Linux Advanced Routing & Traffic Control HOWTO

Bert Hubert

<bert.hubert@netherlabs.nl >

A very hands-on approach to iproute2 , traffic shaping and a bit of netfilter .

Table of Contents

1. Dedication

2. Introduction

2.1. Disclaimer & License

2.2. Prior knowledge

2.3. What Linux can do for you

2.4. Housekeeping notes

2.5. Access, CVS & submitting updates

2.6. Mailing list

2.7. Layout of this document

3. Introduction to iproute2

3.1. Why iproute2?

3.2. iproute2 tour

3.3. Prerequisites

3.4. Exploring your current configuration

3.5. ARP

4. Rules - routing policy database

4.1. Simple source policy routing

4.2. Routing for multiple uplinks/providers

5. GRE and other tunnels

5.1. A few general remarks about tunnels:

5.2. IP in IP tunneling

5.3. GRE tunneling

5.4. Userland tunnels

6. IPv6 tunneling with Cisco and/or 6bone

6.1. IPv6 Tunneling

7. IPsec: secure IP over the Internet

8. Multicast routing

9. Queueing Disciplines for Bandwidth Management

9.1. Queues and Queueing Disciplines explained

9.2. Simple, classless Queueing Disciplines

9.3. Advice for when to use which queue

9.4. Terminology

9.5. Classful Queueing Disciplines

9.6. Classifying packets with filters

9.7. The Intermediate queueing device (IMQ)

10. Load sharing over multiple interfaces

10.1. Caveats

10.2. Other possibilities

11. Netfilter & iproute - marking packets

12. Advanced filters for (re-)classifying packets

12.1. The u32 classifier

12.2. The route classifier

12.3. Policing filters

12.4. Hashing filters for very fast massive filtering

13. Kernel network parameters

13.1. Reverse Path Filtering

13.2. Obscure settings

14. Advanced & less common queueing disciplines

14.1. bfifo / pfifo

14.2. Clark-Shenker-Zhang algorithm (CSZ)

14.3. DSMARK

14.4. Ingress qdisc

14.5. Random Early Detection (RED)

14.6. Generic Random Early Detection

14.7. VC/ATM emulation

14.8. Weighted Round Robin (WRR)

15. Cookbook

15.1. Running multiple sites with different SLAs

15.2. Protecting your host from SYN floods

15.3. Rate limit ICMP to prevent dDoS

15.4. Prioritizing interactive traffic

15.5. Transparent web-caching using netfilter , iproute2 , ipchains and squid

15.6. Circumventing Path MTU Discovery issues with per route MTU settings

15.7. Circumventing Path MTU Discovery issues with MSS Clamping (for ADSL, cable, PPPoE & PPtP users)

15.8. The Ultimate Traffic Conditioner: Low Latency, Fast Up & Downloads

15.9. Rate limiting a single host or netmask

16. Building bridges, and pseudo-bridges with Proxy ARP

16.1. State of bridging and iptables

16.2. Bridging and shaping

16.3. Pseudo-bridges with Proxy-ARP

17. Dynamic routing - OSPF and BGP

18. Other possibilities

19. Further reading

20. Acknowledgements