I'm running torrent client on my headless Ubuntu server. Also number of computers are connected to this server, which is used as internet gateway/router. The question is whether it's possible to configure iptables to prioritize traffic from eth1(lan if) over local traffic generated by server? Something like QOS..

  • Are you aware that 10.04 is off topic right? – Braiam Jan 9 '14 at 0:09
  • this applies to higher releases as well. – Pablo Jan 9 '14 at 10:22
  • take a look at tc qdisc... too lartc.org/manpages/tc.txt‎ – Ismail Yushaw Jan 9 '14 at 22:44

There are several alternatives to achieve what you are looking for. But first of all, yes it is possible. Though, many of the possibilities are rather complex.

One of the easiest options might be to run the torrent daemon under a own user\group. Then use iptables to mark all traffic from that user\group with a flag. Then later let the tc filter on that flag and put it in the low priority queue. Look at the bottom of this wiki for an idea.

For what you are asking do you only need two queues(fig 1.), one low priority and one high. Though it might be better to stick with something closer to this example. You can adopt the example to your needs, just drop the part with nat and make the default mark lower value than the mark you will use for the traffic generated by the daemon.

So for my suggestion you can use something like iptables -A OUTPUT -t mangle -m owner --uid-owner ZZZZ -j MARK --set-mark 6 ZZZZ is the user identificator.

An alternative for setting a flag might be to use iptables -A OUTPUT -t mangle -m owner --uid-owner ZZZZ -j CLASSIFY --set-class X:Y where X and Y is the class identifier, and ZZZZ is the user identificator.

Fig 1:

| root 1: |
| class 1:1  |
  |      |    
+----+ +----+ 
|1:10| |1:11| 
+----+ +----+

The best might be to have a leaf for every fw mark. But my best advice now is, read and try to understand the example referred above to adopt it to your needs. If you have any questions add them.

In the example referred above, is it important that you understand this part (fig 2.) when you want to write iptables rules for marking or classifying traffic. For a short explanation of it with a slightly different looking diagram have a look at this.

Fig 2:

First you have to understand how packet traverse the filters with iptables:

        +------------+                +---------+               +-------------+
Packet -| PREROUTING |--- routing-----| FORWARD |-------+-------| POSTROUTING |- Packets
input   +------------+    decision    +---------+       |       +-------------+    out
                             |                          |
                        +-------+                    +--------+   
                        | INPUT |---- Local process -| OUTPUT |
                        +-------+                    +--------+

This will point you in the right direction:

Rules, Guidelines and Approaches

Linux Advanced Routing & Traffic Control HOWTO: Rate limiting a single host or netmask

A Traffic Control Journey: Real World Scenarios

Iptables Tutorial 1.2.2

  • I came across this while googling and also DD-WRT based routers are using tc in order to mimic QOS. But I don't know how to configure in my particular case... Any example will be appreciated. – Pablo Jan 9 '14 at 20:21
  • 1
    will come back with more head on, if i got the time : ) – Anders F. U. Kiær Jan 9 '14 at 22:38
  • What if I mark packets from LAN port to avoid changing anything related to my app? – Pablo Jan 11 '14 at 10:39
  • @pablo yes, then mark all traffic from eg. ethZ with mark 1\0 for high priority and then traffic shape with that in mind. Make the default tc rule for unmarked to have low priority. Or classify all traffic from that ethZ to be in class X and all other traffic to be in class Y. Priority X over Y. Also possible to give them a a ratio of the available rate eg. like 20/80 and allow them to borrow from each other when the other doesn't use its dedicated bandwidth. – Anders F. U. Kiær Jan 12 '14 at 0:38

Quality of service is quite a complex topic -- the link posted by @anders-f-u-kiaer is possibly the best solution, but quite complex. I am not at all an expert on this so I will not comment.

Nevertheless, often a simpler solution can be handy. If you want just to limit the bandwidth for one program (for example, the torrent client) a much simple solution is using trickle (1).

You can install it by

sudo apt-get install trickle 

and then you run a program with

trickle -d 100 -u 50 program 

and program will have its bandwidth topped at 100 kbps for download and 50 kbps for upload. A lot more options and info for trickle can be found on this page on tuxradar: control your bandwidth with trickle.

(1) This is different from proper QoS: the bandwidth used by the "crippled" program will be reduced every time, not only when there is demand on the higher priority services as it will happen with proper QoS.

  • I don't really want to set top u/l bandwidths. What I need is the program to use as much as it can, until LAN interface is idle. When there will be traffic through LAN, I want the program to yield traffic to the LAN, but still be able to use it as much as possible. What you are saying is hard limiting program u/l limits, which I can do without trickle from inside torrent client(rtorrent). Hope it's clear. – Pablo Jan 9 '14 at 20:18

You don't do this with iptables. You need to change the routing metrics.

Set routing metrics for a network interface — Ubuntu Apps Directory

To give all other interfaces a higher priority than wlan0 simply run:

ifmetric wlan0 1

To reset the metrics of the routes attached to wlan0 simply run:

 ifmetric wlan0 0

more info here: http://0pointer.de/lennart/projects/ifmetric/

  • 2
    Could you either bring some example on what should I do after installing ifmetric? – Pablo Jan 9 '14 at 10:25
  • 2
    Changing the metrics will only prioritize one interface (route) with respect to another, it will not do QoS or shaping. – Rmano Jan 9 '14 at 16:20

protected by fossfreedom Jan 9 '14 at 22:39

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.