys nfct-dst divisor 1024

########################################## End of downlink configuration ##########################################



###################################################################################################################
## uplink via ppp0 ##

# A qdisc is a whole set of shaping rules that we apply
# Here we add a HTB qdisc to the interface ppp0
# This is known as the root for the interface
# Default class is 40
tc qdisc add dev ppp0 root handle 1: htb default 40

# Then we add to the root some overall rate limits
tc class add dev ppp0 parent 1: classid 1:1 htb rate ${UPLINK}kbit

# Then we go through and add a number of classes to the
# root qdisc. With some qdiscs the classes are automatically
# created. With HTB they are not so we add 4 in total
# with different rate limits each

# interactive traffic
tc class add dev ppp0 parent 1:1  classid 1:10 htb \
 rate 50kbit ceil 50kbit prio 0

# web browsing
tc class add dev ppp0 parent 1:1  classid 1:30 htb \
 rate 120kbit ceil 200kbit prio 1

# default traffic
tc class add dev ppp0 parent 1:1  classid 1:40 htb \
 rate 120kbit ceil 200kbit prio 2

# bad boys
tc class add dev ppp0 parent 1:1  classid 1:60 htb \
 rate 40kbit ceil 40kbit prio 3

# Next we add some more qdiscs. These are different priority
# qdiscs but they each sit on top of the classes already created.
# So the root qdisc dumps traffic in each class, and the qdisc
# here prioritises within that class
tc qdisc add dev ppp0 parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev ppp0 parent 1:30 handle 30: sfq perturb 10
tc qdisc add dev ppp0 parent 1:40 handle 40: sfq perturb 10 
tc qdisc add dev ppp0 parent 1:60 handle 60: sfq perturb 10

# Finally we attach some filters to each class
# A filter is what sends a particular packet to a particular class
# This filter uses the iptables marks to allocate them
tc filter add dev ppp0 parent 1:0 prio 0 protocol ip handle 10 fw flowid 1:10
tc filter add dev ppp0 parent 1:0 prio 0 protocol ip handle 30 fw flowid 1:30
tc filter add dev ppp0 parent 1:0 prio 0 protocol ip handle 40 fw flowid 1:40
tc filter add dev ppp0 parent 1:0 prio 0 protocol ip handle 60 fw flowid 1:60

# see download comment
tc filter add dev ppp0 parent 10: protocol ip handle 10 flow hash keys nfct-src divisor 1024
tc filter add dev ppp0 parent 30: protocol ip handle 30 flow hash keys nfct-src divisor 1024
tc filter add dev ppp0 parent 40: protocol ip handle 40 flow hash keys nfct-src divisor 1024
tc filter add dev ppp0 parent 60: protocol ip handle 60 flow hash keys nfct-src divisor 1024

################################# End of uplink configuration #####################################################

Courtesy : http://files.andybev.com/web-portal/shape-htb

Traffic shaping with tc

Sometimes it's necessary to limit traffic bandwidth from and to a container. You can do it using ordinary tc tool.
Contents

* 1 Packet routes
* 2 Limiting outgoing bandwidth
* 3 Limiting incoming bandwidth
* 4 Limiting CT to HN talks
* 5 Limiting packets per second rate from container
* 6 An alternate approch using HTB
* 7 External links

Packet routes

First of all, a few words about how packets travel from and to a container. Suppose we have Hardware Node (HN) with a container (CT) on it, and this container talks to some Remote Host (RH). HN has one "real" network interface eth0 and, thanks to OpenVZ, there is also "virtual" network interface venet0. Inside the container we have interface venet0:0.

venet0:0 venet0 eth0
CT >------------->-------------> HN >--------->--------> RH

venet0:0 venet0 eth0
CT <-------------<-------------< HN <---------<--------< RH

Limiting outgoing bandwidth

We can limit container outgoing bandwidth by setting the tc filter on eth0.

DEV=eth0
tc qdisc del dev $DEV root
tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 100mbit
tc class add dev $DEV parent 1: classid 1:1 cbq rate 256kbit allot 1500 prio 5 bounded isolated
tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip src X.X.X.X flowid 1:1
tc qdisc add dev $DEV parent 1:1 sfq perturb 10

X.X.X.X is an IP address of container.

Limiting incoming bandwidth

This can be done by setting the tc filter on venet0:

DEV=venet0
tc qdisc del dev $DEV root
tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 100mbit
tc class add dev $DEV parent 1: classid 1:1 cbq rate 256kbit allot 1500 prio 5 bounded isolated
tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst X.X.X.X flowid 1:1
tc qdisc add dev $DEV parent 1:1 sfq perturb 10

Note that X.X.X.X is an IP address of container.

Limiting CT to HN talks

As you can see, two filters above don't limit container to HN talks. I mean a container can emit as much traffic as it wishes. To make such a limitation from the HN, it is necessary to use tc police on venet0:

DEV=venet0
tc filter add dev $DEV parent 1: protocol ip prio 20 u32 match u32 1 0x0000 police rate 2kbit buffer 10k drop flowid :1

Limiting packets per second rate from container

To prevent dos atacks from the container you can limit packets per second rate using iptables.

DEV=eth0
iptables -I FORWARD 1 -o $DEV -s X.X.X.X -m limit --limit 200/sec -j ACCEPT
iptables -I FORWARD 2 -o $DEV -s X.X.X.X -j DROP

Here X.X.X.X is an IP address of container.
An alternate approch using HTB

For details refer to the HTB Home Page

#!/bin/sh
#
# Incoming traffic control
#
CT_IP1=$1
CT_IP2=$2
DEV=venet0
#
tc qdisc del dev $DEV root
#
tc qdisc add dev $DEV root handle 1: htb default 10
#
tc class add dev $DEV parent 1: classid 1:1 htb rate 100mbit burst 15k
tc class add dev $DEV parent 1:1 classid 1:10 htb rate 10mbit ceil 10mbit burst 15k
tc class add dev $DEV parent 1:1 classid 1:20 htb rate 20mbit ceil 20mbit burst 15k
tc class add dev $DEV parent 1:1 classid 1:30 htb rate 30mbit ceil 30mbit burst 15k
#
tc qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10
tc qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10
#
if [ ! -z $CT_IP1 ]; then
tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip dst "$CT_IP1" flowid 1:20
fi
if [ ! -z $CT_IP2 ]; then
tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip dst "$CT_IP2" flowid 1:30
fi
#
echo;echo "tc configuration for $DEV:"
tc qdisc show dev $DEV
tc class show dev $DEV
tc filter show dev $DEV
#
# Outgoing traffic control
#
DEV=eth0
#
tc qdisc del dev $DEV root
#
tc qdisc add dev $DEV root handle 1: htb default 10
#
tc class add dev $DEV parent 1: classid 1:1 htb rate 100mbit burst 15k
tc class add dev $DEV parent 1:1 classid 1:10 htb rate 10mbit ceil 10mbit burst 15k
tc class add dev $DEV parent 1:1 classid 1:20 htb rate 20mbit ceil 20mbit burst 15k
tc class add dev $DEV parent 1:1 classid 1:30 htb rate 30mbit ceil 30mbit burst 15k
#
tc qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10
tc qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10
#
if [ ! -z $CT_IP1 ]; then
tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip src "$CT_IP1" flowid 1:20
fi
if [ ! -z $CT_IP2 ]; then
tc filter add dev $DEV protocol ip parent 1:0 prio 1 u32 match ip src "$CT_IP2" flowid 1:30
fi
#
echo;echo "tc configuration for $DEV:"
tc qdisc show dev $DEV
tc class show dev $DEV
tc filter show dev $DEV

Courtesy : http://wiki.openvz.org/Traffic_shaping_with_tc