nycolasbs
(usa Slackware)
Enviado em 02/08/2007 - 15:32h
Salve galera!!!
Lí algumas documentações e artigos sobre HTB e montei meu script para fazer o controle de banda, mas não tenho certeza se minha interpretação foi correta, por isso estou postando aqui meu script para solicitar ajuda de alguem com experiencia em HTB para analisar meu script.
#!/bin/bash
# Limpa regras do iptables e faz mascaramento dos pacotes saindo
/usr/local/sbin/iptables -F
/usr/local/sbin/iptables -t nat -F
/usr/local/sbin/iptables -t mangle -F
/usr/local/sbin/iptables -t nat -A POSTROUTING -j MASQUERADE
#################################################
# Marcando os ip’s para ficar mais facil no controle
# Servidor - 20
# Pacotes P2P Marcados pelo IPP2P - 30
# Pacotes P2P Marcados pelo Layer 7 - 40
# Pacote SIP Marcado pelo Layer 7 - 50
# Pacote http Marcado pelo Layer 7 - 60
# Marcando Ip do Servidor
/usr/local/sbin/iptables -A FORWARD -s 10.1.254.254 -o eth1 -t mangle -j MARK --set-mark 20
/usr/local/sbin/iptables -A FORWARD -d 10.1.254.254 -i eth0 -t mangle -j MARK --set-mark 20
# Marcar todos os pacotes P2p pelo IPP2P
/usr/local/sbin/iptables -A FORWARD -t mangle -m ipp2p --ipp2p -j MARK --set-mark 30
/usr/local/sbin/iptables -A PREROUTING -t mangle -m ipp2p --ipp2p -j MARK --set-mark 30
# Marca todos os pacotes P2p pelo Layer7
/usr/local/sbin/iptables -A PREROUTING -t mangle -m layer7 --l7proto edonkey -j MARK --set-mark 40
/usr/local/sbin/iptables -A PREROUTING -t mangle -m layer7 --l7proto gnutella -j MARK --set-mark 40
/usr/local/sbin/iptables -A PREROUTING -t mangle -m layer7 --l7proto netbios -j MARK --set-mark 40
/usr/local/sbin/iptables -A PREROUTING -t mangle -m layer7 --l7proto napster -j MARK --set-mark 40
/usr/local/sbin/iptables -A PREROUTING -t mangle -m layer7 --l7proto fasttrack -j MARK --set-mark 40
/usr/local/sbin/iptables -A PREROUTING -t mangle -m layer7 --l7proto bittorrent -j MARK --set-mark 40
/usr/local/sbin/iptables -A PREROUTING -t mangle -m layer7 --l7proto imesh -j MARK --set-mark 40
/usr/local/sbin/iptables -A FORWARD -t mangle -m layer7 --l7proto edonkey -j MARK --set-mark 40
/usr/local/sbin/iptables -A FORWARD -t mangle -m layer7 --l7proto gnutella -j MARK --set-mark 40
/usr/local/sbin/iptables -A FORWARD -t mangle -m layer7 --l7proto netbios -j MARK --set-mark 40
/usr/local/sbin/iptables -A FORWARD -t mangle -m layer7 --l7proto napster -j MARK --set-mark 40
/usr/local/sbin/iptables -A FORWARD -t mangle -m layer7 --l7proto fasttrack -j MARK --set-mark 40
/usr/local/sbin/iptables -A FORWARD -t mangle -m layer7 --l7proto bittorrent -j MARK --set-mark 40
/usr/local/sbin/iptables -A FORWARD -t mangle -m layer7 --l7proto imesh -j MARK --set-mark 40
# Marca os pacotes Sip pelo Layer7
/usr/local/sbin/iptables -A PREROUTING -t mangle -m layer7 --l7proto sip -j MARK --set-mark 50
/usr/local/sbin/iptables -A FORWARD -t mangle -m layer7 --l7proto sip -j MARK --set-mark 50
# Marca os pacotes HTTP pelo Layer7
/usr/local/sbin/iptables -A PREROUTING -t mangle -m layer7 --l7proto http -j MARK --set-mark 60
/usr/local/sbin/iptables -A FORWARD -t mangle -m layer7 --l7proto http -j MARK --set-mark 60
################################################
#Eth0 . upload (INTERNET)
#Eth1 . download (REDE INTERNA)
INT=eth1
EXT=eth0
#EXTERNA - UPLOAD
tc qdisc del dev $EXT root
# O default 10 diz que os pacotes que nao tiver nenhuma marcacao irá ter banda de 100kbit
tc qdisc add dev $EXT root handle 1: htb default 10
tc class add dev $EXT parent 1: classid 1:1 htb rate 600kbit
#Define o total de banda onde ceil é o limite e rate é a banda garantida quando não se especifica o ceil ele apenas vai garantir sem limite maximo)
tc class add dev $EXT parent 1:1 classid 1:10 htb rate 100kbit ceil 600kbit # tudo q nao foi marcado
tc class add dev $EXT parent 1:1 classid 1:20 htb rate 100kbit # servidor
tc class add dev $EXT parent 1:1 classid 1:30 htb rate 50kbit ceil 100kbit # p2p marcado ipp2p
tc class add dev $EXT parent 1:1 classid 1:40 htb rate 50kbit ceil 100kbit # p2p marcado layer7
tc class add dev $EXT parent 1:1 classid 1:50 htb rate 300kbit ceil 600kbit # voip
tc class add dev $EXT parent 1:1 classid 1:60 htb rate 100kbit ceil 600kbit # http
# Divide igualmente a banda pertub equivale ao tempo de atualizacao
tc qdisc add dev $EXT parent 1:10 handle 10: sfq perturb 5
tc qdisc add dev $EXT parent 1:20 handle 20: sfq perturb 5
tc qdisc add dev $EXT parent 1:30 handle 30: sfq perturb 5
tc qdisc add dev $EXT parent 1:40 handle 40: sfq perturb 5
tc qdisc add dev $EXT parent 1:50 handle 50: sfq perturb 5
tc qdisc add dev $EXT parent 1:60 handle 60: sfq perturb 5
#Prioriza os pacotes este valor vai de 1 a 5 quanto menor o valor maior a prioridade
tc filter add dev $EXT protocol ip parent 1:0 prio 5 handle 10 fw classid 1:10
tc filter add dev $EXT protocol ip parent 1:0 prio 2 handle 20 fw classid 1:20
tc filter add dev $EXT protocol ip parent 1:0 prio 5 handle 30 fw classid 1:30
tc filter add dev $EXT protocol ip parent 1:0 prio 5 handle 40 fw classid 1:40
tc filter add dev $EXT protocol ip parent 1:0 prio 1 handle 50 fw classid 1:50
tc filter add dev $EXT protocol ip parent 1:0 prio 3 handle 60 fw classid 1:60
#INTERNA - DOWNLOAD
tc qdisc del dev $INT root
tc qdisc add dev $INT root handle 1: htb default 10
tc class add dev $INT parent 1: classid 1:1 htb rate 600kbit
tc class add dev $INT parent 1:1 classid 1:10 htb rate 100kbit ceil 600kbit # tudo q nao foi marcado
tc class add dev $INT parent 1:1 classid 1:20 htb rate 100kbit # vago
tc class add dev $INT parent 1:1 classid 1:30 htb rate 50kbit ceil 100kbit # p2p marcado pelo ipp2p
tc class add dev $INT parent 1:1 classid 1:40 htb rate 50kbit ceil 100kbit # p2p marcado pelo layer7
tc class add dev $INT parent 1:1 classid 1:50 htb rate 300kbit ceil 600kbit # voip
tc class add dev $INT parent 1:1 classid 1:60 htb rate 100kbit ceil 600kbit # http
tc qdisc add dev $INT parent 1:10 handle 10: sfq perturb 5
tc qdisc add dev $INT parent 1:20 handle 20: sfq perturb 5
tc qdisc add dev $INT parent 1:30 handle 30: sfq perturb 5
tc qdisc add dev $INT parent 1:40 handle 40: sfq perturb 5
tc qdisc add dev $INT parent 1:50 handle 50: sfq perturb 5
tc qdisc add dev $INT parent 1:60 handle 60: sfq perturb 5
tc filter add dev $INT protocol ip parent 1:0 prio 5 handle 10 fw classid 1:10
tc filter add dev $INT protocol ip parent 1:0 prio 2 handle 20 fw classid 1:20
tc filter add dev $INT protocol ip parent 1:0 prio 5 handle 30 fw classid 1:30
tc filter add dev $INT protocol ip parent 1:0 prio 5 handle 40 fw classid 1:40
tc filter add dev $INT protocol ip parent 1:0 prio 1 handle 50 fw classid 1:50
tc filter add dev $INT protocol ip parent 1:0 prio 3 handle 60 fw classid 1:60