Traffic shaping / speed lanes

[David Mahon]

Quick question about traffic shaping. Route TO WAN and route FROM WAN.

Is TO WAN from firebrick to router or vice versa (TO WAN being from the
router to the firebrick's WAN port)?

And now I've found TO LAN and FROM LAN as well and I'm confused. There
are no tunnels active and traffic to/from the firebrick is minimal.
Should TO WAN and FROM LAN just be set the same? Do they both need to be
set?

For ADSL MAX should I set TO WAN as 400 and TO LAN as 8000 for the
default lane?

[David Mahon]

Post by David Mahon
Quick question about traffic shaping.

Perhaps I ought to explain what I want to do:

I want to limit all traffic to port 119 from outside the network to 64
kbps. Hopefully this should prevent me getting too high an internet
bill. I want to limit this traffic whether or not the connection was
initiated from inside or outside the firebrick. I don't mind about the
outgoing traffic.

As I want to limit traffic in reply to a session initiated on this side,
as well as traffic initiated outside, I guess I have to just limit all
port 119 traffic - is that right.

Should I limit TO WAN, FROM WAN, TO LAN or FROM LAN to 64 kbps for port
119 traffic, a combination of 2 of them or all of them?

[Ben Mack]

Hi David

I've not checked u.n.p.a, hope I'm not duplicating replies

Post by David Mahon
Quick question about traffic shaping. Route TO WAN and route FROM WAN.
Is TO WAN from firebrick to router or vice versa (TO WAN being from the
router to the firebrick's WAN port)?

TO WAN is from the routing core to the WAN port (i.e. to your WAN
router)

Post by David Mahon
And now I've found TO LAN and FROM LAN as well and I'm confused. There
are no tunnels active and traffic to/from the firebrick is minimal.
Should TO WAN and FROM LAN just be set the same? Do they both need to be
set?

If you just have traffic flowing between WAN and LAN, then just set the
rate TO and FROM WAN

Post by David Mahon
For ADSL MAX should I set TO WAN as 400 and TO LAN as 8000 for the
default lane?

If you want to prioritise certain traffic (e.g. VoIP QoS), then you want
to limit the rate TO/FROM WAN to just below what your link is capable
of, so all buffering takes place in the FireBrick, and none on your WAN
link (i.e. keep latency low)

With ADSL Max you need to find out what your line is actually capable
of, and set limits just below that

You can test whether you have got it right by prioritising ICMP, and
checking ping times stay low when running a TCP file transfer

Post by David Mahon
I want to limit all traffic to port 119 from outside the network to 64
kbps.

OK, just set up a shaping rule to catch all traffic with target port
119, and put it in its own speed lane. The set the rate from WAN to
64kbps max

Post by David Mahon
I want to limit this traffic whether or not the connection was
initiated from inside or outside the firebrick.

If session is initiated from inside, which is port 119, source or
target?

Post by David Mahon
I don't mind about the
outgoing traffic.
As I want to limit traffic in reply to a session initiated on this side,
as well as traffic initiated outside, I guess I have to just limit all
port 119 traffic - is that right.

See my question above.

To clarify;
Shaping rules apply to sessions
Speed lanes apply to individual packets

I.e. the speed lane doesn't care which way the session was established,
but the shaping rule does. Note the 'Both Ways' option in shaping rules
makes them apply to sessions initiated both ways

Post by David Mahon
Should I limit TO WAN, FROM WAN, TO LAN or FROM LAN to 64 kbps for port
119 traffic, a combination of 2 of them or all of them?

FROM WAN

HTH

[David Mahon]

Post by Ben Mack
Hi David
I've not checked u.n.p.a, hope I'm not duplicating replies

It's crossposted, no duplication.

Post by Ben Mack
If you just have traffic flowing between WAN and LAN, then just set the
rate TO and FROM WAN

I've been using TO WAN and TO LAN to set the limits.

Comparing the statistics in TO LAN and FROM WAN then shows me how much
traffic has been dropped by the firebricks shaping rules, which is
handy. Unfortunately, there's still quite a bit of traffic which is
being dropped - pity, because the idea was to reduce the chargeable
bandwidth on my ADSL link, not to receive some of the traffic anyway and
then have it dropped (and resent).

Would using a limit in FROM WAN rather than in TO LAN make any
difference at all?

[Ben Mack]

Post by David Mahon
Comparing the statistics in TO LAN and FROM WAN then shows me how much
traffic has been dropped by the firebricks shaping rules, which is
handy. Unfortunately, there's still quite a bit of traffic which is
being dropped - pity, because the idea was to reduce the chargeable
bandwidth on my ADSL link, not to receive some of the traffic anyway and
then have it dropped (and resent).

Sorry, I don't understand

Traffic shaping shouldn't normally drop traffic (I assume you mean
packet loss), it should just buffer it (unless of course the buffers
overflow).

The only way I know of reducing what comes down your line (without
equipment at the head-end) is to build up latency so the sending TCP
stack backs off