[NBLUG/talk] Linux as router
Osiris Pedroso
opedroso at swoptimizer.com
Wed Nov 3 13:02:15 PST 2004
That sounds great!
Question on this line:
> Here is a rule from one of my firewalls that uses TOS shaping.
> iptables -t mangle -A OUTPUT -p tcp -j TOS --dport 20:21 --set-tos 8
Aren't port 20 and 21 ports for FTP traffic? Or does you VoIP also go
through them?
Osiris Pedroso
--
Ph: (707) 658-3500
http://www.SWoptimizer.com
-----Original Message-----
From: talk-bounces at nblug.org [mailto:talk-bounces at nblug.org] On Behalf Of
Mark Street
Sent: Wednesday, November 03, 2004 11:07 AM
To: General NBLUG chatter about anything Linux, answers to questions,etc.
Subject: Re: [NBLUG/talk] Linux as router
On Wednesday 03 November 2004 09:58, Osiris Pedroso wrote:
> I am using Vonage as VoIP and been pretty happy with it, although the
> occasional ftp disrupts my calls.
>
> The Vonage documentation says that using the Motorola phone adapter in
> front of everything else enables it to use QoS features that prevent this
> kind of problem, but it is not what I am seeing.
>
> That is my main thrust to get a Linux router/firewall and then do some
> traffic shapping to make sure that does not happen anymore.
>
> Interesting article you sent, but Vonage seems to have worked around the
> problem described in it.
I have worked with and deployed asterisk, an open source VOIP server and
PBX,
asterisk.org
If you put the VOIP equipment phone behind a Linux Firewall you may have to
look into NAT and forwarding.... remember echo 1
> /proc/sys/net/ipv4/ip_forward ?
You have to tell the kernel to forward traffic from the inside to the
outside
using NAT most likely. Remember, most of this filtering takes place in the
Linux kernel being the monolithic design that it is.
Here is a rule from one of my firewalls that uses TOS shaping.
iptables -t mangle -A OUTPUT -p tcp -j TOS --dport 20:21 --set-tos 8
You can tweak it to your liking for any service, port, etc. Especially for
your VOIP equipment - Minimize-Delay would be important.
To see the different parameters you can set for TOS
iptables -m tos -h
TOS match v1.2.8 options:
[!] --tos value Match Type of Service field from one of the
following numeric or descriptive values:
Minimize-Delay 16 (0x10)
Maximize-Throughput 8 (0x08)
Maximize-Reliability 4 (0x04)
Minimize-Cost 2 (0x02)
Normal-Service 0 (0x00)
http://www.faqs.org/docs/linux_network/x-087-2-firewall.tos.manipulation.htm
l
TOS Bit Manipulation - The Type Of Service (TOS) bits are a set of four-bit
flags in the IP header. When any one of these bit flags is set, routers may
handle the datagram differently than datagrams with no TOS bits set. Each of
the four bits has a different purpose and only one of the TOS bits may be
set
at any time, so combinations are not allowed. The bit flags are called Type
of Service bits because they enable the application transmitting the data to
tell the network the type of network service it requires.
The classes of network service available are:
Minimum delay - Used when the time it takes for a datagram to travel from
the
source host to destination host (latency) is most important. A network
provider might, for example, use both optical fiber and satellite network
connections. Data carried across satellite connections has farther to travel
and their latency is generally therefore higher than for terrestrial-based
network connections between the same endpoints. A network provider might
choose to ensure that datagrams with this type of service set are not
carried
by satellite.
Maximum throughput - Used when the volume of data transmitted in any period
of
time is important. There are many types of network applications for which
latency is not particularly important but the network throughput is; for
example, bulk-file transfers. A network provider might choose to route
datagrams with this type of service set via high-latency, high-bandwidth
routes, such as satellite connections.
Maximum reliability - Used when it is important that you have some certainty
that the data will arrive at the destination without retransmission being
required. The IP protocol may be carried over any number of underlying
transmission mediums. While SLIP and PPP are adequate datalink protocols,
they are not as reliable as carrying IP over some other network, such as an
X.25 network. A network provider might make an alternate network available,
offering high reliability, to carry IP that would be used if this type of
service is selected.
Minimum cost - Used when it is important to minimize the cost of data
transmission. Leasing bandwidth on a satellite for a transpacific crossing
is
generally less costly than leasing space on a fiber-optical cable over the
same distance, so network providers may choose to provide both and charge
differently depending on which you use. In this scenario, your "minimum
cost"
type of service bit may cause your datagrams to be routed via the lower-cost
satellite route.
On Wednesday 03 November 2004 09:58, Osiris Pedroso wrote:
> I am using Vonage as VoIP and been pretty happy with it, although the
> occasional ftp disrupts my calls.
>
> The Vonage documentation says that using the Motorola phone adapter in
> front of everything else enables it to use QoS features that prevent this
> kind of problem, but it is not what I am seeing.
>
> That is my main thrust to get a Linux router/firewall and then do some
> traffic shapping to make sure that does not happen anymore.
>
> Interesting article you sent, but Vonage seems to have worked around the
> problem described in it.
> -----Original Message-----
> From: talk-bounces at nblug.org [mailto:talk-bounces at nblug.org] On Behalf Of
> Mark Street
> Sent: Tuesday, November 02, 2004 10:11 PM
> To: General NBLUG chatter about anything Linux, answers to questions,etc.
> Subject: Re: [NBLUG/talk] Linux as router
>
> I saw this one on my Asterisk mailing list. I thought it might help you
in
> the long run.
>
> http://www.voip-info.org/wiki-NAT+and+VOIP
>
> What type of VOIP phone/service are you using?
>
> On Monday 01 November 2004 13:57, Osiris Pedroso wrote:
> > This is more a trip for enlightenment than actually just to get a
>
> firewall.
>
> > I have a Netgear hardware firewall already in place, behind this machine
>
> at
>
> > the moment.
> >
> > The real big plan is to later on do some traffic shapping with my VoIP
> > phone on the inside of the net, making my phone calls immune to my ftp
> > transfers. Today it is outside due to my inability to forward packages
>
> from
>
> > one NIC to the other.
>
> _______________________________________________
> talk mailing list
> talk at nblug.org
> http://nblug.org/cgi-bin/mailman/listinfo/talk
>
>
> _______________________________________________
> talk mailing list
> talk at nblug.org
> http://nblug.org/cgi-bin/mailman/listinfo/talk
--
Mark Street, RHCE
http://www.oswizards.com
--
Key fingerprint = 3949 39E4 6317 7C3C 023E 2B1F 6FB3 06E7 D109 56C0
GPG key http://www.oswizards.com/pubkey.asc
_______________________________________________
talk mailing list
talk at nblug.org
http://nblug.org/cgi-bin/mailman/listinfo/talk
More information about the talk
mailing list