2

I have a wifi router where the wlan0 interface (radio interface) is bridged with the ethernet interface eth0 (connected to another server acting as DHCP)

/ # brctl show br0
bridge name     bridge id               STP enabled     interfaces
br0             8000.bce67c4d8fb0       no              eth0
                                                        
                                                        
                                                        wlan0

Linux Kernel version: 4.4.60 nftables version: v0.9.6

I was trying to setup a rule in ip6 family to rate-limit ipv6 traffic. Here is my rule:

/ # nft list chain ip6 ngadre_rate_limiting ngadre_counter
table ip6 ngadre_rate_limiting {
        chain ngadre_counter {
                type filter hook prerouting priority raw; policy accept;
                limit rate 625 kbytes/second counter packets 1945 bytes 609744 accept
                counter packets 0 bytes 0 drop
        }
}

When I run sudo ping6 2006:db8:0:f101::10 -i 0.1 the rule is hit and counter are incrementing. But when I run iperf3 -V -c 2006:db8:0:f101::10 -p5678 -i1 -tinf, the rule is not hit counters are not incrementing and traffic is not rate limited.

I applied the rule following this wiki:

nft add rule filter input limit rate 10 mbytes/second accept

Am I missing something in the ip6 rule ?

UPDATE 1: I tried with limit rate 2/second and tried fast ping6 -i 0.1, here rule is being hit and drop counters incrementing, also ping6 is being rate limited to 2 packets per second. THat means with icmpv6 there doesn't seem any issue with limit rate, but when I try iperf3, this rule does not even hit and drop counters also not incrementing.

2
  • @A.B unfortunately, Since nftables v0.6 and linux kernel 4.6, ruleset debug/tracing is supported. my kernel does not support tracing.
    – Haswell
    Jul 8, 2023 at 4:18
  • Can you please help with the ip6 family, ignore the bridge for now, as its a work around I trying, the ip6 rules are complete. Also, the link which I mentioned, that does not put any mark on the packet. So is it required in the ip6 rule which I tried fresh.
    – Haswell
    Jul 8, 2023 at 14:14

1 Answer 1

1

After some internal help from my org, there are certain rules added elsewhere where marking is happening on packets, which I cannot share on open forum. Based on that the packets were skipping the rate limit rule. I resolved that issue by setting proper marks.

2
  • See the marks I have been asking all along: they were the problem
    – A.B
    Jul 11, 2023 at 12:07
  • Yes Sir, your suggestion prompted me to look in that direction.
    – Haswell
    Jul 11, 2023 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .