Linux Advanced Routing & Traffic Control HOWTO Bert Hubert Netherlabs BV [email protected] Thomas Graf (Section Author) tgraf%suug.ch Gregory Maxwell (Section Author) Remco van Mook (Section Author) [email protected] Martijn van Oosterhout (Section Author) [email protected] Paul B Schroeder (Section Author) [email protected] Jasper Spaans (Section Author) [email protected] Pedro Larroy (Section Author) piotr%member.fsf.org Linux Advanced Routing & Traffic Control HOWTO by Bert Hubert Thomas Graf (Section Author) tgraf%suug.ch Gregory Maxwell (Section Author) Remco van Mook (Section Author) [email protected] Martijn van Oosterhout (Section Author) [email protected] Paul B Schroeder (Section Author) [email protected] Jasper Spaans (Section Author) [email protected] Pedro Larroy (Section Author) piotr%member.fsf.org A very hands-on approach to iproute2, traffic shaping and a bit of netfilter. Revision History Revision $Revision: 1.35 $ $Date: 2003/07/26 19:57:49 $ DocBook Edition Table of Contents 1. Dedication...............................................................................................................................................1 2. Introduction............................................................................................................................................2 2.1. Disclaimer & License..................................................................................................................2 2.2. Prior knowledge ..........................................................................................................................2 2.3. What Linux can do for you .........................................................................................................3 2.4. Housekeeping notes ....................................................................................................................3 2.5. Access, CVS & submitting updates ............................................................................................4 2.6. Mailing list ..................................................................................................................................4 2.7. Layout of this document .............................................................................................................5 3. Introduction to iproute2........................................................................................................................6 3.1. Why iproute2?.............................................................................................................................6 3.2. iproute2 tour................................................................................................................................6 3.3. Prerequisites ................................................................................................................................6 3.4. Exploring your current configuration..........................................................................................7 3.4.1. ip shows us our links ......................................................................................................7 3.4.2. ip shows us our IP addresses ..........................................................................................8 3.4.3. ip shows us our routes ....................................................................................................8 3.5. ARP.............................................................................................................................................9 4. Rules - routing policy database ..........................................................................................................11 4.1. Simple source policy routing ....................................................................................................11 4.2. Routing for multiple uplinks/providers.....................................................................................12 4.2.1. Split access ...................................................................................................................13 4.2.2. Load balancing .............................................................................................................14 5. GRE and other tunnels........................................................................................................................16 5.1. A few general remarks about tunnels:.......................................................................................16 5.2. IP in IP tunneling ......................................................................................................................16 5.3. GRE tunneling...........................................................................................................................17 5.3.1. IPv4 Tunneling .............................................................................................................17 5.3.2. IPv6 Tunneling .............................................................................................................19 5.4. Userland tunnels........................................................................................................................19 6. IPv6 tunneling with Cisco and/or 6bone............................................................................................20 6.1. IPv6 Tunneling..........................................................................................................................20 7. IPSEC: secure IP over the Internet....................................................................................................24 7.1. Intro with Manual Keying.........................................................................................................25 7.2. Automatic keying ......................................................................................................................28 7.2.1. Theory...........................................................................................................................29 7.2.2. Example........................................................................................................................29 7.2.3. Automatic keying using X.509 certificates...................................................................33 7.3. IPSEC tunnels ...........................................................................................................................36 7.4. Other IPSEC software...............................................................................................................37 7.5. IPSEC interoperation with other systems .................................................................................38 7.5.1. Windows .......................................................................................................................38 7.5.2. Check Point VPN-1 NG ...............................................................................................38 iii 8. Multicast routing .................................................................................................................................39 9. Queueing Disciplines for Bandwidth Management ..........................................................................41 9.1. Queues and Queueing Disciplines explained............................................................................41 9.2. Simple, classless Queueing Disciplines ....................................................................................42 9.2.1. pfifo_fast.......................................................................................................................42 9.2.2. Token Bucket Filter ......................................................................................................45 9.2.3. Stochastic Fairness Queueing.......................................................................................47 9.3. Advice for when to use which queue ........................................................................................49 9.4. Terminology ..............................................................................................................................49 9.5. Classful Queueing Disciplines ..................................................................................................52 9.5.1. Flow within classful qdiscs & classes ..........................................................................52 9.5.2. The qdisc family: roots, handles, siblings and parents.................................................53 9.5.3. The PRIO qdisc ............................................................................................................54 9.5.4. The famous CBQ qdisc ................................................................................................57 9.5.5. Hierarchical Token Bucket ...........................................................................................64 9.6. Classifying packets with filters .................................................................................................66 9.6.1. Some simple filtering examples....................................................................................66 9.6.2. All the filtering commands you will normally need.....................................................67 9.7. The Intermediate queueing device (IMQ).................................................................................69 9.7.1. Sample configuration....................................................................................................69