0

Currently i have the below rule for rate limiting the traffic on port 22. This applies for all traffic, however i don't want this to apply for one IP say x.x.x.x , how to do this? So if the traffic is from x.x.x.x and port 22, there should not be any rate limitation.

        tc filter add dev eth1 parent ffff: protocol ip u32 \
              match ip sport 22 0xffff  \
              police rate 800kbit burst 24000 drop flowid :1
0

You can add a filter that will match this IP with an empty action that will classify the packet as "pass", without going through further filters. Since without specifying a priority the order can't be guessed, both filters should have a priority (aka prio or pref) set. So if you want to spare the IP 192.0.2.10 from rate limitation, you can replace your filter with those two:

tc filter add dev eth1 parent ffff: protocol ip priority 1 \
   u32 match ip src 192.0.2.10 action pass
tc filter add dev eth1 parent ffff: protocol ip priority 2 \
   u32 match ip sport 22 0xffff action police rate 800kbit burst 24000 drop flowid :1

Note that police is also an action, but the action keyword is optional (while it has to be stated for an empty action with only a pass option).

Also, if it can still suit this case, you should consider using shaping (delaying before having to drop) on egress traffic, rather than policing (dropping only) on ingress traffic: this would probably improve performances (avoiding duplicate packets on the wire because of drops).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.