参照了 Linux的高级路由和流量控制HOWTO中文版 http://www.lartc.org/ 和网上的一些文章,
有些乱,有些地方的设置还不合理,需要改进,但是它基本上能够正确的工作,我就在用(使用环境:ADSL 512Kbit/2Mbit,用NAT带10台电脑上网。),也希望对大家有用,下面是代码:
#!/bin/sh
# /etc/init.d/qos
DEV=eth0
CEIL=400
start_tc(){
echo "start TC"
tc qdisc add dev $DEV root handle 1: htb default 14
tc class add dev $DEV parent 1: classid 1:1 htb rate ${CEIL}kbit ceil ${CEIL}kbit
# tcp flag ADSL
tc class add dev $DEV parent 1:1 classid 1:10 htb rate 20kbit ceil 40kbit prio 0
# game,telnet,ssh,DNS
tc class add dev $DEV parent 1:1 classid 1:11 htb rate 20kbit ceil 80kbit prio 1
# http,movie,icmp,etc
tc class add dev $DEV parent 1:1 classid 1:12 htb rate 200kbit ceil ${CEIL}kbit prio 2
# QQ,mini cost
tc class add dev $DEV parent 1:1 classid 1:13 htb rate 40kbit ceil ${CEIL}kbit prio 2
# other,max throughput
tc class add dev $DEV parent 1:1 classid 1:14 htb rate 100kbit ceil ${CEIL}kbit prio 3
# limited ip
tc class add dev $DEV parent 1:1 classid 1:15 htb rate 20kbit ceil 30kbit prio 3
tc filter add dev $DEV parent 1:0 protocol ip prio 1 handle 1 fw classid 1:10
tc filter add dev $DEV parent 1:0 protocol ip prio 2 handle 2 fw classid 1:11
tc filter add dev $DEV parent 1:0 protocol ip prio 3 handle 3 fw classid 1:12
tc filter add dev $DEV parent 1:0 protocol ip prio 4 handle 4 fw classid 1:13
tc filter add dev $DEV parent 1:0 protocol ip prio 5 handle 5 fw classid 1:14
tc filter add dev $DEV parent 1:0 protocol ip prio 6 handle 6 fw classid 1:15
echo "Done"
}
start_mangle(){
echo "start MARK"
# tos
iptables -t mangle -A PREROUTING -m tos --tos Minimize-Delay -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -m tos --tos Minimize-Delay -j RETURN
iptables -t mangle -A PREROUTING -m tos --tos Minimize-Cost -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -m tos --tos Minimize-Cost -j RETURN
iptables -t mangle -A PREROUTING -m tos --tos Maximize-Throughput -j MARK --set-mark 0x5
iptables -t mangle -A PREROUTING -m tos --tos Maximize-Throughput -j RETURN
# SYN flag
iptables -t mangle -A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j MARK --set-mark 0x1
iptables -t mangle -A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j RETURN
# ftp control data
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport ftp -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport ftp -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport ftp -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport ftp -j RETURN
# DNS
iptables -t mangle -A PREROUTING -p udp -m udp --dport 53 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p udp -m udp --dport 53 -j RETURN
iptables -t mangle -A PREROUTING -p udp -m udp --sport 53 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p udp -m udp --sport 53 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 53 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 53 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 53 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 53 -j RETURN
# Now prioritize ssh packets:
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 22 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 22 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 22 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 22 -j RETURN
# games
iptables -t mangle -A PREROUTING -d 61.135.177.57 -p tcp -m tcp --dport 3724 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -d 61.135.177.57 -p tcp -m tcp --dport 3724 -j RETURN
iptables -t mangle -A PREROUTING -s 61.135.177.57 -p tcp -m tcp --sport 3724 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -s 61.135.177.57 -p tcp -m tcp --sport 3724 -j RETURN
# icmp
iptables -t mangle -A PREROUTING -p icmp -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p icmp -j RETURN
# movie
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 554 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 554 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 554 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 554 -j RETURN
# http and/or htpps
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 80 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 80 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 80 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 443 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 443 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 443 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 443 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 8080 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 8080 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 8080 -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 8080 -j RETURN
# QQ
iptables -t mangle -A PREROUTING -p udp -m udp --sport 8000 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p udp -m udp --sport 8000 -j RETURN
iptables -t mangle -A PREROUTING -p udp -m udp --dport 8000 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p udp -m udp --dport 8000 -j RETURN
# smtp pop3 tos min cost
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 25 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 25 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 25 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 25 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 110 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 110 -j RETURN
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 110 -j MARK --set-mark 0x4
iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 110 -j RETURN
# default:
iptables -t mangle -A PREROUTING -j MARK --set-mark 0x5
iptables -t mangle -A PREROUTING -j RETURN
##### OUT
# Proper TOS handling:
iptables -t mangle -A OUTPUT -m tos --tos Minimize-Delay -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -m tos --tos Minimize-Delay -j RETURN
iptables -t mangle -A OUTPUT -m tos --tos Minimize-Cost -j MARK --set-mark 0x4
iptables -t mangle -A OUTPUT -m tos --tos Minimize-Cost -j RETURN
iptables -t mangle -A OUTPUT -m tos --tos Maximize-Throughput -j MARK --set-mark 0x5
iptables -t mangle -A OUTPUT -m tos --tos Maximize-Throughput -j RETURN
# A good idea is to prioritize packets to begin tcp connections, those with SYN flag set:
iptables -t mangle -A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j RETURN
# ADSL 218.29.0.233:2167
iptables -t mangle -A OUTPUT -p udp -m udp --dport 2167 -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -p udp -m udp --dport 2167 -j RETURN
iptables -t mangle -A OUTPUT -p udp -m udp --sport 2167 -j MARK --set-mark 0x1
iptables -t mangle -A OUTPUT -p udp -m udp --sport 2167 -j RETURN
# ftp control data
iptables -t mangle -A OUTPUT -p tcp -m tcp --dport ftp -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p tcp -m tcp --dport ftp -j RETURN
iptables -t mangle -A OUTPUT -p tcp -m tcp --sport ftp -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p tcp -m tcp --sport ftp -j RETURN
# DNS
iptables -t mangle -A OUTPUT -p udp -m udp --dport 53 -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p udp -m udp --dport 53 -j RETURN
iptables -t mangle -A OUTPUT -p udp -m udp --sport 53 -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p udp -m udp --sport 53 -j RETURN
iptables -t mangle -A OUTPUT -p tcp -m tcp --dport 53 -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p tcp -m tcp --dport 53 -j RETURN
iptables -t mangle -A OUTPUT -p tcp -m tcp --sport 53 -j MARK --set-mark 0x2
iptables -t mangle -A OUTPUT -p tcp -m tcp --sport 53 -j RETURN
# icmp
iptables -t mangle -A OUTPUT -p icmp -j MARK --set-mark 0x3
iptables -t mangle -A OUTPUT -p icmp -j RETURN
# OUTPUT default
iptables -t mangle -A OUTPUT -j MARK --set-mark 0x3
iptables -t mangle -A OUTPUT -j RETURN
echo "Done"
}
# another queueing discipline to them so bandwith sharing is more fair:
# http
tc qdisc add dev $DEV parent 1:12 handle 120: sfq perturb 10
# other
tc qdisc add dev $DEV parent 1:14 handle 140: sfq perturb 10
# limited ip
tc qdisc add dev $DEV parent 1:15 handle 150: sfq perturb 10
stop_mangle() {
echo "stop mangle ......"
( iptables -t mangle -F && echo "ok." ) || echo "error."
}
stop_tc() {
echo "Stop TC......"
( tc qdisc del dev $DEV root && echo "ok." ) || echo "error."
}
status() {
tc -s class show dev $DEV
}
usage() {
echo "Usage: `basename $0` [start | stop | restart | status | mangle ]"
}
###################
case "$1" in
start)
( start_tc && start_mangle && echo "TC started!" ) || echo "error."
exit 0
;;
stop)
( stop_tc && stop_mangle && echo "TC stopped!" ) || echo "error."
exit 0
;;
restart)
stop_tc
stop_mangle
sleep 1
start_tc
start_mangle
echo "TC restart"
;;
status)
status
;;
mangle)
iptables -t mangle -nL
;;
*) usage
exit 1
;;
esac