ClearFoundation

Wow... that post ended up being a long one. I guess I just did write some technical documentation I'll have to move it over to the documentation pages!

Wow... that post ended up being a long one. I guess I just did write some technical documentation I'll have to move it over to the documentation pages!

Thanks for the helpful reply! Maybe I wouldn't even have a problem then, because I really don't care about limiting bandwidth to individual IPs. I manage a campus network, so i just want to be able to stop people from hogging all the bandwidth with bittorrent, downloads, etc.

We have a 6mbps Down/ 1mbps Up cable connection - so what would be an example of a rule/rules that I could set up to ensure everyone can browse the web, send/receive email, etc even when some student decides they want to try to download a 700mb file?

I would like to do QoS on certain IP's, mainly ones that do NOT need to go through the proxy/content filter.

I have transparent on, but I really only need 2 IP's filtered (preferably by MAC rather than IP). I've figured out that if transparent was off all I need to do is come up with an iptables rule that does this:
redirect port 80 to 8080 and block port 3128, only for the MACs in question.

I'm not sure how to go about this yet. For one, I know mostly nothing about iptables, but I think I can figure that part out. What I'm not sure on is where to place this rule? I'm thinking it should go in /etc/rc.d/rc.firewall.local

Am I close?? I mess with this a bit and see what I can screw up.

Blake McGinnis wrote:
We have a 6mbps Down/ 1mbps Up cable connection - so what would be an example of a rule/rules that I could set up to ensure everyone can browse the web, send/receive email, etc even when some student decides they want to try to download a 700mb file?

Without bandwidth rules, everyone will get a fair slice. If 10 users happen to be downloading at the same time, then each will receive about 10 percent of the bandwidth. Somehow, you have to tell the bandwidth system that traffic X is more important than traffic Y. Differentiating between a student downloading a PlayStation add-on and a faculty member downloading a large data set for statistics class is something only humans can do

If you have any priority traffic that needs to get through, you should define those bandwidth rules. If just want to make sure a percentage of your bandwidth is set aside for non-web traffic, you could limit the proxy server to something like 4Mbps. There's now an example in the User Guide! That's not the best way to configure things though... you will end up was 2Mbps of bandwidth even when the network is idle.

I am having the same problem. I would like to upgrade my server from Clarkconnect 4.3 which has been working perfectly for 2 years now handleling 1550 wireless users under traffic control ( Proxy and Bandwitdth manager ) to ClearOS, but as far as I noticed, the problems with proxy and bandwith manager remains since Clarkconnect 5.0. I think this issue should have some attention due the real need of those services, because now a days traffic Management has become a must in any computer network, so it should be reviewed what is wrong with those service working together.

Thanks in advance!

@evandro

First -- I am listening and I hear your feature request loud and clear. As with any feature request, you need to find software development resources to fulfil it.

Please review my previous post -- the answer is there. ClearOS Enterprise is just not designed for 1550 wireless users but designed for small environments (up to 50 user). In other words, the bandwidth manager was designed to meet the needs of that particular market. The biggest issue for this market is making sure high priority traffic (notably VoIP) gets through undisturbed.

I think this issue should have some attention

Just as there's a market for a more home-friendly version of ClearOS, there's also a market for networks with 1550 users in a single location (yikes). Right now,software development resources at ClearCenter are laser focused on small and distributed environments. ClearFoundation welcomes any new initiatives and software development resources -- that's one of the reasons we're moving the source code over to a not-for-profit foundation. Open and free!

For the target market, the feature that you seek is a "nice to have", so it won't get all that much attention right now. It will get some attention of course, but just not as much as you might be expecting.

I would like to upgrade my server from Clarkconnect 4.3 which has been working perfectly for 2 years now handleling 1550 wireless users under traffic control

Know that your download limits are only applicable to large file downloads. In other words, you will see expected results when you run a test through the proxy using a large file. Using lots of small files which is typical when loading a web page, you aren't clamping the speed at all. It's just an illusion (and yes, I realize this illusion is good enough in some circumstances). You can't really clamp download speeds properly due to the nature of the proxy cache. This is especially true with web proxy virus scanning enabled (a feature added in 5.0) since files up to 20 MB are first download, scanned, and then forwarded to the web browser.

I hope that clears things up a bit. Again, I'm here to listen to the community (with a bias to our target market... you know... the customers who pay the bills) so feel free to openly discuss the topic.

Hi,
When I mentioned 1550 users, I meant connected users to the network and NOT authenticated users. I know that Clarkconnect or ClearOS is designed for at most 50 users authenticated.

I have a network at the campus with a large WLAN where there are those 1550 notebooks with theirs MAC address registered in the server. I have some ACLs in the Squid which control some misuse of the Network, and I have some Iptables rules that prohibits unregistered Notebooks connect to the Network. With Clarkconnect 4.3 in the Bandwidth Manager I created rules for each IP Address ie: 192.168.1.3 all ports 64kbits Upload and 256Kbits Download another one: 192.168.1.4 all ports 64kbits Upload and 256Kbits Download, and so on. Why I have done this way? Because if I create just one single rule for the entire Network like 192.168.1.0/24 all ports 64Kbit Upload and 256Kbit Download, the 6Mb that I have for this Network will have only 256Kbit for all those IPs, I have this for experience, that's why I created one Rule for each IP, since I never have more than 200 Notebooks connected simultaneously and I have the DHCP server lease setup for 1 Hour. It has been working very fine for over 3 years, so I never had problem anymore with people getting heavy download and others trying to access the University Server for education purpose, everyone who connects to the WLAN gets 64Kbit UP and 256Kbit DOWN, that's it. Again, there are 1550 Notebooks registered but not more than 200 at the same time.

Getting back to the issue Bandwidth manager. After the Clarkconnect 5.0 this kind described operation didn't work anymore, it happens like mentioned in this Forum, if I turn the transparent Proxy and the Bandwidth together like I always do, the the traffic flows uncontrolled, passing the stipulated Kbt/s. this is one of the reason I still keep my Clarkconnect 4.3 alive. I also have this experience in other networks I have worked on, like I company here in Town which provides a large WLAN for residential users. It showed the same problem when I tried the Upgrade for 5.0.

When I found out that Clear Foundation took control of the the OS, I real quick downloaded the Version and Installed, but I have this surprise. I hope this feedback was important for the improvement of the ClearOS, since Bandwidth Control and Proxy service have became a must in any Network with where users need to be controlled.

Thanks! I hope this work!