1. Ingress bandwidth shaping vs. Netfilter
7.th Netfilter Workshop
18.th to 21.th October 2010 by
Jesper Dangaard Brouer
Linux Kernel Developer
ComX Networks A/S

2. Overview Our old setup Use of outgoing bandwidth shaping Our new setup
Why we need ingress bandwidth shaping
IMQ vs IFB
Proposal / discussion
How can we use iptables for classify?
Adding table before ingress qdisc step?

3. Old setup: Outgoing BW limit
Per customer Iptables classification (rule tree)
(Using CLASSIFY target)

4. New setup: Act as router
Partisipate as real router
Route unrelated traffic through eth0 and eth1

5. New setup: Issues Why outgoing shaping is a problem
Double bandwidth to customers
Need to route traffic through eth0 and eth1
Unnecessary bandwidth limit routed traffic
Brake multiqueue scalability
Thus, cannot scale to 10Gbit/s

6. Solution: Ingress shaping
Move shaping
Only on customer facing interfaces (eth10 and eth20)
Implying ingress shaping
Ingress options
IMQ (InterMediate Queueing)
IFB (Intermediate Functional Block)

7. IMQ vs IFB Discussion IMQ (InterMediate Queueing) Bad: Not in mainline
Bad: Changes skbuff
Good: Can use iptables for classification
IFB (Intermediate Functional Block)
Good: In mainline
Bad: Can not use iptables for classification
Solution: Need new netfilter hook?
Discussion

8. Discussion Can we add a new hook Before ingress queue disc?
Seperate table or reuse RAW or mangle??
If new → table name???
Allow action mirred/redirect/steal tricks?
Hack: create tc-filter ”action iptables”
Which calls do_table()
Bad: traverse the table twice
Action 'ipt' exists but only calls targets
Notice: cannot jump to a chainname due to ”blobs”