Forum: [Problem] iptables + nowe tomato

Kod Pobierz kod źródłowy
modprobe ipt_TTL

iptables -t mangle -I POSTROUTING -o br0 -j TTL --ttl-set 1

TCA="tc class add dev br0"

TFA="tc filter add dev br0"

TQA="tc qdisc add dev br0"

SFQ="sfq perturb 10"

tc qdisc del dev br0 root

tc qdisc add dev br0 root handle 1: htb

tc class add dev br0 parent 1: classid 1:1 htb rate 2000kbit

$TCA parent 1:1 classid 1:10 htb rate 550kbit ceil 1800kbit prio 1

$TCA parent 1:1 classid 1:11 htb rate 550kbit ceil 1000kbit prio 2

$TCA parent 1:1 classid 1:12 htb rate 100kbit ceil 1800kbit prio 1

$TCA parent 1:1 classid 1:13 htb rate 100kbit ceil 400kbit prio 2

$TCA parent 1:1 classid 1:14 htb rate 100kbit ceil 400kbit prio 2

$TCA parent 1:1 classid 1:15 htb rate 100kbit ceil 400kbit prio 2

$TCA parent 1:1 classid 1:16 htb rate 100kbit ceil 400kbit prio 2

$TCA parent 1:1 classid 1:17 htb rate 1kbit ceil 2kbit prio 2

$TQA parent 1:10 handle 10: $SFQ

$TQA parent 1:11 handle 11: $SFQ

$TQA parent 1:12 handle 12: $SFQ

$TQA parent 1:13 handle 13: $SFQ

$TQA parent 1:14 handle 14: $SFQ

$TQA parent 1:15 handle 15: $SFQ

$TQA parent 1:16 handle 16: $SFQ

$TQA parent 1:17 handle 17: $SFQ

$TFA parent 1:0 prio 1 protocol ip handle 10 fw flowid 1:10

$TFA parent 1:0 prio 2 protocol ip handle 11 fw flowid 1:11

$TFA parent 1:0 prio 1 protocol ip handle 12 fw flowid 1:12

$TFA parent 1:0 prio 2 protocol ip handle 13 fw flowid 1:13

$TFA parent 1:0 prio 2 protocol ip handle 14 fw flowid 1:14

$TFA parent 1:0 prio 2 protocol ip handle 15 fw flowid 1:15

$TFA parent 1:0 prio 2 protocol ip handle 16 fw flowid 1:16

$TFA parent 1:0 prio 2 protocol ip handle 17 fw flowid 1:17

iptables -t mangle -A POSTROUTING -d 192.168.1.100 -j MARK --set-mark 10

iptables -t mangle -A POSTROUTING -d 192.168.1.101 -j MARK --set-mark 11

iptables -t mangle -A POSTROUTING -d 192.168.1.102 -j MARK --set-mark 12

iptables -t mangle -A POSTROUTING -d 192.168.1.103 -j MARK --set-mark 13

iptables -t mangle -A POSTROUTING -d 192.168.1.104 -j MARK --set-mark 14

iptables -t mangle -A POSTROUTING -d 192.168.1.105 -j MARK --set-mark 15

iptables -t mangle -A POSTROUTING -d 192.168.1.106 -j MARK --set-mark 16

iptables -t mangle -A POSTROUTING -d 192.168.1.107 -j MARK --set-mark 17

TCAU="tc class add dev imq0"

TFAU="tc filter add dev imq0"

TQAU="tc qdisc add dev imq0"

modprobe imq

modprobe ipt_IMQ

ip link set imq0 up

tc qdisc del dev imq0 root

tc qdisc add dev imq0 root handle 1: htb

tc class add dev imq0 parent 1: classid 1:1 htb rate 256kbit

$TCAU parent 1:1 classid 1:10 htb rate 80kbit ceil 250kbit prio 1

$TCAU parent 1:1 classid 1:11 htb rate 10kbit ceil 100kbit prio 2

$TCAU parent 1:1 classid 1:12 htb rate 80kbit ceil 250kbit prio 1

$TCAU parent 1:1 classid 1:13 htb rate 10kbit ceil 100kbit prio 2

$TCAU parent 1:1 classid 1:14 htb rate 10kbit ceil 100kbit prio 2

$TCAU parent 1:1 classid 1:15 htb rate 10kbit ceil 100kbit prio 2

$TCAU parent 1:1 classid 1:16 htb rate 10kbit ceil 100kbit prio 2

$TCAU parent 1:1 classid 1:17 htb rate 1kbit ceil 2kbit prio 2

$TQAU parent 1:10 handle 10: $SFQ

$TQAU parent 1:11 handle 11: $SFQ

$TQAU parent 1:12 handle 12: $SFQ

$TQAU parent 1:13 handle 13: $SFQ

$TQAU parent 1:14 handle 14: $SFQ

$TQAU parent 1:15 handle 15: $SFQ

$TQAU parent 1:16 handle 16: $SFQ

$TQAU parent 1:17 handle 17: $SFQ

$TFAU parent 1:0 prio 1 protocol ip handle 10 fw flowid 1:10

$TFAU parent 1:0 prio 2 protocol ip handle 11 fw flowid 1:11

$TFAU parent 1:0 prio 1 protocol ip handle 12 fw flowid 1:12

$TFAU parent 1:0 prio 2 protocol ip handle 13 fw flowid 1:13

$TFAU parent 1:0 prio 2 protocol ip handle 14 fw flowid 1:14

$TFAU parent 1:0 prio 2 protocol ip handle 15 fw flowid 1:15

$TFAU parent 1:0 prio 2 protocol ip handle 16 fw flowid 1:16

$TFAU parent 1:0 prio 2 protocol ip handle 17 fw flowid 1:17

iptables -t mangle -A PREROUTING -s 192.168.1.100 -j MARK --set-mark 10

iptables -t mangle -A PREROUTING -s 192.168.1.101 -j MARK --set-mark 11

iptables -t mangle -A PREROUTING -s 192.168.1.102 -j MARK --set-mark 12

iptables -t mangle -A PREROUTING -s 192.168.1.103 -j MARK --set-mark 13

iptables -t mangle -A PREROUTING -s 192.168.1.104 -j MARK --set-mark 14

iptables -t mangle -A PREROUTING -s 192.168.1.105 -j MARK --set-mark 15

iptables -t mangle -A PREROUTING -s 192.168.1.106 -j MARK --set-mark 16

iptables -t mangle -A PREROUTING -s 192.168.1.107 -j MARK --set-mark 17

iptables -t mangle -A PREROUTING -j IMQ --todev 0

iptables -I FORWARD -s 192.168.1.101 -p tcp -m connlimit --connlimit-above 30 -j DROP

iptables -I FORWARD -s 192.168.1.102 -p tcp -m connlimit --connlimit-above 30 -j DROP

#iptables -I FORWARD -s 192.168.1.103 -p tcp -m connlimit --connlimit-above 30 -j DROP

iptables -I FORWARD -s 192.168.1.104 -p tcp -m connlimit --connlimit-above 30 -j DROP

iptables -I FORWARD -s 192.168.1.105 -p tcp -m connlimit --connlimit-above 30 -j DROP

iptables -I FORWARD -s 192.168.1.106 -p tcp -m connlimit --connlimit-above 30 -j DROP

iptables -I FORWARD -s 192.168.1.107 -p tcp -m connlimit --connlimit-above 30 -j DROP

iptables -I FORWARD -s 192.168.1.101 -p udp -m limit --limit 6/sec -j DROP

iptables -I FORWARD -s 192.168.1.102 -p udp -m limit --limit 6/sec -j DROP

#iptables -I FORWARD -s 192.168.1.103 -p udp -m limit --limit 6/sec -j DROP

iptables -I FORWARD -s 192.168.1.104 -p udp -m limit --limit 6/sec -j DROP

iptables -I FORWARD -s 192.168.1.105 -p udp -m limit --limit 6/sec -j DROP

iptables -I FORWARD -s 192.168.1.106 -p udp -m limit --limit 6/sec -j DROP

iptables -I FORWARD -s 192.168.1.107 -p udp -m limit --limit 6/sec -j DROP



#iptables -I FORWARD -s 192.168.1.102 -p tcp --dport 1:65535 -j DROP

#iptables -I FORWARD -s 192.168.1.102 -p udp --dport 1:65535 -j DROP

#iptables -I FORWARD -s 192.168.1.104 -p tcp --dport 1:65535 -j DROP

#iptables -I FORWARD -s 192.168.1.104 -p udp --dport 1:65535 -j DROP



#iptables -t nat -A PREROUTING -p tcp --dport 80 -m mac --mac 00:01:03:88:16:91 -j DNAT --to 192.168.1.1:8000



#iptables -A PREROUTING -t nat -s 192.168.1.106 -p tcp --dport 1:65535 -j DNAT --to- 192.168.1.1:8000

iptables -A PREROUTING -t nat -s 192.168.1.107 -p tcp --dport 1:65535 -j DNAT --to- 192.168.1.1:8000

#iptables -A PREROUTING -t nat -s 192.168.1.102 -p tcp --dport 1:65535 -j DNAT --to- 192.168.1.1:8000

iptables -A PREROUTING -t nat -s 192.168.1.104 -p tcp --dport 1:65535 -j DNAT --to- 192.168.1.1:8000