Use iptables + tc to control traffic

On the eth0 server, the external address eth0: 192.168.1.223eth1 is set to the internal address eth1: 11920.2.1. the function to be implemented now is to limit the entire exit to 512 kbit (upload traffic ), download traffic of the 192.168.2 network segment to 512 Kbit. The method is as follows: first, help set the corresponding address: (not detailed) implement route settings

Set the external address eth0: 192.168.1.223 in eth0 on the server.

Eth1 helps set the internal address eth1: 1 192.168.2.1

The function to be implemented now is to limit the entire exit to 512 kbit (upload traffic), and download traffic from the 192.168.2 network segment to 512 Kbit.

The method is as follows:

First, help to set the corresponding address: (not detailed)

Implement route settings and useIptables.

Iptables? CA input-F

Iptables-A output-F

Iptables-A forward-F

Echo 1>/proc/sys/net/ipv4/ip_forward

# Forwarding permitted

Iptables-A input? Cj accept

Iptables-A output-j accept

Iptables-A forward-j accept

Iptables-t nat-a postrouting-s 192.168.2.0/24-jMASQUERADE

# Mask IP addresses so that packets of internal hosts can be connected to the outside world through the server.

Manage traffic

Tc qdisc add dev eth0 root tbf rate 512 k lantency 50 ms burst1540

# Use tbf (TokenBucketFilter) to filter the queue on the eth0 Nic. the outbound traffic is limited to 512 kbit, the delay is 50 ms, and the burst data is 1540. the specified rate value is the limited bandwidth.

Continue to limit eth1.

Tc qdisc add dev eth1 root handle 1:0 cbq bandwidth 100 Mbitavpkt 1000 cell 8

# Create a queue and specify the NIC as a M Nic. this is irrelevant to the traffic limit and is used for computing.

Tc class add dev eth1 parent 1:0 classid cbq bandwidth100Mbit rate 5 Mbit weight 6 Mbit prio 8 allot 1514 cell 8 maxburst20 avpkt 1000 bounded

# Create a root category. the bandwidth is limited to 5 Mbit and other bandwidths cannot be borrowed. The parameters following Prio are priority values, indicating the order in which data packets are processed.

Tc class add dev eth1 parent classid cbq bandwidth100Mbit rate 512 kbit weight 5 Mbit prio 5 allot 1514 cell 8 maxburst20 avpkt 1000 bounded

# Under the same class, create a class with a bandwidth limit of 512 kbit at and do not allow the borrow bandwidth for the 192.168.2 network segment.

Tc qdisc add dev eth1 parent :3 handle 30: sfq

# Create a queue under each category, and use sfq (Stochastic Fareness Queueing) to then fair the queue.

Tc filter add dev eth1 parent 1:0 protocol ip prio 1 u32 matchip dst 172.17.0.0/16 flowid :3

# Use The u32 filter to classify the destination address and match the created queue.

Through the above method, simple traffic control is implemented to limit the upload traffic at the exit and the download traffic at the internal port.

The download speed from 192.168.2.20 is 512 kbit, and the download speed is 64-65kB.

The download speed from 192.168.2.20 is 128 kbit. the download speed is 14-16kB.

Note: If the data packet does not match any rule, the rule set by root is sent.