<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.28.1">
</HEAD>
<BODY>
В Птн, 12/03/2010 в 14:59 -0500, Kevin White пишет:
<BLOCKQUOTE TYPE=CITE>
<PRE>
For example, for all of the data going out of a box on a tunnel, I want
to separate it into two groups, traffic going to remote IP address A
then traffic going anywhere else. Address A gets priority: if data
needs to go out to A, it goes in front of data heading anywhere else.
How does Openswan sit in the whole Linux networking stack? Can I do
traffic shaping on data I'm sending out the VPN? Does Klips or native
make a difference?
</PRE>
</BLOCKQUOTE>
<BR>
<PRE>
If you want to use klips, you can use the following example script from my openwrt box.
If you want to use native, you need to tag ipsec packets to move them in queue IMQ ("...-j IMQ - todev $IMQ_")
My example:
#!/bin/sh /etc/rc.common
START=70
INET_IFACE="ipsec0"
IMQ_OUT="0"
IMQ_IN="1"
start() {
insmod sch_htb
insmod sch_sfq
insmod cls_u32
#######################################################################################################
#Outgoing traffic
#
iptables -t mangle -A POSTROUTING -o $INET_IFACE -j IMQ --todev $IMQ_OUT
tc qdisc add dev imq$IMQ_OUT root handle 1: htb default 20
tc class add dev imq$IMQ_OUT parent 1: classid 1:1 htb rate 500kbit burst 2k ceil 500kbit
tc class add dev imq$IMQ_OUT parent 1:1 classid 1:10 htb rate 400kbit burst 2k prio 0 ceil 500kbit
tc class add dev imq$IMQ_OUT parent 1:1 classid 1:20 htb rate 100kbit burst 2k prio 1 ceil 500kbit
tc qdisc add dev imq$IMQ_OUT parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev imq$IMQ_OUT parent 1:20 handle 20: sfq perturb 10
tc filter add dev imq$IMQ_OUT parent 1: protocol ip u32 match <U>ip dst A.A.A.A</U> flowid 1:10
ip link set imq$IMQ_OUT up
#######################################################################################################
#Incoming traffic
#
iptables -t mangle -A PREROUTING -i $INET_IFACE -j IMQ --todev $IMQ_IN
tc qdisc add dev imq$IMQ_IN root handle 1: htb default 20
tc class add dev imq$IMQ_IN parent 1: classid 1:1 htb rate 500kbit burst 2k ceil 500kbit
tc class add dev imq$IMQ_IN parent 1:1 classid 1:10 htb rate 400kbit burst 2k prio 0 ceil 500kbit
tc class add dev imq$IMQ_IN parent 1:1 classid 1:20 htb rate 100kbit burst 2k prio 1 ceil 500kbit
tc qdisc add dev imq$IMQ_IN parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev imq$IMQ_IN parent 1:20 handle 20: sfq perturb 10
tc filter add dev imq$IMQ_IN parent 1: protocol ip u32 match <U>ip src A.A.A.A</U> flowid 1:10
ip link set imq$IMQ_IN up
#######################################################################################################
}
stop() {
ip link set imq$IMQ_OUT down
ip link set imq$IMQ_IN down
tc qdisc del dev imq$IMQ_OUT root
tc qdisc del dev imq$IMQ_IN root
iptables -t mangle -D POSTROUTING -o $INET_IFACE -j IMQ --todev $IMQ_OUT
iptables -t mangle -D PREROUTING -i $INET_IFACE -j IMQ --todev $IMQ_IN
rmmod sch_htb
rmmod sch_sfq
rmmod cls_u32
}
</PRE>
<BR>
Best regards,<BR>
Sergey
</BODY>
</HTML>