We have say 4 users in a private network connected to the Internet trough a Linux router with a public IP address that is doing network address translation (NAT). I have to configure QoS to give access to the users to Internet but with throttled bandwidth for 2 users while for others no limitations.


eth0 of Linux Router is a 10Mbps link. eth1 is connected to switch and 4 nodes are connected to the switch. I want configure tc to throttle bandwidth of 2 nodes only i.e. a group of users (XyZ in picture) to use only 3Mbps cumulatively. (When 1 user will be downloading/uploading, he/she must get 3Mbps but when 3 users are downloading/uploading simultaneously they must receive 1MBps )

First please let me know is the requirement achievable, if yes how shall I proceed?

Below is the topology

enter image description here

1 Answer 1


You need to pick a class aware qdisc like HFSC or HTB.

Then you'll have to build a class tree like this:

Root Class (10MBit)
\--- XyZ Class (rate 3Mbit ceil 3Mbit)
|    |
|    \--- Client 10 (rate 1.5Mbit ceil 3Mbit)
|    \--- Client 11 (rate 1.5Mbit ceil 3Mbit)
\--- Client 30 (rate 3.5Mbit ceil 10Mbit)
\--- Client 40 (rate 3.5Mbit ceil 10Mbit)

And that on both interfaces (for upload and download shaping).

With HTB to get predictable results you should make sure that the sum of children is always equal to parent. So Root has 10Mbit, and its direct children equal (Xyz 3Mbit + Client30 3.5Mbit + Client40 + 3.5Mbit == 10Mbit). Likewise XyZ has 3Mbit and its children Client10+Client11.

Years and years ago I wrote a script that did something similar:


It's unmaintained today, but maybe it can give you some ideas anyway.

Traffic shaping in Linux was a bit of an neglected/esoteric field, hard to find good documentation too. Not sure if that ever changed...

There is http://lartc.org/ (ignore the wondershaper part)

and the Kernel Packet Traveling Diagram http://www.docum.org/docum.org/kptd/ (also the FAQ)

Or if that's all to complicated, maybe a stateless qdisc like ESFQ will do the trick for you. It tries to achieve some kind of equilibrium between clients without actually applying any hard bandwidth limits.

Good luck.

  • Thanks for taking time to answer, Well, Okay I've understood the tree you want me to create on eth1, are you suggesting me to create same class tree on eth0 which is public interface? how will eth0 know about the client addresses? They would have been NATed when they reach eth0 , no? What I'm missing?
    – Neel
    Jun 9, 2015 at 12:46
  • You're only shaping outgoing traffic, so you (or rather, iptables or nftables I guess) should know which client it belongs to and mark the packets accordingly. Jun 9, 2015 at 13:10
  • 1
    Okay so I'm doing it on egress traffic from Linux Router to Local Network I should build class tree on eht1 right? Then why should I build class tree on eth0? I mean what I'm understanding wrong?
    – Neel
    Jun 9, 2015 at 13:14
  • 3
    eth0: upload, eth1: download. If you want to shape both directions you need qdisc on both interfaces. You can influence downloads only indirectly (delay or drop tcp packets and hope the other side will take the hint). Jun 9, 2015 at 13:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .