Linux Advanced Routing & Traffic
Control HOWTO
Bert Hubert
Netherlabs BV
bert.hubert@netherlabs.nl
Thomas Graf (Section Author)
tgraf%suug.ch
Gregory Maxwell (Section Author)
Remco van Mook (Section Author)
remco@virtu.nl
Martijn van Oosterhout (Section Author)
kleptog@cupid.suninternet.com
Paul B Schroeder (Section Author)
paulsch@us.ibm.com
Jasper Spaans (Section Author)
jasper@spaans.ds9a.nl
Pedro Larroy (Section Author)
piotr%member.fsf.org
Linux Advanced Routing & Traffic Control HOWTO
by Bert Hubert
Thomas Graf (Section Author)
tgraf%suug.ch
Gregory Maxwell (Section Author)
Remco van Mook (Section Author)
remco@virtu.nl
Martijn van Oosterhout (Section Author)
kleptog@cupid.suninternet.com
Paul B Schroeder (Section Author)
paulsch@us.ibm.com
Jasper Spaans (Section Author)
jasper@spaans.ds9a.nl
Pedro Larroy (Section Author)
piotr%member.fsf.org
A very hands-on approach to iproute2, traffic shaping and a bit of netfilter.
Revision History
Revision $Revision$ $Date$
DocBook Edition
Table of Contents
1. Dedication...............................................................................................................................................1
2. Introduction............................................................................................................................................2
2.1. Disclaimer & License..................................................................................................................2
2.2. Prior knowledge ..........................................................................................................................2
2.3. What Linux can do for you .........................................................................................................3
2.4. Housekeeping notes ....................................................................................................................3
2.5. Access, GIT & submitting updates .............................................................................................4
2.6. Mailing list ..................................................................................................................................5
2.7. Layout of this document .............................................................................................................5
3. Introduction to iproute2........................................................................................................................6
3.1. Why iproute2?.............................................................................................................................6
3.2. iproute2 tour................................................................................................................................6
3.3. Prerequisites ................................................................................................................................6
3.4. Exploring your current configuration..........................................................................................7
3.4.1. ip shows us our links ......................................................................................................7
3.4.2. ip shows us our IP addresses ..........................................................................................8
3.4.3. ip shows us our routes ....................................................................................................8
3.5. ARP.............................................................................................................................................9
4. Rules - routing policy database ..........................................................................................................11
4.1. Simple source policy routing ....................................................................................................11
4.2. Routing for multiple uplinks/providers.....................................................................................12
4.2.1. Split access ...................................................................................................................13
4.2.2. Load balancing .............................................................................................................14
5. GRE and other tunnels........................................................................................................................16
5.1. A few general remarks about tunnels:.......................................................................................16
5.2. IP in IP tunneling ......................................................................................................................16
5.3. GRE tunneling...........................................................................................................................17
5.3.1. IPv4 Tunneling .............................................................................................................17
5.3.2. IPv6 Tunneling .............................................................................................................19
5.4. Userland tunnels........................................................................................................................19
6. IPv6 tunneling with Cisco and/or 6bone............................................................................................21
6.1. IPv6 Tunneling..........................................................................................................................21
7. IPSEC: secure IP over the Internet....................................................................................................25
7.1. Intro with Manual Keying .........................................................................................................26
7.2. Automatic keying......................................................................................................................29
7.2.1. Theory...........................................................................................................................30
7.2.2. Example........................................................................................................................31
7.2.3. Automatic keying using X.509 certificates...................................................................34
7.3. IPSEC tunnels ...........................................................................................................................37
7.4. Other IPSEC software...............................................................................................................38
7.5. IPSEC interoperation with other systems .................................................................................39
7.5.1. Windows .......................................................................................................................39
7.5.2. Check Point VPN-1 NG ...............................................................................................39
iii
8. Multicast routing .................................................................................................................................40
9. Queueing Disciplines for Bandwidth Management ..........................................................................42
9.1. Queues and Queueing Disciplines explained............................................................................42
9.2. Simple, classless Queueing Disciplines ....................................................................................43
9.2.1. pfifo_fast.......................................................................................................................43
9.2.2. Token Bucket Filter ......................................................................................................45
9.2.3. Stochastic Fairness Queueing.......................................................................................48
9.3. Advice for when to use which queue ........................................................................................50
9.4. Terminology ..............................................................................................................................50
9.5. Classful Queueing Disciplines ..................................................................................................53
9.5.1. Flow within classful qdiscs & classes ..........................................................................53
9.5.2. The qdisc family: roots, handles, siblings and parents.................................................54
9.5.3. The PRIO qdisc ............................................................................................................55
9.5.4. The famous CBQ qdisc ................................................................................................58
9.5.5. Hierarchical Token Bucket ...........................................................................................66
9.6. Classifying packets with filters .................................................................................................67
9.6.1. Some simple filtering examples....................................................................................67
9.6.2. All the filtering commands you will normally need.....................................................68
9.7. The Intermediate queueing device (IMQ).................................................................................70
9.7.1. Sample configuration....................................................................................................70
10. Load sharing over multiple interfaces .............................................................................................72
10.1. Caveats ....................................................................................................................................73
10.2. Other possibilities ...................................................................................................................73
11. Netfilter & iproute - marking packets..............................................................................................75
12. Advanced filters for (re-)classifying packets ...................................................................................77
12.1. The u32 classifier....................................................................................................................78
12.1.1. U32 selector................................................................................................................78
12.1.2. General selectors ........................................................................................................79
12.1.3. Specific selectors ........................................................................................................81
12.2. The route classifier ...............................................................................................................82
12.3. Policing filters .........................................................................................................................83
12.3.1. Ways to police ............................................................................................................83
12.3.2. Overlimit actions ........................................................................................................84
12.3.3. Examples ....................................................................................................................85
12.4. Hashing filters for very fast massive filtering .........................................................................85
12.5. Filtering IPv6 Traffic...............................................................................................................87
12.5.1. How come that IPv6 tc filters do not work? ...............................................................88
12.5.2. Marking IPv6 packets using ip6tables........................................................................88
12.5.3. Using the u32 selector to match IPv6 packet .............................................................88
13. Kernel network parameters ..............................................................................................................90
13.1. Reverse Path Filtering .............................................................................................................90
13.2. Obscure settings ......................................................................................................................91
13.2.1. Generic ipv4 ...............................................................................................................91
13.2.2. Per device settings ......................................................................................................96
13.2.3. Neighbor policy ..........................................................................................................97
13.2.4. Routing settings ..........................................................................................................98
iv
14. Advanced & less common queueing disciplines............................................................................101
14.1. bfifo/pfifo ........................................................................................................................101
14.1.1. Parameters & usage ..................................................................................................101
14.2. Clark-Shenker-Zhang algorithm (CSZ) ................................................................................101
14.3. DSMARK..............................................................................................................................102
14.3.1. Introduction ..............................................................................................................102
14.3.2. What is Dsmark related to? ......................................................................................102
14.3.3. Differentiated Services guidelines............................................................................103
14.3.4. Working with Dsmark ..............................................................................................103
14.3.5. How SCH_DSMARK works....................................................................................104
14.3.6. TC_INDEX Filter.....................................................................................................105
14.4. Ingress qdisc..........................................................................................................................107
14.4.1. Parameters & usage ..................................................................................................107
14.5. Random Early Detection (RED) ...........................................................................................108
14.6. Generic Random Early Detection .........................................................................................109
14.7. VC/ATM emulation...............................................................................................................109
14.8. Weighted Round Robin (WRR) ............................................................................................110
15. Cookbook..........................................................................................................................................111
15.1. Running multiple sites with different SLAs..........................................................................111
15.2. Protecting your host from SYN floods..................................................................................112
15.3. Rate limit ICMP to prevent dDoS .........................................................................................113
15.4. Prioritizing interactive traffic ................................................................................................114
15.5. Transparent web-caching using netfilter, iproute2, ipchains and squid ................................115
15.5.1. Traffic flow diagram after implementation...............................................................119
15.6. Circumventing Path MTU Discovery issues with per route MTU settings ..........................120
15.6.1. Solution.....................................................................................................................121
15.7. Circumventing Path MTU Discovery issues with MSS Clamping (for ADSL, cable, PPPoE &
PPtP users)............................................................................................................................122
15.8. The Ultimate Traffic Conditioner: Low Latency, Fast Up & Downloads .............................123
15.8.1. Why it doesn’t work well by default ........................................................................123
15.8.2. The actual script (CBQ)............................................................................................125
15.8.3. The actual script (HTB)............................................................................................127
15.9. Rate limiting a single host or netmask ..................................................................................129
15.10. Example of a full nat solution with QoS.............................................................................129
15.10.1. Let’s begin optimizing that scarce bandwidth ........................................................130
15.10.2. Classifying packets.................................................................................................132
15.10.3. Improving our setup ...............................................................................................134
15.10.4. Making all of the above start at boot ......................................................................134
16. Building bridges, and pseudo-bridges with Proxy ARP...............................................................135
16.1. State of bridging and iptables................................................................................................135
16.2. Bridging and shaping ............................................................................................................135
16.3. Pseudo-bridges with Proxy-ARP ..........................................................................................135
16.3.1. ARP & Proxy-ARP...................................................................................................136
16.3.2. Implementing it ........................................................................................................136
v
