QOS com asterisk

diogomxc
(usa Ubuntu)

Enviado em 11/07/2009 - 14:26h

Olá amigos!

Preciso reservar parte da minha banda para dados e parte para voip. Gostaria de saber se o script que estou usando esta correto:

#!/bin/sh

#** Parar Serviços **
service iptables stop
squid stop
htb eth0 stop
htb eth1 stop

#****************************** BLOQUEAR ***************************************
iptables -P INPUT DROP
iptables -P FORWARD DROP

#********************************* LIBERAR *************************************
iptables -P OUTPUT ACCEPT

iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp --sport 25 -j ACCEPT
iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp --sport 110 -j ACCEPT
iptables -A FORWARD -p tcp --dport 995 -j ACCEPT
iptables -A FORWARD -p tcp --sport 995 -j ACCEPT
iptables -A FORWARD -p tcp --dport 993 -j ACCEPT
iptables -A FORWARD -p tcp --sport 993 -j ACCEPT
iptables -A FORWARD -p tcp --dport 465 -j ACCEPT
iptables -A FORWARD -p tcp --sport 465 -j ACCEPT
iptables -A FORWARD -p tcp --dport 20 -j ACCEPT
iptbales -A FORWARD -p tcp --sport 20 -j ACCEPT
iptables -A FORWARD -p tcp --dport 21 -j ACCEPT
iptables -A FORWARD -p tcp --sport 21 -j ACCEPT

iptables -A FORWARD -p udp --dport 10000:20000 -j ACCEPT
iptables -A FORWARD -p udp --sport 10000:20000 -j ACCEPT
iptables -A FORWARD -p udp --dport 5060 -j ACCEPT
iptables -A FORWARD -p udp --sport 5060 -j ACCEPT
iptables -A FORWARD -p udp --dport 1571 -j ACCEPT
iptables -A FORWARD -p udp --sport 1571 -j ACCEPT

#Ping
iptables -A INPUT -i eth0 -p icmp -m limit --limit 2/s -j ACCEPT
iptables -A INPUT -i eth1 -p icmp -m limit --limit 2/s - j ACCEPT

iptables -A FORWARD -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -p udp --sport 53 -j ACCEPT
iptables -A FORWARD -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -p tcp --sport 53 -j ACCEPT

iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --sport 53 -j ACCEPT

iptables -A INPUT -i eth1 -j ACCEPT

#Porta da Internet
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 80 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --sport 80 -j ACCEPT

#Porta do Trixbox
#iptables -A INPUT -i eth1 -p tcp --dport 8080 -j ACCEPT
#iptables -A INPUT -i eth1 -p tcp --sport 8080 -j ACCEPT

Liberar MSN
#iptables -A POSTROUTING -p tcp -m tcp -o eth0 --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 536
#iptables -A POSTROUTING -p tcp -m tcp -o eth1 --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 536
iptables -A FORWARD -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -p tcp --sport 1863 -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp --sport 443 -j ACCEPT

#VoIP
iptables -A INPUT -i eth0 -p udp --dport 1571 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 5060 -j ACCEPT
iptables -A INPUT -i eth0 -p udp --dport 10000:20000 -j ACCEPT

#****************************** LoopBack ***************************************
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#****************************** MASCARAMENTO ***********************************
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

#******************************** ROTAS ****************************************
route add -net 192.168.0.0 netmask 255.255.255.0 gw 192.168.0.1 eth0
route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1 eth1

#****************************** SQUID ******************************************
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

#****************************** QoS ********************************************
iptables -t mangle -A POSTROUTING -p udp --sport 10000:20000 -j TOS --set-tos 16
iptables -t mangle -A POSTROUTING -p udp --sport 5060 -j TOS --set-tos 16
iptables -t mangle -A POSTROUTING -p udp --sport 1571 -j TOS --set-tos 16

iptables -t mangle -A PREROUTING -p udp --dport 10000:20000 -j TOS --set-tos 16
iptables -t mangle -A PREROUTING -p udp --dport 5060 -j TOS --set-tos 16
iptables -t mangle -A PREROUTING -p udp --dport 1571 -j TOS --set-tos 16

#****************************** HTB ********************************************
iptables -t mangle -A POSTROUTING -p udp --sport 10000:20000 -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -p udp --sport 5060 -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -p udp --sport 1571 -j MARK --set-mark 0x1

iptables -t mangle -A PREROUTING -p udp --dport 10000:20000 -j MARK --set-mark 0x1
iptables -t mangle -A PREROUTING -p udp --dport 5060 -j MARK --set-mark 0x1
iptables -t mangle -A PREROUTING -p udp --dport 1571 -j MARK --set-mark 0x1

#******************************** Reserva de Banda ********************************
#WAN (UPLOAD) - Rede Externa
tc qdisc add dev eth0 root handle 1: htb default 20
tc class add dev eth0 parent 1: classid 1:1 htb rate 200kbit ceil 200kbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 50kbit ceil 50kbit prio 1
tc class add dev eth0 parent 1:1 classid 1:20 htb rate 150kbit ceil 150kbit prio 2

tc qdisc add dev eth0 parent 1:10 handle 120: sfq perturb 10
tc qdisc add dev eth0 parent 1:20 handle 130: sfq perturb 10

tc filter add dev eth0 parent 1:0 protocol ip prio 1 handle 1 fw classid 1:10
tc filter add dev eth0 parent 1:0 protocol ip prio 2 handle 2 fw classid 1:20

#LAN (DOWNLOAD) - Rede Interna
tc qdisc add dev eth1 root handle 1: htb default 20
tc class add dev eth1 parent 1: classid 1:1 htb rate 10000kbit ceil 10000kbit
tc class add dev eth1 parent 1:1 classid 1:10 htb rate 50kbit ceil 50kbit prio 1
tc class add dev eth1 parent 1:1 classid 1:20 htb rate 400kbit ceil 400kbit prio 2

tc qdisc add dev eth1 parent 1:10 handle 120: sfq perturb 10
tc qdisc add dev eth1 parent 1:20 handle 130: sfq perturb 10

tc filter add dev eth1 parent 1:0 protocol ip prio 1 handle 1 fw classid 1:10
tc filter add dev eth1 parent 1:0 protocol ip prio 2 handle 2 fw classid 1:20

#** Inicializar Servicos **
service iptables save
service iptables start
squid start
htb eth0 start

Alguem pode me ajudar?

Obrigado!

refinski
(usa Ubuntu)

Enviado em 24/03/2014 - 06:32h

Estou fazendo o TCC da faculdade e preciso criar uma topologia de uma rede voip entre uma matriz e uma filial, só que não tenho ideia como fazer, acredito que eu tenha que usar dois roteadores, um servidor voip(asterisk) na matriz, vou usar dois micros para comunicação voip, e minha dúvida é se tenho que criar dois servidores um de cada lado para usar iptables com HTB para tratar a questão de QoS, se puder me dar uma luz te agradeço, grande abraço.