TCA="tc class add dev br0"

TFA="tc filter add dev br0"

TQA="tc qdisc add dev br0"

SFQ="sfq perturb 10"

tc qdisc del dev br0

tc qdisc add dev br0 root handle 1: htb

tc class add dev br0 parent 1: classid 1:1 htb rate 1024kbit

$TCA parent 1:1 classid 1:10 htb rate 512kbit ceil 1024kbit prio 1

$TCA parent 1:1 classid 1:11 htb rate 512kbit ceil 1024kbit prio 2

$TQA parent 1:10 handle 10: $SFQ

$TQA parent 1:11 handle 11: $SFQ

$TFA parent 1:0 prio 1 protocol ip handle 10 fw flowid 1:10

$TFA parent 1:0 prio 2 protocol ip handle 11 fw flowid 1:11

iptables -t mangle -A POSTROUTING -d 192.168.1.101 -j MARK --set-mark 10

iptables -t mangle -A POSTROUTING -d 192.168.1.102 -j MARK --set-mark 11

tc qdisc add dev br0 ingress

$TFA parent ffff: protocol ip u32 match ip src 192.168.1.101 flowid :1 police rate 128kbit mtu 12k burst 10k drop

$TFA parent ffff: protocol ip u32 match ip src 192.168.1.102 flowid :1 police rate 128kbit mtu 12k burst 10k drop

iptables -I FORWARD -s 192.168.1.102 -p tcp -m connlimit --connlimit-above 150 -j DROP