Forum: Co w tym skrypcie nie tak?update, nadal nie działa

Kod Pobierz kod źródłowy


modprobe ipt_layer7

TCA="tc class add dev br0"

TFA="tc filter add dev br0"

TQA="tc qdisc add dev br0"

SFQ="sfq perturb 10"

CEIL=5000

CEILU=720

WWWMAX=1000000



# quakelive

PRIO0="27000:27100,5222"



# ftp, www  itp. download

PRIO1="20:110"



# PRIO2 - automatycznie wyldujuja tutaj kolosy z PRIO1

# nic nie musisz robic



# PRIO3 - w tej nedznej kolejce :) skoncza wszytkie pakiety z portow

# nie okreslonych w PRIO0 lub PRIO1.

# W praktyce jest to p2p.

# nic nie musisz robic



# porty wchodzace P2P , ftp i zdalny

P2P="11000-14000"

USL="21,3389"





tc qdisc del dev br0 root

tc qdisc add dev br0 root handle 1: htb default 12

tc class add dev br0 parent 1: classid 1:1 htb rate ${CEIL}kbit





$TCA parent 1:1 classid 1:10 htb rate 250kbit ceil 250kbit prio 0

$TCA parent 1:1 classid 1:11 htb rate 3000kbit ceil ${CEIL}kbit prio 1

$TCA parent 1:1 classid 1:12 htb rate 1000kbit ceil ${CEIL}kbit prio 2

$TCA parent 1:1 classid 1:13 htb rate 500kbit ceil ${CEIL}kbit prio 3

$TCA parent 1:1 classid 1:14 htb rate 250kbit ceil ${CEIL}kbit prio 4

$TQA parent 1:10 handle 10: $SFQ

$TQA parent 1:11 handle 11: $SFQ

$TQA parent 1:12 handle 12: $SFQ

$TQA parent 1:13 handle 13: $SFQ

$TQA parent 1:14 handle 14: $SFQ

$TFA parent 1:0 prio 0 protocol ip handle 10 fw flowid 1:10

$TFA parent 1:0 prio 1 protocol ip handle 11 fw flowid 1:11

$TFA parent 1:0 prio 2 protocol ip handle 12 fw flowid 1:12

$TFA parent 1:0 prio 3 protocol ip handle 13 fw flowid 1:13

$TFA parent 1:0 prio 4 protocol ip handle 14 fw flowid 1:14

iptables -t mangle -A POSTROUTING -j BCOUNT



# reguly dla programow P2P

iptables -t mangle -A POSTROUTING -p tcp -m mport --dports ${P2P} -j MARK --set-mark 13

iptables -t mangle -A POSTROUTING -p tcp -m mport --dports ${P2P} -j RETURN

iptables -t mangle -A POSTROUTING -p udp -m mport --dports ${P2P} -j MARK --set-mark 13

iptables -t mangle -A POSTROUTING -p udp -m mport --dports ${P2P} -j RETURN



#ftp i zdalny

iptables -t mangle -A POSTROUTING -p tcp -m mport --dports ${USL} -j MARK --set-mark 11

iptables -t mangle -A POSTROUTING -p tcp -m mport --dports ${USL} -j RETURN

iptables -t mangle -A POSTROUTING -p udp -m mport --dports ${USL} -j MARK --set-mark 11

iptables -t mangle -A POSTROUTING -p udp -m mport --dports ${USL} -j RETURN



# reguly dla PRIO0

iptables -t mangle -A POSTROUTING -p tcp -m mport --sports ${PRIO0} -j MARK --set-mark 10

iptables -t mangle -A POSTROUTING -p tcp -m mport --sports ${PRIO0} -j RETURN

iptables -t mangle -A POSTROUTING -p udp -m mport --sports ${PRIO0} -j MARK --set-mark 10

iptables -t mangle -A POSTROUTING -p udp -m mport --sports ${PRIO0} -j RETURN





# reguly dla PRIO1

iptables -t mangle -A POSTROUTING -p tcp -m mport --sports ${PRIO1} -m bcount --range 0x0-${WWWMAX} -j MARK --set-mark 11

iptables -t mangle -A POSTROUTING -p tcp -m mport --sports ${PRIO1} -m bcount --range 0x0-${WWWMAX} -j RETURN

iptables -t mangle -A POSTROUTING -p udp -m mport --sports ${PRIO1} -m bcount --range 0x0-${WWWMAX} -j MARK --set-mark 11

iptables -t mangle -A POSTROUTING -p udp -m mport --sports ${PRIO1} -m bcount --range 0x0-${WWWMAX} -j RETURN



# reguly dla PRIO2

iptables -t mangle -A POSTROUTING -p tcp -m mport --sports ${PRIO1} -m bcount --range $(($WWWMAX+1)) -j MARK --set-mark 12

iptables -t mangle -A POSTROUTING -p tcp -m mport --sports ${PRIO1} -m bcount --range $(($WWWMAX+1)) -j RETURN

iptables -t mangle -A POSTROUTING -p udp -m mport --sports ${PRIO1} -m bcount --range $(($WWWMAX+1)) -j MARK --set-mark 12

iptables -t mangle -A POSTROUTING -p udp -m mport --sports ${PRIO1} -m bcount --range $(($WWWMAX+1)) -j RETURN



# regula dla PRIO3

# tak, naprawde wszystko co nie zostalo wylapane powyzej konczy tutaj

iptables -t mangle -A POSTROUTING -j MARK --set-mark 13



# aby zwiekszyc wydajnosc L7 wrzucaj tutaj (koniec tabeli)

# liczba po --set-mark to klasa. Dostepne klasy sa tworzone

# powyzej przez makra $TCA. Odradzam uzycie 10 tutaj.

iptables -t mangle -A POSTROUTING -m layer7 --l7proto shoutcast -j MARK --set-mark 11

iptables -t mangle -A POSTROUTING -m layer7 --l7proto skypetoskype -j MARK --set-mark 11





TCAU="tc class add dev imq0"

TFAU="tc filter add dev imq0"

TQAU="tc qdisc add dev imq0"

modprobe imq

modprobe ipt_IMQ

ip link set imq0 up

tc qdisc del dev imq0 root

tc qdisc add dev imq0 root handle 1: htb default 12

tc class add dev imq0 parent 1: classid 1:1 htb rate 720kbit

$TCAU parent 1:1 classid 1:10 htb rate 16000kbit ceil 160kbit prio 0

$TCAU parent 1:1 classid 1:11 htb rate 310kbit ceil ${CEILU}kbit prio 1

$TCAU parent 1:1 classid 1:12 htb rate 100kbit ceil ${CEILU}kbit prio 2

$TCAU parent 1:1 classid 1:13 htb rate 100kbit ceil ${CEILU}kbit prio 3

$TCAU parent 1:1 classid 1:14 htb rate 50kbit ceil ${CEILU}kbit prio 4

$TQAU parent 1:10 handle 10: $SFQ

$TQAU parent 1:11 handle 11: $SFQ

$TQAU parent 1:12 handle 12: $SFQ

$TQAU parent 1:13 handle 13: $SFQ

$TQAU parent 1:14 handle 14: $SFQ

$TFAU parent 1:0 prio 0 protocol ip handle 10 fw flowid 1:10

$TFAU parent 1:0 prio 1 protocol ip handle 11 fw flowid 1:11

$TFAU parent 1:0 prio 2 protocol ip handle 12 fw flowid 1:12

$TFAU parent 1:0 prio 3 protocol ip handle 13 fw flowid 1:13

$TFAU parent 1:0 prio 4 protocol ip handle 14 fw flowid 1:14



# reguly dla wychodzącego

iptables -t mangle -A PREROUTING -p tcp -m mport --dports ${PRIO0} -j MARK --set-mark 10

iptables -t mangle -A PREROUTING -p tcp -m mport --dports ${PRIO0} -j RETURN

iptables -t mangle -A PREROUTING -p udp -m mport --dports ${PRIO0} -j MARK --set-mark 10

iptables -t mangle -A PREROUTING -p udp -m mport --dports ${PRIO0} -j RETURN



iptables -t mangle -A PREROUTING -p tcp -m mport --dports ${USL} -j MARK --set-mark 11

iptables -t mangle -A PREROUTING -p tcp -m mport --dports ${USL} -j RETURN

iptables -t mangle -A PREROUTING -p udp -m mport --dports ${USL} -j MARK --set-mark 11

iptables -t mangle -A PREROUTING -p udp -m mport --dports ${USL} -j RETURN



# cos co nie wiem co robi

iptables -t mangle -A PREROUTING -j IMQ --todev 0