modprobe ipt_layer7
TCA="tc class add dev br0"
TFA="tc filter add dev br0"
tc qdisc del dev br0 root
tc qdisc add dev br0 root handle 1: htb
tc class add dev br0 parent 1: classid 1:1 htb rate 1900kbit
$TCA parent 1:1 classid 1:10 htb rate 1200kbit ceil 1200kbit prio 2
$TCA parent 1:1 classid 1:11 htb rate 80kbit ceil 500kbit prio 4
$TCA parent 1:1 classid 1:12 htb rate 256kbit ceil 520kbit prio 4
$TFA parent 1:0 prio 2 protocol ip handle 10 fw flowid 1:10
$TFA parent 1:0 prio 4 protocol ip handle 11 fw flowid 1:11
$TFA parent 1:0 prio 4 protocol ip handle 12 fw flowid 1:12
iptables -t mangle -A POSTROUTING -m layer7 --l7proto flash -j MARK --set-mark 11
iptables -t mangle -A POSTROUTING -m layer7 --l7proto httpvideo -j MARK --set-mark 11
iptables -t mangle -A POSTROUTING -m layer7 --l7proto httpaudio -j MARK --set-mark 11
iptables -t mangle -A POSTROUTING -m layer7 --l7proto exe -j MARK --set-mark 12
iptables -t mangle -A POSTROUTING -m layer7 --l7proto ftp -j MARK --set-mark 12
iptables -t mangle -A POSTROUTING -m iprange --dst-range 10.0.0.14-10.0.0.21 -j MARK --set-mark 10
iptables -t mangle -A POSTROUTING -p tcp --sport 400:442 -j MARK --set-mark 11
iptables -t mangle -A POSTROUTING -p tcp --sport 444:8079 -j MARK --set-mark 11
iptables -t mangle -A POSTROUTING -p tcp --sport 8081:65535 -j MARK --set-mark 11
iptables -t mangle -A POSTROUTING -p tcp --sport 20:21 -j MARK --set-mark 12
tc qdisc add dev br0 ingress
iptables -t mangle -I POSTROUTING -p tcp --sport 80 -m layer7 --l7proto bittorrent -j DROP
iptables -t mangle -I POSTROUTING -p tcp --sport 80 -m layer7 --l7proto gnutella -j DROP
iptables -t mangle -I POSTROUTING -p tcp --sport 80 -m layer7 --l7proto edonkey -j DROP
iptables -t mangle -I POSTROUTING -p tcp --sport 53 -m layer7 --l7proto bittorrent -j DROP
iptables -t mangle -I POSTROUTING -p tcp --sport 53 -m layer7 --l7proto gnutella -j DROP
iptables -t mangle -I POSTROUTING -p tcp --sport 53 -m layer7 --l7proto edonkey -j DROP
$TFA parent ffff: protocol ip handle 50 fw police rate 10kbit mtu 12k burst 10k drop
iptables -t mangle -A PREROUTING -m layer7 --l7proto bittorrent -j MARK --set-mark 50
iptables -t mangle -A PREROUTING -m layer7 --l7proto edonkey -j MARK --set-mark 50
iptables -t mangle -A PREROUTING -m layer7 --l7proto gnutella -j MARK --set-mark 50
$TFA parent ffff: protocol ip handle 51 fw police rate 150kbit mtu 12k burst 10k drop
iptables -t mangle -A PREROUTING -m iprange --src-range 10.0.0.2-10.0.0.20 -j MARK --set-mark 51
iptables -I FORWARD -m iprange --src-range 10.0.0.2-10.0.0.20 -p tcp -m connlimit --connlimit-above 80 -j DROP
iptables -I FORWARD -p udp -m iprange --src-range 10.0.0.2-10.0.0.20 -j DROP
iptables -I FORWARD -p udp -m iprange --src-range 10.0.0.2-10.0.0.20 -m limit --limit 20/s -j ACCEPT
iptables -I FORWARD -p tcp --dport 400:65535 -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p UDP --dport 400:65535 -j DROP
iptables -A FORWARD -p UDP --dport 400:65535 -m limit --limit 60/s -j ACCEPT
$TFA parent ffff: protocol ip handle 52 fw police rate 10kbit mtu 12k burst 10k drop
iptables -t mangle -A PREROUTING -p tcp --dport 400:442 -j MARK --set-mark 52
iptables -t mangle -A PREROUTING -p tcp --dport 444:8079 -j MARK --set-mark 52
iptables -t mangle -A PREROUTING -p tcp --dport 8081:65535 -j MARK --set-mark 52