• Patrick McHardy's avatar
    [NETFILTER]: x_tables: add rateest match · 50c164a8
    Patrick McHardy authored
    Add rate estimator match. The rate estimator match can match on
    estimated rates by the RATEEST target. It supports matching on
    absolute bps/pps values, comparing two rate estimators and matching
    on the difference between two rate estimators.
    
    This is what I use to route outgoing data connections from a FTP
    server over two lines based on the  available bandwidth:
    
    # estimate outgoing rates
    iptables -t mangle -A POSTROUTING -o eth0 -j RATEEST --rateest-name eth0 \
                                                         --rateest-interval 250ms \
                                                         --rateest-ewma 0.5s
    iptables -t mangle -A POSTROUTING -o ppp0 -j RATEEST --rateest-name ppp0 \
                                                         --rateest-interval 250ms \
                                                         --rateest-ewma 0.5s
    
    # mark based on available bandwidth
    iptables -t mangle -A BALANCE -m state --state NEW \
                                  -m helper --helper ftp \
                                  -m rateest --rateest-delta \
                                             --rateest1 eth0 \
                                             --rateest-bps1 2.5mbit \
                                             --rateest-gt \
                                             --rateest2 ppp0 \
                                             --rateest-bps2 2mbit \
                                  -j CONNMARK --set-mark 0x1
    
    iptables -t mangle -A BALANCE -m state --state NEW \
                                  -m helper --helper ftp \
                                  -m rateest --rateest-delta \
                                             --rateest1 ppp0 \
                                             --rateest-bps1 2mbit \
                                             --rateest-gt \
                                             --rateest2 eth0 \
                                             --rateest-bps2 2.5mbit \
                                  -j CONNMARK --set-mark 0x2
    
    iptables -t mangle -A BALANCE -j CONNMARK --restore-mark
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    50c164a8
Kconfig 26.3 KB