My little RB keeps me connected to a small VPN of random enthusiast types. We do this mostly just for the hell of it, but one feature is access to suitable file shares on our LANs.

I've held off on opening any of that up for the moment as I didn't want to risk having my upstream slagged. But here's how to do a really simple rate limit on data coming from a specific host on my network to destinations on the VPN:

/ip firewall mangle
add action=mark-packet chain=prerouting disabled=no dst-address= \
    new-packet-mark=files passthrough=no protocol=tcp src-address=

/queue simple
add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s direction=both \
    disabled=no interface=all limit-at=0/0 max-limit=1M/1M name=vpn-files \
    packet-marks=files parent=none priority=8 queue=default/default \

The host on my end is The VPN more broadly is 10/8. Those two rules are all it takes. 1Mbps is about a third of my upstream, which is enough to let people slowly snarf things without any real noticeable impact on my own use of my net connection.
I have an AppleTV. It's on My gateway is a RouterOS box. Among the routes out of my LAN that it knows is a VPN that terminates in the US.

I'd already been routing specific destination addresses down that VPN, so any attempt to hit Pandora would go that way and thus work. But this isn't really adequate for stuff like Hulu where it's a giant mess of Akamai-fu.


/ip firewall mangle
add action=mark-routing chain=prerouting disabled=no new-routing-mark=usa \
passthrough=yes src-address=

/ip route
add disabled=no distance=1 dst-address= gateway=nycvpn routing-mark=\
usa scope=30 target-scope=10

And now any packet originating on will appear to the outside world as though it came from a machine in New York City.

The RouterBox is dirt cheap. It's a quality bit of kit that can do most of the things you'd expect from a "real" Cisco router. This is just one of the things that makes it awesome.


Abort, Rephrase, Ignore?

October 2011

2 345678


RSS Atom

Most Popular Tags

Style Credit

Expand Cut Tags

No cut tags