I have a Linux box serving as a firewall/router for our home network. I live out in the boonies, so I have a relatively slow broadband connection:

Downstream Rate     7616 Kbps 
Upstream Rate   512 Kbps  

Which is more realistically about 5000 Kbps down, 300 Kbps Up according to speedtest.net.

My kids like to play Steam, Skype, and Minecraft as well as multiplayer games on their Playstation 3. We like to watch Hulu and Netflix.

When our kids are gaming, it often kills our video streaming and, indeed, internet responsiveness in general. During such "outages" I often see hundreds of connections created by their gaming activities and found a way to limit this per host, which does help tremendously. A very simple IPTABLES rule to limit to 25 connections per host:

iptables  -A INPUT -p tcp --syn  -m connlimit --connlimit-above 25 -j REJECT 

Has alleviated quite a number of "incidents" since, but we still have trouble with watching Hulu and Netflix whenever the kids are downloading some new game or uploading their latest home video to YouTube, so now I'm trying to figure out how to do some basic traffic shaping.

tc qdisc add dev eth0 root tbf rate 5000Kbit latency 50ms burst 1540

But it more or less killed Internet connectivity altogether. Did I calculate my numbers incorrectly or is this simply the wrong way to go about resolving my problem? Alternatively, are there other/better techniques for keeping our Internet responsive for Netflix/Hulu streaming? I'm still learning a good bit about QoS and traffic shaping, so please provide references if you know of some good resources documenting this topic.

I'm mostly working through this behemoth: http://lartc.org/lartc.html#LARTC.IPROUTE2 to try to figure things out.

  • You are talking about 'responsiveness', but netflix is bufferable stream and as such does not need responsive connection. Gaming OTOH usually should not be bandwidth hungry, but would need to be responsive, as latency+jitter will negatively affect or destroy the gaming experience. If netflix stream suffer I doubt it's gaming, I'm guessing kids are downloading something. I would create QoS policy which guarantees netflix box capacity, so that all other are dropped until netflix gets say 5Mbps. For responsiveness you might want to look blog.ip.fi/2012/03/silver-bullet-for-home-qos.html – ytti Sep 7 '13 at 19:29

Install Shorewall, and use its simple traffic shaping guide. It provides a simple interface to iptables and various route shaping and load balancing facilities.


Unfortunately, QoS will only help you for OUTBOUND flows, as I really do not think your ISP, NETLIX and your son's gaming network (PSN, XBoxLiv...) will use/honor QoS on flows TOWARD you.

You can help a bit by shaping LOWER than your real inbound speed, but this will only work for TCP traffic (once over the BW limit you set, you'll drop some packets and TCP will act on those to lower traffic flows). UDP will still clog everything as it's mostly "Fire & Forget"

Since the bottleneck for your inbound connection is the last leg - your DSL link- your ISP will still drop some random traffic destined for you (since they surely do not have queue priority & shaping configured for regular users)

  • This is an excellent observation, so the best way to actually enable dealing with this is to find an ADSL modem I can install Linux on and thus also install traffic shaping QoS services on to help control this aspect of incoming traffic. Am I correctly understanding? I think I was actually somewhat onto the correct path here earlier by adding rate limiting rules to my IPTABLES config that simply dropped and packets coming in for a specific target after a certain limit was reached. I wasn't sure if this was truly effective or not in this particular aspect. – Michael Lang Sep 10 '13 at 17:56
  • Even if you find a DSL endpoint where you can do QoS, incomming data has already saturated your link before even reaching the QoS point. Rate limiting will help you, as long as you have mostly TCP traffic it'OK as TCP will react to dropped packets by reducing the flows speed. If your traffic is mostly UDP or any other traffic without means to regulate flow, your link will still be maxed-out UDP and UDP-like traffic (video conferencing, Skype, regular VoIP, etc) is Fire & Forget. it doesn't really care if you skip a packet from time to time and so won't adapt its speed to the link. – Remi Letourneau Sep 11 '13 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.