使用 TC 来优化带宽

参照了  Linux的高级路由和流量控制HOWTO中文版 http://www.lartc.org/ 和网上的一些文章，

有些乱，有些地方的设置还不合理，需要改进，但是它基本上能够正确的工作，我就在用（使用环境：ADSL 512Kbit/2Mbit，用NAT带10台电脑上网。），也希望对大家有用，下面是代码：

 

---

 

#!/bin/sh
# /etc/init.d/qos

DEV=eth0
CEIL=400

start_tc(){
echo "start TC"

tc qdisc add dev $DEV root handle 1: htb default 14
tc class add dev $DEV parent 1: classid 1:1 htb rate ${CEIL}kbit ceil ${CEIL}kbit
# tcp flag ADSL
tc class add dev $DEV parent 1:1 classid 1:10 htb rate 20kbit ceil 40kbit prio 0
# game,telnet,ssh,DNS
tc class add dev $DEV parent 1:1 classid 1:11 htb rate 20kbit ceil 80kbit prio 1
# http,movie,icmp,etc
tc class add dev $DEV parent 1:1 classid 1:12 htb rate 200kbit ceil ${CEIL}kbit prio 2
# QQ,mini cost
tc class add dev $DEV parent 1:1 classid 1:13 htb rate 40kbit ceil ${CEIL}kbit prio 2
# other,max throughput
tc class add dev $DEV parent 1:1 classid 1:14 htb rate 100kbit ceil ${CEIL}kbit prio 3
# limited ip
tc class add dev $DEV parent 1:1 classid 1:15 htb rate 20kbit ceil 30kbit prio 3

tc filter add dev $DEV parent 1:0 protocol ip prio 1 handle 1 fw classid 1:10
tc filter add dev $DEV parent 1:0 protocol ip prio 2 handle 2 fw classid 1:11
tc filter add dev $DEV parent 1:0 protocol ip prio 3 handle 3 fw classid 1:12
tc filter add dev $DEV parent 1:0 protocol ip prio 4 handle 4 fw classid 1:13
tc filter add dev $DEV parent 1:0 protocol ip prio 5 handle 5 fw classid 1:14
tc filter add dev $DEV parent 1:0 protocol ip prio 6 handle 6 fw classid 1:15

echo "Done"
}

start_mangle(){
echo "start MARK" 

# tos
iptables -t mangle -A PREROUTING -m tos --tos Minimize-Delay -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -m tos --tos Minimize-Delay -j RETURN
iptables -t mangle -A PREROUTING -m tos --tos Minimize-Cost -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -m tos --tos Minimize-Cost -j RETURN
iptables -t mangle -A PREROUTING -m tos --tos Maximize-Throughput -j MARK --set-mark 0x5
iptables -t mangle -A PREROUTING -m tos --tos Maximize-Throughput -j RETURN

# SYN flag
iptables -t mangle -A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j MARK --set-mark 0x1
iptables -t mangle -A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j RETURN

# ftp control data
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport ftp -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport ftp -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport ftp -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport ftp -j RETURN

# DNS
iptables -t mangle -A PREROUTING -p udp -m udp --dport 53 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p udp -m udp --dport 53 -j RETURN
iptables -t mangle -A PREROUTING -p udp -m udp --sport 53 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p udp -m udp --sport 53 -j RETURN

iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 53 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 53 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 53 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 53 -j RETURN

# Now prioritize ssh packets:
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 22 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 22 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 22 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 22 -j RETURN

# games
iptables -t mangle -A PREROUTING -d 61.135.177.57 -p tcp -m tcp --dport 3724 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -d 61.135.177.57 -p tcp -m tcp --dport 3724 -j RETURN
iptables -t mangle -A PREROUTING -s 61.135.177.57 -p tcp -m tcp --sport 3724 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -s 61.135.177.57 -p tcp -m tcp --sport 3724 -j RETURN

# icmp
iptables -t mangle -A PREROUTING -p icmp -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p icmp -j RETURN

# movie
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 554 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 554 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 554 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 554 -j RETURN

# http and/or htpps
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 80 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 80 -j RETURN

iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 443 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 443 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 443 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 443 -j RETURN

iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 8080 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 8080 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 8080 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 8080 -j RETURN

# QQ
iptables -t mangle -A PREROUTING -p udp -m udp --sport 8000 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p udp -m udp --sport 8000 -j RETURN
iptables -t mangle -A PREROUTING -p udp -m udp --dport 8000 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p udp -m udp --dport 8000 -j RETURN

# smtp pop3 tos min cost
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 25 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 25 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 25 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 25 -j RETURN

iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 110 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 110 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 110 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 110 -j RETURN

# default:
iptables -t mangle -A PREROUTING -j MARK --set-mark 0x5
iptables -t mangle -A PREROUTING -j RETURN

##### OUT
#  Proper TOS handling:
iptables -t mangle -A OUTPUT -m tos --tos Minimize-Delay -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -m tos --tos Minimize-Delay -j RETURN
iptables -t mangle -A OUTPUT -m tos --tos Minimize-Cost -j MARK --set-mark 0x4
iptables -t mangle -A OUTPUT -m tos --tos Minimize-Cost -j RETURN
iptables -t mangle -A OUTPUT -m tos --tos Maximize-Throughput -j MARK --set-mark 0x5
iptables -t mangle -A OUTPUT -m tos --tos Maximize-Throughput -j RETURN

# A good idea is to prioritize packets to begin tcp connections, those with SYN flag set:
iptables -t mangle -A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j RETURN

#   ADSL   218.29.0.233:2167
iptables -t mangle -A OUTPUT -p udp -m udp --dport 2167 -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -p udp -m udp --dport 2167 -j RETURN
iptables -t mangle -A OUTPUT -p udp -m udp --sport 2167 -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -p udp -m udp --sport 2167 -j RETURN

# ftp control data
iptables -t mangle -A OUTPUT -p tcp -m tcp --dport ftp -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p tcp -m tcp --dport ftp -j RETURN
iptables -t mangle -A OUTPUT -p tcp -m tcp --sport ftp -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p tcp -m tcp --sport ftp -j RETURN

# DNS
iptables -t mangle -A OUTPUT -p udp -m udp --dport 53 -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p udp -m udp --dport 53 -j RETURN
iptables -t mangle -A OUTPUT -p udp -m udp --sport 53 -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p udp -m udp --sport 53 -j RETURN

iptables -t mangle -A OUTPUT -p tcp -m tcp --dport 53 -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p tcp -m tcp --dport 53 -j RETURN
iptables -t mangle -A OUTPUT -p tcp -m tcp --sport 53 -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p tcp -m tcp --sport 53 -j RETURN

# icmp
iptables -t mangle -A OUTPUT -p icmp -j MARK --set-mark 0x3
iptables -t mangle -A OUTPUT -p icmp -j RETURN

# OUTPUT default
iptables -t mangle -A OUTPUT -j MARK --set-mark 0x3
iptables -t mangle -A OUTPUT -j RETURN

echo "Done"
}

# another queueing discipline to them so bandwith sharing is more fair:
# http
tc qdisc add dev $DEV parent 1:12 handle 120: sfq perturb 10
# other
tc qdisc add dev $DEV parent 1:14 handle 140: sfq perturb 10
# limited ip
tc qdisc add dev $DEV parent 1:15 handle 150: sfq perturb 10

stop_mangle() {
echo "stop mangle ......"
( iptables -t mangle -F && echo "ok." ) || echo "error."
}

stop_tc() {
echo  "Stop TC......"
( tc qdisc del dev $DEV root && echo "ok." ) || echo "error."
}

status() {
tc -s class show dev $DEV
}

usage() {
 echo "Usage: `basename $0` [start | stop | restart | status | mangle ]"
}

###################
case "$1" in

start)

( start_tc && start_mangle && echo "TC started!" ) || echo "error."
exit 0
;;

stop)

( stop_tc && stop_mangle && echo "TC stopped!" ) || echo "error."
exit 0
;;

restart)

stop_tc
stop_mangle
sleep 1
start_tc
start_mangle
echo "TC restart"
;;

status)

status
;;

mangle)

iptables -t mangle -nL
;;

*) usage
exit 1
;;
esac

 

 

---