Sharing bandwidth between IPs

Question

There are 200 users in my network, and these users are in two AD groups and cannot set specific IP ranges for each group. I want to set, for each group, the amount of bandwidth that can be shared between users of groups.

I can manage bandwidth for a IP with squid, and also with iptables+tc, but I want to set bandwidth for groups of IPs that share between users of that. How can I do that?

Answer 1

I can answer how to manage the bandwidth once you know what IP is in which group. You can use hierarchical token bucket to allocate three groups.

• 10 Group A
• 20 Group B
• 30 Unknown traffic for/from non-AD devices in your network

#Create egress shaping
$TC qdisc add dev eth0 root handle 1: htb default 20 r2q 50

$TC class add dev eth0 parent 1: classid 1:1 htb rate 19mbit ceil 19mbit

$TC class add dev eth0 parent 1:1 classid 1:10 htb rate 9mbit ceil 15mbit prio 1
$TC class add dev eth0 parent 1:1 classid 1:20 htb rate 8mbit ceil 15mbit prio 1
$TC class add dev eth0 parent 1:1 classid 1:30 htb rate 2mbit ceil 10mbit prio 2

#Send everything unknown to classid 1:30. The filter has low priority 
#(higher numbers are filtered later)
$TC filter add dev eth0 parent 1: prio 20 protocol all u32 match u32 0 0 flowid 1:30

In the script above the groups can lend bandwidth to other groups if they don't use it. If you don't want this set ceil to the same value as rate.

Now you can write a script that dynamically sends IPs to class 1:10 or 1:20. Probably you have to hook some dhcp- or ad-events.

The script for group A can look like this:

$TC filter replace dev eth0 parent 1: protocol ip prio 3 u32 match \
                ip dst $THEIP/32 flowid 1:10

Remember you can only control what you send. So if your router has interface eth0 and eth1, you have to manage bandwidth on eth1, too.

And consider to attach SFQ leaf QDISC to the classes. SFQ is just great!

$TC qdisc add dev eth0 parent 1:10 handle 110: sfq perturb 10
$TC qdisc add dev eth0 parent 1:20 handle 120: sfq perturb 10
$TC qdisc add dev eth0 parent 1:30 handle 130: sfq perturb 10

Mapping IPs to groups

Finding out what IP is in which group highly depends on the software you use. If your software doesn't support events you might write a script that parses the log and decides to allocate a IP on a certain group.