Limiting "Unknown IP Addresses"

[mpeenie]

Is there a way for me to throttle ALL unknown IPs until they are associated with a client? I'd like to limit every unknown to 1.5x0.5 until I associate them with an account. Currently in my testing if I assign myself to an unknown IP I am unthrottled.

I am trying to lab up all possibilities with LibreQoS, and we are hoping to integrate with UISP in the near future, but for now I'd like the added security of the limiting in case someone slips through.

[trendal]

You might get a faster response on the matrix chat, I re-posted this discussion there. I'm unsure how to answer myself. I know if you have devices in ShapedDevices.csv that don't have a parent there is an ispConfig.py setting for those, but your saying if there is traffic that is totally unrecognized by LibreQoS.

I wonder if ShapedDevices.csv is parsed from the top down and the first matching row taken? If so you could add a row at the bottom for your entire subnet and set it to 1Mbps. I'm not sure how tc would setup the queues with that. Waiting for smarter people to show up here.

[mpeenie]

The other option I thought about was listing every IP out in the ShapedDevices.csv file, and limit unused IPs that way. But, outside of testing that is a bit of a pain for large subnets.

[trendal]

How are you with automating your own stuff? You could pull the list of IP's out of LibreQoS and use that to manage shaping rules in another router inline. I'm sure it would work but it seems like there would be a better way just using some default queue in LibreQoS.

[lakelinx]

The generatedPNDownloadMbps and generatedPNUploadMbps values in the ispConfig.py are what your after i think.

# Devices in ShapedDevices.csv without a defined ParentNode will be placed under a generated
# parent node, evenly spread out across CPU cores. Here, define the bandwidth limit for each
# of those generated parent nodes.
generatedPNDownloadMbps = 1000
generatedPNUploadMbps = 1000

[trendal]

No that only works if the IP is in the ShapedDevices.csv file but does NOT have a parent node assigned.

[mpeenie]

I've changed those values, and was not able to get capped on an "Unknown IP".

[lakelinx]

correct, you would have to list all the ips under shaped devices file and just not give them a parent node.
Thats the only way atm that im aware of, im sure you could easily create the file with some scripting help of excel, its a csv afterall.

[trendal]

@lakelinx if you go out to a tower and plug a laptop in to a core switch you'll have unlimited bandwidth because your IP is not in the ShapedDevices.csv file because it's not in UISP as a client.

UISP as an "Allow default client limits" that I have never used. I'm sure it's doing something similar.

[trendal]

I see you beat me to the punch there

[mpeenie]

So I've listed all my usable IPs from my lab subnet in the ShapedDevices.csv file, and am able to limit them that way.

It would be nice to limit entire subnets until a specific IP gets a different speed package. IE, Limit 10.0.0.0/22 to 2x2, and once someone DHCPs an IP define their new speeds while leaving the rest at the lower limited rate.

[thebracket]

You can specify subnets as IP addresses in ShapedDevices. So "192.168.1.0/24" will apply the limit to the entire 192.168.1.x range.

[mpeenie]

Very interesting. I figured since you have to specify the device ID it only would apply to a single address. I will give this a try. Thank you!

[lakelinx]

Doesnt it require the IPs to be unique and have no duplicates?
i.e. 192.168.0.0/24 and 192.168.0.1/32 would be conflicting.

If im understanding @mpeenie s request, he is looking for a catchall if they dont match elsewhere. Kind of like mikrotik simple queues, works from the top down, if the ip is found above, it takes precedence, otherwise they fall into the "group" at the bottom

[thebracket]

They need to be non-exact matches. So you can't have two 192.168.1.1 entries, but you can have a 192.168.1.0/24 subnet and a 192.168.1.2/32 - they aren't duplicates, and the LPM search is smart enough to pick the most exact match.

…

On Wed, Apr 19, 2023 at 4:01 PM Lake Linx ***@***.***> wrote: Doesnt it require the IPs to be unique and have no duplicates? i.e. 192.168.0.0/24 and 192.168.0.1/32 would be conflicting. If im understanding @mpeenie <https://github.com/mpeenie> s request, he is looking for a catchall if they dont match elsewhere. Kind of like mikrotik simple queues, works from the top down, if the ip is found above, it takes precedence, otherwise they fall into the "group" at the bottom — Reply to this email directly, view it on GitHub <#340 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADRU435XAWS77QOBOUKXQUTXCBHDVANCNFSM6AAAAAAXEQBQXA> . You are receiving this because you commented.Message ID: ***@***.***>

[lakelinx]

Thats awesome! Learned something new!

[mpeenie]

Yeah, this worked for me. Thank you!

[trendal]

sweet, so my guess was correct, that setting a basic plan for the entire subnet would cover the unknown's and then the /32's would apply the correct plan.