IPT=/usr/sbin/iptables IP=/usr/sbin/ip TC=/usr/sbin/tc # Specify ethernet device, Queue length, and MTU size # ((qlen * mtu) / rate) / 1024 = time DEV=vlan1 OUT_QLEN=30 #MTU=1500 # Set to ~80% of tested maximum bandwidth UPLINK=400 # specify class rates - We grant each class at LEAST its "fair share" of # bandwidth. this way no class will ever be starved by another class. UPLINK_1_R=128 # VOIP only UPLINK_2_R=64 # Interactive (low port) traffic and ICMP/ACK UPLINK_3_R=16 # Everything else (ssh) UPLINK_4_R=16 # P2P # Each class is also permitted to consume all of the available bandwidth # if no other classes are in use. UPLINK_1_C=${UPLINK} UPLINK_2_C=${UPLINK} UPLINK_3_C=${UPLINK} UPLINK_4_C=${UPLINK} # remove old qdiscs $TC qdisc del dev $DEV root 2> /dev/null > /dev/null $TC qdisc del dev $DEV ingress 2> /dev/null > /dev/null # reset iptables rules $IPT -t mangle -D POSTROUTING -o $DEV -j MYSHAPER-OUT $IPT -t mangle -F MYSHAPER-OUT $IPT -t mangle -X MYSHAPER-OUT # set outgoing queue length $IP link set dev $DEV qlen ${OUT_QLEN} # lower the MTU to decrease latency #$IP link set dev $DEV mtu $MTU # Create HTB root qdisc with an htb default of 30 $TC qdisc add dev $DEV root handle 1: htb default 40 # create main rate limit class $TC class add dev $DEV parent 1: classid 1:1 htb rate ${UPLINK}kbit # create leaf rate limit classes $TC class add dev $DEV parent 1:1 classid 1:10 htb rate ${UPLINK_1_R}kbit ceil ${UPLINK_1_C}kbit prio 0 $TC class add dev $DEV parent 1:1 classid 1:20 htb rate ${UPLINK_2_R}kbit ceil ${UPLINK_2_C}kbit prio 1 $TC class add dev $DEV parent 1:1 classid 1:30 htb rate ${UPLINK_3_R}kbit ceil ${UPLINK_3_C}kbit prio 2 $TC class add dev $DEV parent 1:1 classid 1:40 htb rate ${UPLINK_4_R}kbit ceil ${UPLINK_4_C}kbit prio 3 # attach qdisc to leaf classes - here we at SFQ to each priority class. SFQ # insures that within each class connections will be treated (almost) fairly. $TC qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10 $TC qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10 $TC qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10 $TC qdisc add dev $DEV parent 1:40 handle 40: sfq perturb 10 # add MYSHAPER-OUT chain to the mangle table in $IPT - this sets up the table # we use to filter and mark packets. $IPT -t mangle -N MYSHAPER-OUT $IPT -t mangle -I POSTROUTING -o $DEV -j MYSHAPER-OUT # add fwmark entries to classify different types of traffic - Set fwmark from # 10-40 according to desired class. 10 is highest prio. # outgoing VOIP rules - trumps everything else $IPT -t mangle -A MYSHAPER-OUT -p udp --sport 5060:5063 -j CLASSIFY --set-class 1:10 $IPT -t mangle -A MYSHAPER-OUT -p udp --dport 5060:5063 -j CLASSIFY --set-class 1:10 $IPT -t mangle -A MYSHAPER-OUT -p udp --sport 4569:4569 -j CLASSIFY --set-class 1:10 $IPT -t mangle -A MYSHAPER-OUT -p udp --dport 4569:4569 -j CLASSIFY --set-class 1:10 $IPT -t mangle -A MYSHAPER-OUT -p udp --sport 5036:5036 -j CLASSIFY --set-class 1:10 $IPT -t mangle -A MYSHAPER-OUT -p udp --dport 5036:5036 -j CLASSIFY --set-class 1:10 $IPT -t mangle -A MYSHAPER-OUT -p udp --sport 10000:20000 -j CLASSIFY --set-class 1:10 $IPT -t mangle -A MYSHAPER-OUT -p udp --dport 10000:20000 -j CLASSIFY --set-class 1:10 # default for outgoing interactive ports rules $IPT -t mangle -A MYSHAPER-OUT -p tcp --sport 0:1024 -j CLASSIFY --set-class 1:20 $IPT -t mangle -A MYSHAPER-OUT -p tcp --dport 0:1024 -j CLASSIFY --set-class 1:20 # the ack rule -- for ack packets smaller than 64 bytes --it must be added using # tc filter instead of iptables for now because the length module appears to be # broken and/or missing from the wrt54g iptables $TC filter add dev $DEV parent 1:0 prio 1 protocol ip u32 match ip protocol 6 0xff match u16 0x0000 0xffc0 at 2 match u8 0x10 0xff at 33 flowid 1:20 # outgoing DNS rule $IPT -t mangle -A MYSHAPER-OUT -p udp --dport domain -j CLASSIFY --set-class 1:20 # cheap outgoing ping rule $IPT -t mangle -A MYSHAPER-OUT -p icmp -j CLASSIFY --set-class 1:20 # outgoing ssh connection rule $IPT -t mangle -A MYSHAPER-OUT -p tcp --sport ssh -j CLASSIFY --set-class 1:20 $IPT -t mangle -A MYSHAPER-OUT -p tcp --dport ssh -j CLASSIFY --set-class 1:20 # outgoing P2P rules -- these are close to last b/c they use relatively costly layer 7 matching $IPT -t mangle -A MYSHAPER-OUT -m layer7 --l7dir /etc/l7-protocols/protocols --l7proto directconnect -j CLASSIFY --set-class 1:40 $IPT -t mangle -A MYSHAPER-OUT -m layer7 --l7dir /etc/l7-protocols/protocols --l7proto fasttrack -j CLASSIFY --set-class 1:40 # outgoing default rule - unmarked packets get schleped into lowest prio $IPT -t mangle -A MYSHAPER-OUT -m mark --mark 0 -j CLASSIFY --set-class 1:30 # All done, exit ok exit 0 '