<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p style="line-height: 100%">I took an extra router I had
and bridged two ports on the router's switch, so they just pass
traffic. (eth0.2 and eth0.3)<br>
</p>
<p style="line-height: 100%">Clients >-[Main Router] --[Extra
Router]--[Cable-Modem]<br>
</p>
<p style="line-height: 100%">The extra router is passive. It acts
like it's part of the Ethernet cable between the main router and
cable modem. It does not interfere.<br>
</p>
<p style="line-height: 100%">The extra router needs these packages:</p>
<p style="line-height: 100%">kmod-ebtables, kmod-ebtables-ipv4,
kmod-crypto-pcompress and the two packages compiled from the
Makefile
I showed below (iptables-mod-ndpi and iptables-mod-ndpi)</p>
<p style="line-height: 100%">I edited /etc/sysctl.conf and change
the
last two lines to this:</p>
<p style="line-height: 100%">net.bridge.bridge-nf-call-ip6tables=1<br>
net.bridge.bridge-nf-call-iptables=1</p>
<p style="line-height: 100%">This enables bridge firewalling, so the
traffic between the two ports can be marked.<br>
</p>
<p style="line-height: 100%">I then added firewall rules to LuCIs
custom firewall rules tab.</p>
<p style="line-height: 100%">Example Rules, modify classes as
desired:<br>
</p>
<p style="line-height: 100%">iptables -t mangle -A FORWARD -m ndpi
--steam -m mac ! --mac-source <b>Your Main Router's Mac Address</b>
-j DSCP
--set-dscp-class cs0<br>
iptables -t mangle -A FORWARD -m ndpi
--youtube -m mac ! --mac-source <b>Your Main Router's Mac Address</b>
-j DSCP
--set-dscp-class cs2</p>
<p style="line-height: 100%">iptables -t mangle -A FORWARD -m ndpi
--netflix -m mac ! --mac-source <b>Your Main Router's Mac Address</b>
-j DSCP
--set-dscp-class cs3<br>
iptables -t mangle -A FORWARD -m ndpi
--skype -m mac ! --mac-source <b>Your Main Router's Mac Address</b>
-j DSCP
--set-dscp-class cs4</p>
<p style="line-height: 100%">Have your main router use some form of
DiffServ for both upload and download on its WAN interface. For
upload traffic, you just need the two packages from the makefile
to be installed on the main router and create firewall rules like
this:</p>
<p style="line-height: 100%">iptables -t mangle -A FORWARD -o eth2
-m ndpi --netflix -j DSCP --set-dscp-class cs3<br>
iptables -t mangle -A FORWARD -o eth2 -m ndpi --skype -j DSCP
--set-dscp-class cs4</p>
<p style="line-height: 100%">If you need help building a custom
firmware image, just let me know.<br>
</p>
<br>
<div class="moz-cite-prefix">On 11/10/2016 9:06 PM, Outback Dingo
wrote:<br>
</div>
<blockquote
cite="mid:CAKYr3zwOk=andE45Da1UvZuopm8DJ7ewYgLf4esvo28=39SMJw@mail.gmail.com"
type="cite">
<pre wrap="">On Fri, Nov 11, 2016 at 9:55 AM, Noah Causin <a class="moz-txt-link-rfc2396E" href="mailto:n0manletter@gmail.com"><n0manletter@gmail.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I finally got my project working.
I integrated the NDPI Deep Packet Inspection engine into my LEDE build, so I
could prioritize applications using Cake.
<a class="moz-txt-link-freetext" href="http://www.ntop.org/products/deep-packet-inspection/ndpi/">http://www.ntop.org/products/deep-packet-inspection/ndpi/</a>
NDPI integrates into IPTables, which allows me to DSCP mark packets. Cake
reads the DiffServ markings and puts the traffic into appropriate classes.
I found a Makefile which successfully compiles:
<a class="moz-txt-link-freetext" href="https://github.com/981213/lede_src/blob/0d344bc2958838dcbc547a8f0a3d8842e6f6d2f8/package/my_package/ndpi-netfilter/Makefile">https://github.com/981213/lede_src/blob/0d344bc2958838dcbc547a8f0a3d8842e6f6d2f8/package/my_package/ndpi-netfilter/Makefile</a>
The system works very well. Steam traffic is deprioritized to allow
applications like YouTube, Netflix, and Skype to receive higher amounts of
the available bandwidth.
What I do for ingress is bridge two ports on an extra router, enable bridge
firewalling, and create IPTables rules to mark downstream packets. The
router I use is a D-Link DGL-5500, which is comparable to an Archer C7.
IPv6 support is not available in this netfilter module, but the IPv4 support
is great.
Noah Causin
</pre>
</blockquote>
<pre wrap="">
very nice.... however, can you describe a bit better how you
configured for ingress ? a second router? configuration file ? your
high level description seems a bit confusing to me
</pre>
<blockquote type="cite">
<pre wrap="">_______________________________________________
Cake mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Cake@lists.bufferbloat.net">Cake@lists.bufferbloat.net</a>
<a class="moz-txt-link-freetext" href="https://lists.bufferbloat.net/listinfo/cake">https://lists.bufferbloat.net/listinfo/cake</a>
</pre>
</blockquote>
</blockquote>
<br>
</body>
</html>