最高法首次发布中国知识产权司法保护纲要

百度 前不久，我们在广泛征集群众意见的基础上，决定今年继续办好城镇棚户区改造、助残扶贫康复、基层医疗服务能力提升、农村边远地区中小学温暖工程等10件实事。

The QoS addons for IPCop are advanced traffic shaping addons to the popular IPCop firewall. Maintained as GPL/Creative Commons Open Source projects by Markus Hoffmann.

There are currently two QoS packages being maintained, using two different packet scheduling protocols; HTB and HTSC.

A Brief Introduction to Traffic Shaping

Quality of Service (QoS) is a term used to all the different modules that make up traffic shaping. QoS is an attempt to bring all these different programs and protocols together to give priority to network traffic that is time dependent, like VoIP and online games, over less time critical data transfers such as P2P or FTP traffic. If it does it well, then you can have a conversation using VoIP while downloading/uploading large files without delay or gaps in the voice call.

Flavours

There are two versions of the Advanced QoS Addon:

• Hierarchical Fair Service Curve scheduler (HFSC) – (QoS 2.5 Ipcop 1.4.8)
• Hierarchical Token Bucket scheduler (HTB) – (QoS_NG)

Table of Contents

• HFSC Manual – (QoS 2.5 Ipcop 1.4.8)

1. Prerequisites
2. Installation
3. Setting up the Classes (For Outgoing Traffic)
4. Setting ACK
5. Defining the Traffic
6. IMQ – Setting up Classes and Rules for Incoming Traffic
7. Uninstalling QoS Addon
8. Glossary

• HTB Manual – (QoS_NG)

Notes

• There are two approaches to limiting unwanted/low priority traffic:
  • Creating a rule pinpointing the traffic type with the layer 7 tools or using the specific port and then specifying the maximum bandwidth this traffic will be allowed to have.
  • Creating rules for allowable traffic and giving them maximum bandwidth (or known quantities) and then limiting the default rule's bandwidth limiting all unknown traffic.
• The maximum root bandwidth is typically set at 90% of the actual bandwidth to reduce the effect of buffered data in the local modem or on the isp's end. The problem stems from the idea that requested data can be queued (in large quantities) to avoid gaps in data flow. While this works for large continuous transfers, mixed data transfers suffer because of having to wait "in queue" to be sent causing the net effect of sluggish response.
• Port ranges can be entered as <port>[space]-[space]<port>. IE: 1000 - 2000
• IP ranges can be entered as CIDR notation addresses. IE: 192.168.1.0/24

Questions-N-Answers

• Q: Where can I download the Advanced QoS for IPCOP?
  • A: here
• Q: What does the QOS "Maximum delay in milliseconds" really mean?
  • A:
• Q: What does the QOS_NG "Maxbust" and "Ceilmaxburst" really mean?
  • A: Burst : Amount of bytes that can be burst at ceil speed, in excess of the configured maximum upload speed. Should be at least as high as the highest burst of all children

Ceilburst: Amount of bytes that can be burst at 'infinite' speed, in other words, as fast as the interface can transmit them. For perfect evening out, should be equal to at most one average packet. Should be at least as high as the highest cburst of all children. Both values could be empty because they will be computed automatically.

• Q: Which is better QOS(HFSC) or QOS_NG(HTB)?
  • A:
    • QOS which is based on HFSC is supposed to be better for VOIP. The Hierchial tree method was designed to share bandwidth between branches or classes and rules (envision a tree, the trunk being the full bandwidth, each branch being class/rule taking bandwidth from the trunk).
    • QOS_NG which is based on HTB is supposed to be better at layer 7 (P2P for example) bandwidth control. The idea behind HTB is that the data flows like water in a hose into "buckets". Each bucket only holds so much data. The buckets are queued by priority to receive the available bandwidth.

Examples

QOS Symmetrical 128Kbps with OpenVPN priority

Assumptions

• RED outgoing is eth0, incoming is imq0
• GREEN is eth1
• Clients and servers are on GREEN
• VPN connections are accessing servers on GREEN intranet
• Clients will produce typical web, ftp, etc... traffic
• VPN is the only service available to the internet on RED

Actions

• Create RED root classes 199(eth0) and 299(imq0) with the maximum bandwidth set to 115 Kbps
• Create class 100, priority 1, minimum bandwidth 50 Kbps, delay 25ms, maximum bandwidth 115 Kbps
• Create class 101, priority 2, minimum bandwidth 50 Kbps, delay 50ms, maximum bandwidth 115 Kbps
• Create class 199, priority 7, minimum bandwidth 1 Kbps, delay 500ms, maximum bandwidth 100 Kbps
• Assign ACK priority to class 100
• Create class 200, priority 1, minimum bandwidth 50 Kbps, delay 25ms, maximum bandwidth 115 Kbps
• Create class 201, priority 2, minimum bandwidth 50 Kbps, delay 50ms, maximum bandwidth 115 Kbps
• Create class 299, priority 7, minimum bandwidth 1 Kbps, delay 500ms, maximum bandwidth 100 Kbps

At this point all traffic will traverse on the default classes 199 and 299 at a slightly reduced rate.

To ensure that vpn (OpenVPN specifically) traffic gets priority, the following rules should be added:

• Create a rule "OpenVPNOut", interface eth0, protocol UDP, mark 101, source port 1194
• Create a rule "OpenVPNIn", interface imq0, protocol UDP, mark 201, source port 1194

This scheme will make OpenVPN traffic higher priority than the default traffic, however since ACK's have a higher priority than everything else, normal traffic will still flow.

Viewing the graphs should provide insight into the flow:

• 1:100 will show ACK traffic from GREEN clients to internet connections
• 1:101 will show VPN outgoing traffic (port 1194)
• 1:199 will show bulk outgoing traffic
• 2:200 will show very little in this configuration as the rule is not used
• 2:201 will show VPN incoming traffic (port 1194)
• 2:299 will show bulk incoming traffic

Additional categorization of the bulk traffic could be done by adding more rules.