|
本帖最后由 easyteacher 于 2020-4-7 16:51 编辑
需要安装
- ethtool
- tc
- kmod-sched-cake
- iptables-mod-hashlimit
- iptables-mod-conntrack-extra
可选安装ipset相关组件,用于匹配视频网站,ipset名称为dscp_video。
这几行根据路由器和网络的实际情况进行修改:
- QOS_DEVICE=eth0.2 # 修改为WAN设备名
- DOWNLOAD_SPEED=30 # 下载速度,单位mbit
- UPLOAD_SPEED=30 # 上传速度,单位mbit
- PRIORITIZED_PORT="22,53" # 特殊优先端口,如SSH、DNS
复制代码
整个代码去除注释和空行不超过60行,实现了对下载和游戏流量的区分,尽可能减少iptables的规则数,非常的轻巧,适合性能孱弱的路由器。二楼讲下思路。
- #!/bin/sh
- QOS_DEVICE=wlan0
- DOWNLOAD_SPEED=2
- UPLOAD_SPEED=1
- SPEED_THRESHOLD=1
- PRIORITIZED_PORT="22,53"
- for DEV in $(ls /sys/class/net) ; do
- ethtool -K $DEV tso off 2>/dev/null
- ethtool -K $DEV ufo off 2>/dev/null
- ethtool -K $DEV gso off 2>/dev/null
- ethtool -K $DEV gro off 2>/dev/null
- done
- # -----tc----- #
- tc qdi del dev br-lan root
- tc qdi del dev $QOS_DEVICE root
- tc qdi replace dev $QOS_DEVICE root cake diffserv4 nat ack-filter-aggressive bandwidth ${UPLOAD_SPEED}mbit
- tc qdi replace dev br-lan root cake diffserv4 nat ingress bandwidth ${DOWNLOAD_SPEED}mbit
- # -----iptables----- #
- _name="mark_DSCP_ul mark_DSCP_dl mark_BULK_UL mark_BULK_DL mark_FAST mark_QUICK cowbqos"
- for NAME in $_name ; do
- iptables -t mangle -N $NAME 2>/dev/null
- iptables -t mangle -F $NAME
- done
- iptables -t mangle -C POSTROUTING -o br-lan -j mark_DSCP_dl || iptables -t mangle -A POSTROUTING -o br-lan -j mark_DSCP_dl
- iptables -t mangle -C PREROUTING -i br-lan -j mark_DSCP_ul || iptables -t mangle -A PREROUTING -i br-lan -j mark_DSCP_ul
- iptables -t mangle -C OUTPUT -o $QOS_DEVICE -j mark_DSCP_ul || iptables -t mangle -A OUTPUT -o $QOS_DEVICE -j mark_DSCP_ul
- # mark_BULK_UL start
- iptables -t mangle -A mark_BULK_UL -m hashlimit --hashlimit-name BULK_TRAFFIC_UL --hashlimit-mode srcip,dstip,dstport --hashlimit-above ${SPEED_THRESHOLD}kb/second --hashlimit-burst 20k --hashlimit-htable-max 1000000 --hashlimit-htable-expire 10000 --hashlimit-htable-gcinterval 10000 -j DSCP --set-dscp-class cs1
- iptables -t mangle -A mark_BULK_UL -m hashlimit --hashlimit-name BULK_TRAFFIC_UL_PKT --hashlimit-mode srcip,dstip,dstport --hashlimit-above 300/second --hashlimit-burst 30 --hashlimit-htable-max 1000000 --hashlimit-htable-expire 10000 --hashlimit-htable-gcinterval 10000 -j DSCP --set-dscp-class cs1
- # mark_BULK_UL end
- # mark_BULK_DL start
- iptables -t mangle -A mark_BULK_DL -m hashlimit --hashlimit-name BULK_TRAFFIC_DL --hashlimit-mode srcip,srcport,dstip --hashlimit-above ${SPEED_THRESHOLD}kb/second --hashlimit-burst 200k --hashlimit-htable-max 1000000 --hashlimit-htable-expire 10000 --hashlimit-htable-gcinterval 10000 -j DSCP --set-dscp-class cs1
- iptables -t mangle -A mark_BULK_DL -m hashlimit --hashlimit-name BULK_TRAFFIC_DL_PKT --hashlimit-mode srcip,srcport,dstip --hashlimit-above 300/second --hashlimit-burst 30 --hashlimit-htable-max 1000000 --hashlimit-htable-expire 10000 --hashlimit-htable-gcinterval 10000 -j DSCP --set-dscp-class cs1
- # mark_BULK_DL end
- # mark_FAST start
- iptables -t mangle -A mark_FAST -m hashlimit --hashlimit-name FAST_TRAFFIC --hashlimit-mode srcip,srcport,dstip,dstport --hashlimit-upto ${SPEED_THRESHOLD}kb/second --hashlimit-burst 40k --hashlimit-htable-max 1000000 --hashlimit-htable-expire 10000 --hashlimit-htable-gcinterval 10000 -j DSCP --set-dscp-class af31
- # mark_FAST end
- # mark_QUICK start
- iptables -t mangle -A mark_QUICK -m connbytes --connbytes 250: --connbytes-dir both --connbytes-mode avgpkt -j RETURN
- iptables -t mangle -A mark_QUICK -m connbytes --connbytes :102400 --connbytes-dir both --connbytes-mode bytes -j RETURN
- iptables -t mangle -A mark_QUICK -m hashlimit --hashlimit-name QUICK_TRAFFIC_PKT --hashlimit-mode srcip,dstip,dstport --hashlimit-above 128/second --hashlimit-burst 1 --hashlimit-htable-max 1000000 --hashlimit-htable-expire 10000 --hashlimit-htable-gcinterval 10000 -j RETURN
- iptables -t mangle -A mark_QUICK -m hashlimit --hashlimit-name QUICK_TRAFFIC_BYTE --hashlimit-mode srcip,dstip,dstport --hashlimit-above 13kb/second --hashlimit-burst 50k --hashlimit-htable-max 1000000 --hashlimit-htable-expire 10000 --hashlimit-htable-gcinterval 10000 -j RETURN
- iptables -t mangle -A mark_QUICK -j DSCP --set-dscp-class cs6
- # mark_QUICK end
- iptables -t mangle -A mark_DSCP_ul -p tcp -m multiport --ports 80,443 -j mark_FAST -m comment --comment "MARK-FAST-CONNECTION-LAN-WAN"
- iptables -t mangle -A mark_DSCP_ul -j mark_BULK_UL -m comment --comment "MARK-BULK-CONNECTION-LAN-WAN"
- iptables -t mangle -A mark_DSCP_ul -j mark_QUICK -m comment --comment "MARK-QUICK-CONNECTION-LAN-WAN"
- iptables -t mangle -A mark_DSCP_dl -p tcp -m multiport --ports 80,443 -j mark_FAST -m comment --comment "MARK-FAST-CONNECTION-WAN-LAN"
- iptables -t mangle -A mark_DSCP_dl -j mark_BULK_DL -m comment --comment "MARK-BULK-CONNECTION-WAN-LAN"
- iptables -t mangle -A mark_DSCP_dl -j mark_QUICK -m comment --comment "MARK-QUICK-CONNECTION-WAN-LAN"
- iptables -t mangle -A mark_DSCP_ul -p tcp -m multiport --dports $PRIORITIZED_PORT -j DSCP --set-dscp-class cs6
- iptables -t mangle -A mark_DSCP_dl -p tcp -m multiport --sports $PRIORITIZED_PORT -j DSCP --set-dscp-class cs6
- iptables -t mangle -A mark_DSCP_ul -p udp -m multiport --dports $PRIORITIZED_PORT -j DSCP --set-dscp-class cs6
- iptables -t mangle -A mark_DSCP_dl -p udp -m multiport --sports $PRIORITIZED_PORT -j DSCP --set-dscp-class cs6
复制代码
|
|