<br><br><div class="gmail_quote">2009/3/26 Danilo Godec <span dir="ltr"><<a href="mailto:danilo.godec@agenda.si">danilo.godec@agenda.si</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hi,<br>
<br>
we have several hundred machines acting as xDSL routers (among other<br>
things). These machines are running 2.4.27+ kernels, OpenSwan with KLIPS<br>
and TC to reserve some bandwidth for mission critical traffic. All<br>
traffic is encrypted and we also use iptables for more selective access<br>
control (not everything from and to remote network is allowed).<br>
<br>
For reasons that are out of our hands we will need to move to a more<br>
recent kernel - 2.6.xx and NETKEY. However the need for bandwidth<br>
reservation and refined access control is still there.<br>
<br>
Is it possible to use TC to shape traffic before it is encrypted?<br>
</blockquote><div><br>Hello!<br><br>Just an idea - how about marking incoming packets, and shaping the outgoing traffic basing upon the marks?<br>This should do the work.<br>In iptables the MARK target should be used, and in tc the fw filter.<br>
<br>B. Regards,<br>Tomasz Grzelak<br></div></div><br>