[Pay87]

OK same problem
Download speed is controlled right but upload speed to web is full even when limited.

[phuzi0n]

And the queues on vlan1 are still there?

[Pay87]

yes

[phuzi0n]

tc -s class show dev vlan1

[Pay87]

root@tabasco:~# tc -s class show dev vlan1
class htb 1:1 root rate 100000Kbit ceil 100000Kbit burst 1023975b cburst 126575b
Sent 252882671 bytes 870897 pkts (dropped 0, overlimits 0)
rate 21792bit 13pps
lended: 0 borrowed: 0 giants: 0
tokens: 67106 ctokens: 8294

class htb 1:100 parent 1:1 leaf 100: prio 2 rate 100000Kbit ceil 100000Kbit burst 1023975b cburst 126575b
Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
lended: 0 borrowed: 0 giants: 0
tokens: 67108 ctokens: 8296

class htb 1:10 parent 1:2 leaf 10: prio 4 rate 427000bit ceil 570000bit burst 6Kb cburst 2311b
Sent 16003375 bytes 285485 pkts (dropped 0, overlimits 0)
rate 3056bit 7pps
lended: 285485 borrowed: 0 giants: 0
tokens: 93562 ctokens: 26031

class htb 1:2 parent 1:1 rate 570000bit ceil 570000bit burst 6Kb cburst 2311b
Sent 252882671 bytes 870897 pkts (dropped 0, overlimits 0)
rate 19432bit 12pps
lended: 294906 borrowed: 0 giants: 0
tokens: 70089 ctokens: 26031

class htb 1:20 parent 1:2 leaf 20: prio 5 rate 85000bit ceil 570000bit burst 6Kb cburst 2311b
Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
lended: 0 borrowed: 0 giants: 0
tokens: 473708 ctokens: 26582

class htb 1:30 parent 1:2 leaf 30: prio 6 rate 57000bit ceil 570000bit burst 6Kb cburst 2311b
Sent 236879296 bytes 585412 pkts (dropped 0, overlimits 0)
rate 13760bit 5pps
lended: 290506 borrowed: 294906 giants: 0
tokens: 699050 ctokens: 25847

class htb 1:40 parent 1:2 leaf 40: prio 7 rate 1000bit ceil 570000bit burst 6Kb cburst 2311b
Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
lended: 0 borrowed: 0 giants: 0
tokens: 40265318 ctokens: 26582

[phuzi0n]

Looks fine to me. Traffic has been going through it and the limit is 570 kbps.

[Pay87]

Yes but in the qos settings i set for some users 200kbit etc and now they got full speed upload to the web..

[phuzi0n]

Ah, I guess you'll have to go back to the first method to make things easier.

[Pay87]

Okay but I tought there is an error in the first code

[phuzi0n]

Which was already corrected.

iptables -t mangle -A POSTROUTING -i br0 -o br0 -j MARK --set-mark 100
iptables -t mangle -A INPUT -i br0 -j MARK --set-mark 100
iptables -t mangle -A OUTPUT -o br0 -j MARK --set-mark 100

[Pay87]

Well its not working with the "corrected" code
I am back on:
iptables -t mangle -D PREROUTING -i br0 -j IMQ --todev 0

Better than everybody has full speed than nobody..

[phuzi0n]

The commands worked for you before though. The correction was only for lan to lan traffic with the postrouting rule.

[Pay87]

That is really strange I look again over it..

[Pay87]

[phuzi0n]

It deletes the first rule of the prerouting chain in the mangle table which could be anything. The safer version to do the same intended action is iptables -t mangle -D PREROUTING -i br0 -j IMQ --todev 0 but since the special version uses this to set the limits then it isn't really what you want. I've realized the reason it was working before is because of the connmark save rules although they're not as graceful as I'd like, but they should get the job done for now.

iptables -t mangle -A POSTROUTING -i br0 -o br0 -j MARK --set-mark 100
iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark
iptables -t mangle -A INPUT -i br0 -j MARK --set-mark 100
iptables -t mangle -A INPUT -j CONNMARK --save-mark
iptables -t mangle -A OUTPUT -o br0 -j MARK --set-mark 100
iptables -t mangle -A OUTPUT -j CONNMARK --save-mark