# iptables and --pid-owner

## neuron

I'm using a lightly modified wshaper.htb, I'd like to set some traffic priority based on pid.  So I found -m owner.

now I'm using tc to control my traffic, like this:

 	tc filter add dev $DEV parent 1: protocol ip u32 \

	   match ip sport $a 0xffff flowid 1:30

is there any way of using tc to do it, or if not, any way someone could tell me which iptables commands I need to run to get iptables working prolerly?

I tried something like this:

iptables -A OUTPUT -t mangle -m owner --pid-owner 12411 -j MARK --set-mark 40

which doesen't produce any errors, but also doesen't work.

----------

## neuron

/me 's changed scripts, and is now using:

 $IPTABLES -t mangle -A MANGLE_MARK -p tcp --dport portnum -j MARK --set-mark 23

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --dport portnum -j RETURN

to mark packets, which works fine, BUT, still can't get -m owner working, tried using this:

$IPTABLES -t mangle -A OUTPUT -o $DEV -m owner --pid-owner 28593 -j MARK --set-mark 23

$IPTABLES -t mangle -A OUTPUT -o $DEV -m owner --pid-owner 28593 -j RETURN

$IPTABLES -t mangle -A OUTPUT -o $DEV -m owner --pid-owner 28591 -j MARK --set-mark 23

$IPTABLES -t mangle -A OUTPUT -o $DEV -m owner --pid-owner 28591 -j RETURN

which doesen't give any errors, but if I use tc -s class show dev ppp0 it shows no packets going through level 23, when I can see use netstat and clearly see stuff going through that pid :/

do I need to attach output to mangle_mark or something like that?

----------

## neuron

hah, got it working, incase anyone else needs it (search for "trying to drop two pids" and replace with pids / probably preferably a gid/userid  :Smile:  ).

(got the script I modded from 69link, https://forums.gentoo.org/viewtopic.php?t=65244&highlight=)

// edited script

```

#!/bin/bash

# The Ultimate Setup For Your Internet Connection At Home

#

# Set the following values to somewhat less than your actual download

# and uplink speed. In kilobits

DOWNLINK=5000

UPLINK=180

#UPLINK_FAST=190

#UPLINK_MED=190

#UPLINK_LOW=180

UPLINK_FAST=170

UPLINK_MED=160

UPLINK_LOW=160

DEV=ppp0

IPTABLES=/sbin/iptables

TC=/sbin/tc

# low priority OUTGOING traffic - you can leave this blank if you want

#Chain:

#All traffic dumped to UPLINKM with prio 2

#LEVEL0 dropped to UPLINK with prio 1

#LEVEL1 dropped to UPLINKL with prio 3

#LEVEL2 dropped to UPLINKL with prio 4

LEVEL0_SRC="110 25"

LEVEL0_DST="22 80 6667 13242 61061 110 25 53"

## all non marked traffic is dropped between here

#LEVEL1_SRC="7000 7001 7002 7003 7004 7005 7006 7007 7008 7009 7010 6881 6882 6883 6884 6885 6886 6887 6888 6889"

#LEVEL1_DST="6881 6882 6883 6884 6885 6886 6887 6888 6889"

#linux user id's:, cat /etc/passwd to get em.

LEVEL1_UID="1008"

#LEVEL2_SRC="4662 18000 18001 18007"

#LEVEL2_DST="4662"

#linux user id's:, cat /etc/passwd to get em.

LEVEL2_UID="1007"

# Kill tc settings

$TC qdisc del dev $DEV root 2> /dev/null

$IPTABLES -t mangle -F

$IPTABLES -t mangle -X

# Some iptables markings

$IPTABLES -t mangle -N MANGLE_MARK

# Set icmp as prioritized traffic

$IPTABLES -t mangle -A MANGLE_MARK -p icmp -j MARK --set-mark 20

$IPTABLES -t mangle -A MANGLE_MARK -p icmp -j RETURN

# Set udp as prioritized traffic

#$IPTABLES -t mangle -A MANGLE_MARK -p udp -j MARK --set-mark 20

#$IPTABLES -t mangle -A MANGLE_MARK -p udp -j RETURN

for a in $LEVEL0_SRC

do

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --sport $a -j MARK --set-mark 20 

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --sport $a -j RETURN

done

for a in $LEVEL0_DST

do

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --dport $a -j MARK --set-mark 20 

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --dport $a -j RETURN

done

for a in $LEVEL1_SRC

do

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --sport $a -j MARK --set-mark 22

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --sport $a -j RETURN

done

for a in $LEVEL1_DST

do

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --dport $a -j MARK --set-mark 22

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --dport $a -j RETURN

done

for a in $LEVEL1_UID

do

  $IPTABLES -t mangle -A POSTROUTING -o $DEV -m owner --uid-owner $a -j MARK --set-mark 22

  $IPTABLES -t mangle -A POSTROUTING -o $DEV -m owner --uid-owner $a -j RETURN

done

for a in $LEVEL2_SRC

do

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --sport $a -j MARK --set-mark 23

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --sport $a -j RETURN

done

for a in $LEVEL2_DST

do

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --dport $a -j MARK --set-mark 23

  $IPTABLES -t mangle -A MANGLE_MARK -p tcp --dport $a -j RETURN

done

for a in $LEVEL2_UID

do

  $IPTABLES -t mangle -A POSTROUTING -o $DEV -m owner --uid-owner $a -j MARK --set-mark 23

  $IPTABLES -t mangle -A POSTROUTING -o $DEV -m owner --uid-owner $a -j RETURN

done

# Set ACK as prioritized traffic

$IPTABLES -t mangle -A MANGLE_MARK -p tcp -m length --length 0:80 -j MARK --set-mark 20

$IPTABLES -t mangle -A MANGLE_MARK -p tcp -m length --length 0:80 -j RETURN

# Set everything as bulk traffic

$IPTABLES -t mangle -A MANGLE_MARK -j MARK --set-mark 21

$IPTABLES -t mangle -A MANGLE_MARK -j RETURN

# Jump to tables

#$IPTABLES -t mangle -I OUTPUT -o $DEV -j MANGLE_MARK

$IPTABLES -t mangle -I POSTROUTING -o $DEV -j MANGLE_MARK

$IPTABLES -t mangle -I PREROUTING -i $DEV -j MANGLE_MARK

# clean existing down- and uplink qdiscs, hide errors

$TC qdisc del dev $DEV root    2> /dev/null > /dev/null

$TC qdisc del dev $DEV ingress 2> /dev/null > /dev/null

###### uplink

# install root HTB, point default traffic to 1:20:

# neuron : other one doesen't have r2q 2

#$TC qdisc add dev $DEV root handle 1: htb default 21 r2q 2

$TC qdisc add dev $DEV root handle 1: htb default 21

# shape everything at $UPLINK speed - this prevents huge queues in your

# DSL modem which destroy latency:

$TC class add dev $DEV parent 1: classid 1:1 htb rate ${UPLINK}kbit burst 6k

#original:

#$TC class add dev $DEV parent 1: classid 1:1 htb rate ${UPLINK}kbit

$TC class add dev $DEV parent 1:1 classid 1:20 htb rate ${UPLINK}kbit burst 6k prio 1

#orig:

#$TC class add dev $DEV parent 1:1 classid 1:20 htb rate ${UPLINK_FAST}kbit ceil ${UPLINK}kbit prio 1

$TC class add dev $DEV parent 1:1 classid 1:21 htb rate 4kbit ceil ${UPLINK_MED}kbit prio 2

$TC class add dev $DEV parent 1:1 classid 1:22 htb rate 4kbit ceil ${UPLINK_LOW}kbit prio 3

$TC class add dev $DEV parent 1:1 classid 1:23 htb rate 4kbit ceil ${UPLINK_LOW}kbit prio 4

# both get Stochastic Fairness:

$TC qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10

$TC qdisc add dev $DEV parent 1:21 handle 21: sfq perturb 10

$TC qdisc add dev $DEV parent 1:22 handle 22: sfq perturb 10

$TC qdisc add dev $DEV parent 1:23 handle 23: sfq perturb 10

# Match marked packets with tc (20=fast, 22=bulk)

$TC filter add dev $DEV parent 1: protocol ip prio 1 handle 20 fw flowid 1:20

$TC filter add dev $DEV parent 1: protocol ip prio 2 handle 21 fw flowid 1:21

$TC filter add dev $DEV parent 1: protocol ip prio 3 handle 22 fw flowid 1:22

$TC filter add dev $DEV parent 1: protocol ip prio 4 handle 23 fw flowid 1:23

########## downlink #############

# slow downloads down to somewhat less than the real speed  to prevent

# queuing at our ISP. Tune to see how high you can set it.

# ISPs tend to have *huge* queues to make sure big downloads are fast

#

# attach ingress policer:

echo Skipping attach ingress

exit

$TC qdisc add dev $DEV handle ffff: ingress

# filter *everything* to it (0.0.0.0/0), drop everything that's

# coming in too fast:

$TC filter add dev $DEV parent ffff: protocol ip prio 50 u32 \

  match ip protocol 6 0xff \

  match ip src 0.0.0.0/0 \

  police rate ${DOWNLINK}kbit

```

note, remove the exit after the last echo there to include download stuff, but I don't do that.

----------

