TCA="tc class add dev br0"

TFA="tc filter add dev br0"

TQA="tc qdisc add dev br0"

SFQ="sfq perturb 10"

tc qdisc del dev br0 root

tc qdisc add dev br0 root handle 1: htb

tc class add dev br0 parent 1: classid 1:1 htb rate 3072kbit

$TCA parent 1:1 classid 1:10 htb rate 3072kbit ceil 3072kbit prio 0

$TQA parent 1:10 handle 10: $SFQ

$TFA parent 1:0 prio 0 protocol ip handle 10 fw flowid 1:10

iptables -t mangle -A POSTROUTING -m iprange --dst-range 192.168.1.2-192.168.1.20 -j MARK --set-mark 10

TCAU="tc class add dev imq0"

TFAU="tc filter add dev imq0"

TQAU="tc qdisc add dev imq0"

modprobe imq

modprobe ipt_IMQ

ip link set imq0 up

tc qdisc del dev imq0 root

tc qdisc add dev imq0 root handle 1: htb

tc class add dev imq0 parent 1: classid 1:1 htb rate 256kbit

$TCAU parent 1:1 classid 1:10 htb rate 256kbit ceil 256kbit prio 0

$TQAU parent 1:10 handle 10: $SFQ

$TFAU parent 1:0 prio 0 protocol ip handle 10 fw flowid 1:10

iptables -t mangle -A PREROUTING -m iprange --src-range 192.168.1.2-192.168.1.20 -j MARK --set-mark 10

iptables -t mangle -A PREROUTING -j IMQ --todev 0

iptables -I FORWARD -m iprange --src-range 192.168.1.2-192.168.1.20 -p tcp -m connlimit --connlimit-above 2048 -j DROP

zakres="192.168.1.2 192.168.1.4 192.168.1.5 192.168.1.6 192.168.1.8 192.168.1.9 192.168.1.14"

rodzaje="tcp, udp"

max="200"

p2p="100"

porty="32459:32461 6346:6348 6881 4662 4672"

protokoly="bittorrent gnutella ares edonkey"



for ip in $zakres

do

   iptables -t filter -A FORWARD -s $ip -p tcp -m connlimit --connlimit-above $max -j DROP

   for protokol in $protokoly

   do

      iptables -t filter -A FORWARD -s $ip -p tcp -m connlimit --connlimit-above $p2p -m layer7 --l7proto $protokol -j DROP

   done

   for rodzaj in $rodzaje

   do

      for port in $porty

      do

         iptables -t filter -A FORWARD -s $ip -p $rodzaj -m connlimit --connlimit-above $p2p --sport $port -j DROP



      done

      iptables -t filter -A FORWARD -d $ip -p tcp -m limit --limit 6/s -m ipp2p --ipp2p -j ACCEPT

      iptables -t filter -A FORWARD -s $ip -p tcp -m limit --limit 6/s -m ipp2p --ipp2p -j ACCEPT

   done

   iptables -t filter -A FORWARD -s $ip -p tcp -m connlimit --connlimit-above $p2p -m ipp2p --ipp2p -j DROP

done