Per-IP Fair Shaping with hash Filter and HTB on NAT Gateway

This setup uses tc's hash filter to dynamically create a class per source or destination IP, combined with HTB to enforce per-IP bandwidth caps. Internally, the hash filter computes a hash of the selected key (src or dst), looks up a classid in a hash table, and if absent, creates one using the link parameter. Each auto-created class inherits the default rate/ceil from the HTB parent, so every IP gets an equal share. The filter supports divisor, hashkey, and link options; link points to the HTB class that new classes are attached under.

This is a staple on ISP NAT gateways, dormitory networks, and multi-tenant edge routers where hundreds or thousands of clients share an uplink and you need per-subscriber fairness without enumerating every IP. It scales better than writing thousands of explicit filters and adapts automatically as DHCP leases change. It is also useful in Kubernetes egress gateways to cap per-pod bandwidth without cgroup integration.

Security note: hashing can be attacked by spoofed source IPs to create many classes and exhaust memory; combine with anti-spoofing (uRPF, iptables) and cap the number of classes via the HTB parent's limit. Performance is good but the hash table grows with active IPs. Pitfalls include hash collisions (mitigated by divisor tuning), forgetting to set a reasonable default class, and not accounting for the fact that classes persist until the qdisc is deleted. Inspect with tc -s class show dev [iface] and tc filter show dev [iface].

> System.Execute()

tc qdisc del dev eth0 root 2>/dev/null
tc qdisc add dev eth0 root handle 1: htb default 9999 r2q 10
tc class add dev eth0 parent 1: classid 1:1 htb rate 1000mbit ceil 1000mbit
tc class add dev eth0 parent 1:1 classid 1:9999 htb rate 1mbit ceil 10mbit
tc filter add dev eth0 parent 1: protocol ip prio 1 handle 1: flow hash keys dst divisor 1024
# Then HTB auto-creates classes under 1:1? Use explicit class for hash:
# Correct pattern: link hash to a class that acts as parent
tc class add dev eth0 parent 1:1 classid 1:100 htb rate 1000mbit ceil 1000mbit
tc filter del dev eth0 parent 1: protocol ip prio 1
tc filter add dev eth0 parent 1: protocol ip prio 1 handle 1: flow hash keys dst divisor 1024 link 1:100
tc -s class show dev eth0

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-1B15528F5CA5