rendered paste bodyiptables=iptables
function start {
tc qdisc add dev eth0 root handle 2:0 htb r2q 100 default 210
tc class add dev eth0 parent 2:0 classid 2:1 htb rate 128kbit ceil 128kbit prio 0 quantum 1500 burst 3k
#acks+tos , maxiumum prio
tc class add dev eth0 parent 2:1 classid 2:110 htb rate 89.6kbit ceil 128kbit prio 0 quantum 3000 burst 1k
tc qdisc add dev eth0 parent 2:110 handle 110:0 esfq perturb 5 depth 1024 hash src
tc filter add dev eth0 parent 2:0 protocol ip prio 0 handle 0x1869f fw classid 2:110
#games-class
tc class add dev eth0 parent 2:1 classid 2:120 htb rate 102.4kbit ceil 128kbit prio 1 quantum 3000 burst 1k
tc qdisc add dev eth0 parent 2:120 handle 120:0 esfq perturb 5 depth 1024 hash src
tc filter add dev eth0 parent 2:0 protocol ip prio 2 handle 0x1869d fw classid 2:120
#norm-class
tc class add dev eth0 parent 2:1 classid 2:130 htb rate 12.8kbit ceil 96kbit prio 2 quantum 1500 burst 0k
tc qdisc add dev eth0 parent 2:130 handle 210:0 esfq perturb 10 depth 1024 hash src
tc filter add dev eth0 parent 2:0 protocol ip prio 3 handle 0x1869c fw classid 2:130
#bulk-class
tc class add dev eth0 parent 2:1 classid 2:140 htb rate 2kbit ceil 89.6kbit prio 3 quantum 1500
tc qdisc add dev eth0 parent 2:140 handle 220:0 esfq perturb 10 depth 1024 hash src
tc filter add dev eth0 parent 2:0 protocol ip prio 4 handle 0x1869b fw classid 2:140
#same for eth1, execpt that we need a extra-(top)level for local generated stuff (i.e. squid/www @ full speed)
tc qdisc add dev eth1 root handle 2:0 htb r2q 100 default 210
tc class add dev eth1 parent 2:0 classid 2:1 htb rate 100240kbit ceil 100240kbit quantum 3000 burst 30k cburst 50k
tc class add dev eth1 parent 2:1 classid 2:2 htb rate 50120kbit ceil 100240kbit prio 7 quantum 3000 burst 10k cburst 10k
tc qdisc add dev eth1 parent 2:2 handle 10:0 pfifo
tc filter add dev eth1 parent 2:0 protocol ip prio 3 handle 0x1869a fw classid 2:2
tc class add dev eth1 parent 2:1 classid 2:3 htb rate 1000kbit ceil 1000kbit quantum 3000 burst 3k cburst 1k
#acks , maxiumum prio
tc class add dev eth1 parent 2:3 classid 2:110 htb rate 300kbit ceil 500kbit prio 0 quantum 3000 burst 1k
tc qdisc add dev eth1 parent 2:110 handle 110:0 esfq perturb 5 depth 1024 hash dst
tc filter add dev eth1 parent 2:0 protocol ip prio 0 handle 0x1869f fw classid 2:110
# games-class
tc class add dev eth1 parent 2:3 classid 2:120 htb rate 600kbit ceil 1000kbit prio 2 quantum 3000 burst 1k
tc qdisc add dev eth1 parent 2:120 handle 120:0 esfq perturb 5 depth 1024 hash dst
tc filter add dev eth1 parent 2:0 protocol ip prio 2 handle 0x1869d fw classid 2:120
#normal traffic
tc class add dev eth1 parent 2:3 classid 2:130 htb rate 200kbit ceil 750kbit prio 3 quantum 1500 burst 0k
tc qdisc add dev eth1 parent 2:130 handle 210:0 esfq perturb 10 depth 1024 hash dst
tc filter add dev eth1 parent 2:0 protocol ip prio 3 handle 0x1869c fw classid 2:130
#bulk-class. lower prio than all others, no reserved bw
tc class add dev eth1 parent 2:3 classid 2:140 htb rate 5kbit ceil 750kbit prio 6 quantum 1500
tc qdisc add dev eth1 parent 2:140 handle 220:0 esfq perturb 10 depth 1024 hash dst
tc filter add dev eth1 parent 2:0 protocol ip prio 4 handle 0x1869b fw classid 2:140
# now iptables-mark-rules. BEWARE THE FACT that LAST MARK COUNTS (i.e. mark-rules are not terminating)
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# Default: Everything forwarded is normal (obsolete because of htb-default filter, but... :)
$iptables -t mangle -A FORWARD
-j MARK --set-mark 0x1869c
# Local Generated Stuff gets into a special class, which is serves at full interface speed
$iptables -t mangle -A OUTPUT -j MARK --set-mark 0
x1869a
# EVERYTING in a connection above 500k is bulk (gets only overridden by games perhaps, see below)
$iptables -t mangle -A FORWARD -m connbytes --connbytes 256000:
-j MARK --set-mark 0x1869b
# Some priorized Stuff
$iptables -t mangle -A FORWARD -p udp --destination-port 53 -j MARK --set-mark 0
x1869f
$iptables -t mangle -A FORWARD -p udp --source-port 53 -j MARK --set-mark 0
x1869f
$iptables -t mangle -A FORWARD -p icmp -m limit --limit 2/second -j MARK --set-mark 0
x1869f
$iptables -t mangle -A FORWARD -p tcp -m tos --tos 0x10 -j MARK --set-mark 0x1869f
$iptables -t mangle -A FORWARD -p tcp --dport 22 -m tos --tos ! 0x8 -m connbytes --connbytes :200000 -j MARK --set-mark 0x1869
f
$iptables -t mangle -A FORWARD -p tcp --sport 22 -m tos --tos ! 0x8 -m connbytes --connbytes :200000 -j MARK --set-mark 0x1869
f
# GAME-MATCHES (PUT THEM IN HERE; NO WHERE ELSE, BECAUSE IPTABLES-MARKS ARE OVERRIDDEN BY THE LAST MATCH!)
# diablo 2
$iptables -t mangle -A FORWARD -p tcp --dport 4000 -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p tcp --sport 4000 -j MARK --set-mark 0x1869d
# teamspeak
$iptables -t mangle -A FORWARD -p udp --dport 8767 -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p udp --sport 8767 -j MARK --set-mark 0x1869d
# warcraft
$iptables -t mangle -A FORWARD -p tcp --dport 6112 -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p tcp --sport 6112 -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p udp --dport 7777 -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p udp --sport 7777 -j MARK --set-mark 0x1869d
# americas army
$iptables -t mangle -A FORWARD -p udp --dport 1716 -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p udp --sport 1716 -j MARK --set-mark 0x1869d
# very much games (unreal, TO, rtcw)
$iptables -t mangle -A FORWARD -p udp --dport 20000:30000 -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p udp --sport 20000:30000 -j MARK --set-mark 0x1869d
# Other (bulk) Matches
$iptables -t mangle -A FORWARD -m helper --helper ftp -j MARK --set-mark 0x1869b
$iptables -t mangle -A FORWARD -p tcp --destination-port 4660:4670 -j MARK --set-mark 0x1869b
$iptables -t mangle -A FORWARD -p tcp --source-port 4660:4670 -j MARK --set-mark 0x1869b
$iptables -t mangle -A FORWARD -p tcp --destination-port 25 -j MARK --set-mark 0x1869b
$iptables -t mangle -A OUTPUT -p tcp --tcp-flags ALL ACK -m length --length 40:52
-j MARK --set-mark 0x1869f
$iptables -t mangle -A FORWARD -p tcp --tcp-flags ALL ACK -m length --length 40:52
-j MARK --set-mark 0x1869f