SHOREWALL-TCDEVICES(5)

🌸 NAME 🌸

okay so bestie, this is the Shorewall Traffic Shaping Devices file — yes, the man page is SHOREWALL-TCDEVICES(5) and it lives in the Configuration Files section of your manual 💅. The actual command/page name is tcdevices and she is the file that decides how fast your interfaces are allowed to go.

---

🦋 SYNOPSIS 🦋

/etc/shorewall[6]/tcdevices

---

✨ DESCRIPTION ✨

The entries in this file define the bandwidth for interfaces where you want traffic shaping turned on. That's it, that's the job 🎀.

If you do not plan to use traffic shaping for a device, do NOT put it in here — because being in this file literally limits that device's throughput to whatever limits you wrote down. No take-backs, it's giving handcuffs 🔒.

💭 a lil note on bandwidth definitions (read this, fr fr)

• do not put a space between the integer value and the unit: 30kbit is valid while 30 kbit is not. the space ruins everything, it's giving sabotage 😭
• you can use one of these units:
  • kbps — Kilobytes per second.
  • mbps — Megabytes per second.
  • kbit — Kilobits per second.
  • mbit — Megabits per second.
  • bps or number — Bytes per second.
• Only whole integers are allowed. no decimals bestie, we don't do fractions here 🧚

🌈 the columns

okay so the columns in the file are as follows (and where the column name is followed by a different name in parentheses, that different name is the one used in the alternate specification syntax 👑).

INTERFACE — [number:]interface

Name of interface. Each interface may be listed only once in this file. You may NOT specify the name of an alias here (like eth0:0, no ma'am) — see https://shorewall.org/FAQ.htm#faq18[1].

You may NOT specify wildcards here either! So if you've got a bunch of ppp interfaces, you gotta put them all in here, every single one, no shortcuts 💀.

If the device doesn't exist, a warning message will be issued during "shorewall [re]start" and "shorewall reload", and traffic shaping configuration will be skipped for that device. she just moves on 💅.

Shorewall assigns a sequential interface number to each interface (first entry in the file is interface 1, second is interface 2, and so on and so on). You can explicitly specify the interface number by prefixing the interface name with the number and a colon (":"). Example: 1:eth0.

IN-BANDWIDTH (in_bandwidth) — {-|bandwidth[:burst]|~bandwidth[:interval:decay_interval]}

The incoming bandwidth of that interface. Now listen — you are not able to do traffic shaping on incoming traffic, because the traffic is already received before you could do anything about it 😭. But this does let you define the maximum traffic allowed for this interface in total, and if the rate is exceeded, the packets get dropped. You mainly want this if you've got a DSL or Cable connection, to avoid queuing at your provider's side.

If you don't want any traffic to be dropped, set this to a value of zero — in which case Shorewall will not create an ingress qdisc. Must be set to zero if the REDIRECTED INTERFACES column is non-empty.

The optional burst option was added in Shorewall 4.4.18. The default burst is 10kb. A larger burst can help make the bandwidth more accurate; often for fast lines, the enforced rate is well below the specified bandwidth. lowkey important 🫶.

What's described above creates a rate/burst policing filter. Beginning with Shorewall 4.4.25, a rate-estimated policing filter may be configured instead. Rate-estimated filters should be used with Ethernet adapters that have Generic Receive Offload enabled by default. See Shorewall FAQ 97a[2].

To create a rate-estimated filter, precede the bandwidth with a tilde ("~"). The optional interval and decay_interval determine how often the rate is estimated and how many samples are retained for estimating. Please see http://ace-host.stuart.id.au/russell/files/tc/doc/estimators.txt for details. If not specified, the default interval is 250ms and the default decay_interval is 4sec ⏱️.

OUT-BANDWIDTH (out_bandwidth) — bandwidth

The outgoing bandwidth of that interface. This is the maximum speed your connection can handle. It's also the speed you can refer to as "full" if you define the tc classes in shorewall-tcclasses[3](5). Outgoing traffic above this rate will be dropped 🫣.

OPTIONS — {-|{classify|htb|hfsc|linklayer={ethernet|atm|adsl}|tsize=tsize|mtu=mtu|mpu=mpu|overhead=overhead},...}

• classify — When specified, Shorewall will not generate tc or Netfilter rules to classify traffic based on packet marks. You must do all classification using CLASSIFY rules in shorewall-mangle[4](5). all you, bestie ✨.
• connmark — Added in Shorewall 5.2.7. May only be specified if the REDIRECTED_INTERFACES column is non-empty. It allows packet marks to be used to classify traffic for these interfaces.
• htb — Use the Hierarchical Token Bucket queuing discipline. This is the default. she's the main character 👑.
• hfsc — Shorewall normally uses the Hierarchical Token Bucket queuing discipline. When hfsc is specified, the Hierarchical Fair Service Curves discipline is used instead (see tc-hfsc (7)).
• linklayer — Added in Shorewall 4.5.6. Type of link (ethernet, atm, adsl). When specified, causes scheduler packet size manipulation as described in tc-stab (8). When this option is given, the following options may also be given after it:
  • mtu=mtu — The device MTU; default 2048 (will be rounded up to a power of two)
  • mpu=mpubytes — Minimum packet size used in calculations. Smaller packets will be rounded up to this size
  • tsize=tablesize — Size table entries; default is 512
  • overhead=overheadbytes — Number of overhead bytes per packet.

REDIRECTED INTERFACES (redirect) — [interface[,interface]...]

May only be specified if the interface in the INTERFACE column is an Intermediate Frame Block (IFB) device. Causes packets that enter each listed interface to be passed through the egress filters defined for this device, thus providing a form of incoming traffic shaping 💫. When this column is non-empty, the classify option is assumed unless the connmark option is specified.

---

🔥 EXAMPLES 🔥

Example 1:

Suppose you're using PPP over Ethernet (DSL) and ppp0 is the interface for this. The device has an outgoing bandwidth of 500kbit and an incoming bandwidth of 6000kbit:

            #INTERFACE   IN-BANDWIDTH    OUT-BANDWIDTH         OPTIONS         REDIRECTED
            #                                                                  INTERFACES
            1:ppp0         6000kbit        500kbit

---

🎀 FILES 🎀

• /etc/shorewall/tcdevices
• /etc/shorewall6/tcdevices

---

💜 SEE ALSO 💜

• tc-hfsc (7)
• https://shorewall.org/traffic_shaping.htm[5]
• https://shorewall.org/configuration_file_basics.htm#Pairs[6]
• http://ace-host.stuart.id.au/russell/files/tc/doc/estimators.txt
• shorewall(8)

---

🌟 NOTES 🌟

1. https://shorewall.org/FAQ.htm#faq18 https://shorewall.org/FAQ.htm#faq18
2. Shorewall FAQ 97a https://shorewall.org/FAQ.htm#faq97a
3. shorewall-tcclasses https://shorewall.org/manpages/shorewall-tcclasses.html
4. shorewall-mangle https://shorewall.org/manpages/shorewall-mangle.html
5. https://shorewall.org/traffic_shaping.htm https://shorewall.org/traffic_shaping.htm
6. https://shorewall.org/configuration_file_basics.htm#Pairs https://shorewall.org/configuration_file_basics.htm#Pairs

---

and that's the whole page bestie, you ate that 💅✨

Configuration Files — 09/24/2020 — SHOREWALL-TCDEVICES(5) 🦋 go shape some traffic, icon 🫶💖