GentooForum.de

Quellcode

#!/bin/bash
TC="/sbin/tc"
IPTABLES="/sbin/iptables"
INET="ppp0"
INTERN="eth0"
INTERN1="eth1"
INTERN2="eth2"
INTERN3="eth3"
INTERN4="eth4"
UPRATE="125kbit"
P1ULMAX="125kbit"
P1ULMIN="5kbit"
P2ULMAX="125kbit"
P2ULMIN="110kbit"
P3ULMAX="100kbit"
P3ULMIN="5kbit"
P4ULMAX="100kbit"
P4ULMIN="5kbit"
PRIO1="1"
PRIO2="2"
PRIO3="3"
PRIO4="4"
voipgateway="192.168.0.1"
if [ "$1" = "status" ]
then
        echo "[qdisc]"
        tc -s qdisc show dev $INET
        echo ""
        echo "[class]"
        tc -s class show dev $INET
        echo ""
        echo "[filter]"
        tc -s filter show dev $INET
        exit
fi
if [ "$1" = "start" ]
then
$IPTABLES -F
$IPTABLES -t mangle -F
$IPTABLES -t nat -F
$IPTABLES -L
$IPTABLES -t mangle -L
$IPTABLES -t nat -L
### Firewall Anfang ###
$IPTABLES -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT  -i $INTERN  -m state --state NEW  -j ACCEPT
$IPTABLES -A FORWARD  -i $INTERN  -m state --state NEW  -j ACCEPT
$IPTABLES -A OUTPUT  -o $INTERN  -m state --state NEW  -j ACCEPT
$IPTABLES -A FORWARD  -o $INTERN  -m state --state NEW  -j ACCEPT
$IPTABLES -A INPUT  -i $INTERN1  -m state --state NEW  -j ACCEPT
$IPTABLES -A FORWARD  -i $INTERN1  -m state --state NEW  -j ACCEPT
$IPTABLES -A OUTPUT  -o $INTERN1  -m state --state NEW  -j ACCEPT
$IPTABLES -A FORWARD  -o $INTERN1  -m state --state NEW  -j ACCEPT
$IPTABLES -A INPUT -i $INET -p tcp --dport 22 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -i $INET -p icmp -j DROP
$IPTABLES -A INPUT  -i $INET  -j DROP
$IPTABLES -A FORWARD  -i $INET  -j DROP
### Firewall Ende ###
# routing
$IPTABLES -t nat -A POSTROUTING -o $INET -j MASQUERADE
# all
$IPTABLES -t mangle -A POSTROUTING -o $INET -j MARK --set-mark $PRIO4
# icmp
$IPTABLES -t mangle -A POSTROUTING -o $INET -p icmp -j MARK --set-mark $PRIO1
# sip
$IPTABLES -t mangle -A POSTROUTING -o $INET -p udp --dport 5080 -j MARK --set-mark $PRIO2
# games
$IPTABLES -t mangle -A POSTROUTING -o $INET -p udp --dport 27915 -j MARK --set-mark $PRIO3
# voip gateways
$IPTABLES -t mangle -A POSTROUTING -s $voipgateway -o $INET -j MARK --set-mark $PRIO2
# http/s
$IPTABLES -t mangle -A POSTROUTING -o $INET -p tcp -m multiport --dport 80,443 -j MARK --set-mark $PRIO4
# dns
$IPTABLES -t mangle -A POSTROUTING -o $INET -p tcp --dport 53 -j MARK --set-mark $PRIO4
$IPTABLES -t mangle -A POSTROUTING -o $INET -p udp --dport 53 -j MARK --set-mark $PRIO4
# layer 7 Anwendungen
#$IPTABLES -t mangle -A POSTROUTING -o $INET -m layer7 --l7proto bittorrent -j MARK --set-mark $PRIO4
#$IPTABLES -t mangle -A POSTROUTING -o $INTERN -m layer7 --l7proto bittorrent -j MARK --set-mark $PRIO4
#$IPTABLES -t mangle -A POSTROUTING -o $INET -m layer7 --l7proto fasttrack -j MARK --set-mark $PRIO4
#$IPTABLES -t mangle -A POSTROUTING -o $INTERN -m layer7 --l7proto fasttrack -j MARK --set-mark $PRIO4
#$IPTABLES -t mangle -A POSTROUTING -o $INET -m layer7 --l7proto edonkey -j MARK --set-mark $PRIO4
#$IPTABLES -t mangle -A POSTROUTING -o $INTERN -m layer7 --l7proto edonkey -j MARK --set-mark $PRIO4
#QOS Anfang
#alte Konfiguration verwerfen
$TC qdisc del dev $INET root
### Root qdisc anlegen
$TC qdisc add dev $INET root handle 1: hfsc default 40
### Hauptklasse anlegen
$TC class add dev $INET parent 1: classid 1:1 hfsc sc rate $UPRATE ul rate $UPRATE
### Unterklassen anlegen
# Unterklasse 1
$TC class add dev $INET parent 1:1 classid 1:10 hfsc sc umax 1488b dmax 60ms rate $P1ULMIN ul rate $P1ULMAX
# Unterklasse 2
$TC class add dev $INET parent 1:1 classid 1:20 hfsc sc umax 1488b dmax 90ms rate $P2ULMIN ul rate $P2ULMAX
# Unterklasse 3
$TC class add dev $INET parent 1:1 classid 1:30 hfsc sc umax 1488b dmax 120ms rate $P3ULMIN ul rate $P3ULMAX
# Unterklasse 4
$TC class add dev $INET parent 1:1 classid 1:40 hfsc sc umax 1488b dmax 150ms rate $P4ULMIN ul rate $P4ULMAX
### Verteilung der markierten Pakete auf die Unterklassen
$TC filter add dev $INET parent 1: protocol ip prio 0 handle $PRIO1 fw flowid 1:10
$TC filter add dev $INET parent 1: protocol ip prio 1 handle $PRIO2 fw flowid 1:20
$TC filter add dev $INET parent 1: protocol ip prio 2 handle $PRIO3 fw flowid 1:30
$TC filter add dev $INET parent 1: protocol ip prio 3 handle $PRIO4 fw flowid 1:40
### Warteschlangen
$TC qdisc add dev $INET parent 1:10 handle 10: sfq perturb 10
$TC qdisc add dev $INET parent 1:20 handle 20: sfq perturb 10
$TC qdisc add dev $INET parent 1:30 handle 30: sfq perturb 10
$TC qdisc add dev $INET parent 1:40 handle 40: sfq perturb 10
# QOS Ende
echo 1 > /proc/sys/net/ipv4/ip_forward
fi

exit 0