How to configure iptables and tc to limit bandwidth and traffic

# Enable the forwarding function of the forward chain in netfilter # EnablingIPForwarding ...... echoEnablingIPForwarding ........ echo1/proc/sys/net/ipv4/ip_forwardIPTABLES/sbin/iptables # define the communication port to call # Pro ## enable the forwarding function of the forward chain in netfilter
# Enabling IP Forwarding ......
Echo "Enabling IP Forwarding ........"
Echo "1">/proc/sys/net/ipv4/ip_forward
IPTABLES = "/sbin/ Iptables"
# Define a communication port for calling
# Protocols Configuration.
HTTP = "80"
HTTPS = "443"
FTP = "21"
FTP_DATA = "20"
SMTP = "25"
POP3 = "110"
IMAP = "143"
SSH = "22"
TELNET = "23"
PCAW_TCP = "5631"
PCAW_UDP = "5632"
WEBMIN = "10000"
Wam= "12000"
DNS = "53"
# Configure network interfaces
# Internet Configuration.
INET_IF = "ppp0"
# Internet netcard
EXT_IF = "eth0"
# Intranet netcard
LAN_IF = "eth1"
LAN_IP = "192.168.0.1"
LAN_IP_RANGE = "192.168.0.0/24"
# TRUSTED_TCP_PORT = "22 25 53 80 110 143 443 3128 6000 6001 6002"
# Localhost Configuration.
LO_IF = "lo"
LO_IP = "127.0.0.1"
# Mount the corresponding functional modules
# Module loading.
Echo "modprobe modules"
# Module loading.
# Needed to initially load modules
/Sbin/depmod-
# Required modules
#/Sbin/modprobe ip_tables
#/Sbin/modprobe ip_conntrack
#/Sbin/modprobe iptable_filter
#/Sbin/modprobe iptable_mangle
#/Sbin/modprobe iptable_nat
#/Sbin/modprobe ipt_LOG
#/Sbin/modprobe ipt_limit
#/Sbin/modprobe ipt_state
#/Sbin/modprobe ip_conntrack_ftp
#/Sbin/modprobe ip_nat_ftp
# Non-Required modules
#/Sbin/modprobe ipt_owner
#/Sbin/modprobe ipt_REJECT
#/Sbin/modprobe ipt_MASQUERADE
#/Sbin/modprobe ip_conntrack_irc
#/Sbin/modprobe ip_nat_irc
######################################## ###################################### Start using tc control network traffic
########################## TC begin ############ ##############################
######################################## ################################## Upload port configuration
Echo "Enabling uplink limit"
# Uplink limit
# Clear dev eth0 rule
Tc qdisc del dev eth0 root 2>/dev/null
# Define the total upload bandwidth (using the tc syntax, here the htb filter is used)
# Define root and default rule
Tc qdisc add dev eth0 root handle 10: htb default 70
# Define uplink max rate
Tc class add dev eth0 parent 10: classid 10:1 htb rate 64 kbps ceil 64 kbps
# Classify different services and define different data traffic
# Define second leaf
# Tc class add dev eth0 parent 10classid htb rate 2 kbps ceil 4 kbps prio 2
# Tc class add dev eth0 parent 10classid htb rate 2 kbps ceil 4 kbps prio 2
# Tc class add dev eth0 parent 10classid htb rate 32 kbps ceil 40 kbps prio 3
Tc class add dev eth0 parent 10classid htb rate 3 kbps ceil 13 kbps prio 0
Tc class add dev eth0 parent 10classid htb rate 1 kbps ceil 11 kbps prio 1
Tc class add dev eth0 parent 10:1 classid 10: 60 htb rate 1 kbps ceil 11 kbps prio 1
Tc class add dev eth0 parent 10:1 classid 10: 70 htb rate 2 kbps ceil 5 kbps prio 1
# Define priorities for different data transmission services and optimize data transmission methods
# Define rule for second leaf
# Tc qdisc add dev eth0 parent handle 101: pfifo
# Tc qdisc add dev eth0 parent handle 102: pfifo
# Tc qdisc add dev eth0 parent handle 103: pfifo
# Tc qdisc add dev eth0 parent handle 104: pfifo
# Tc qdisc add dev eth0 parent handle 105: pfifo
# Tc qdisc add dev eth0 parent 10: 60 handle 106: pfifo
# Tc qdisc add dev eth0 parent 10: 70 handle 107: pfifo
# Tc qdisc add dev eth0 parent handle 101: sfq perturb 10
# Tc qdisc add dev eth0 parent handle 102: sfq perturb 10
# Tc qdisc add dev eth0 parent handle 103: sfq perturb 10
Tc qdisc add dev eth0 parent handle 104: sfq perturb 5
Tc qdisc add dev eth0 parent handle 105: sfq perturb 10
Tc qdisc add dev eth0 parent 10: 60 handle 106: sfq perturb 10
Tc qdisc add dev eth0 parent 10: 70 handle 107: sfq perturb 10
# Prepare for marking the mangle chain in the netfilter chain (handle label)
# Define fw for ipfilter
# Tc filter add dev eth0 parent 10: protocol ip prio 100 handle 10 fw classid
# Tc filter add dev eth0 parent 10: protocol ip prio 100 handle 20 fw classid
# Tc filter add dev eth0 parent 10: protocol ip prio 100 handle 30 fw classid
Tc filter add dev eth0 parent 10: protocol ip prio 100 handle 40 fw classid
Tc filter add dev eth0 parent 10: protocol ip prio 100 handle 50 fw classid
Tc filter add dev eth0 parent 10: protocolip prio 100 handle 60 fw classid 10: 60
Tc filter add dev eth0 parent 10: protocol ip prio 100 handle 70 fw classid 10: 70
######################################## ######################################## ###
# Download port configuration (the method is the same as the upload configuration, but the speed definition is adjusted)
Echo "Enabling downlink limit"
# Downlink limit
# Clear dev eth1 rule
Tc qdisc del dev eth1 root 2>/dev/null
# Define root and default rule
Tc qdisc add dev eth1 root handle 10: htb default 70
# Define downlink max rate
Tc class add dev eth1 parent 10: classid 10htb rate 128 kbps ceil 128 kbps
# Define second leaf
# Tc class add dev eth1 parent 10classid htb rate 2 kbps ceil 32 kbps prio 2
# Tc class add dev eth1 parent 10classid htb rate 2 kbps ceil 32 kbps prio 2
# Tc class add dev eth1 parent 10classid htb rate 32 kbps ceil 212 kbps prio 3
Tc class add dev eth1 parent 10classid htb rate 5 kbps ceil 20 kbps prio 0
Tc class add dev eth1 parent 10classid htb rate 2 kbps ceil 17 kbps prio 1
Tc class add dev eth1 parent 10:1 classid 10: 60 htb rate 2 kbps ceil 17 kbps prio 1
Tc class add dev eth1 parent 10:1 classid 10: 70 htb rate 3 kbps ceil 5 kbps prio 1
# Define rule for second leaf
# Tc qdisc add dev eth1 parent handle 101: pfifo
# Tc qdisc add dev eth1 parent handle 102: pfifo
# Tc qdisc add dev eth1 parent handle 103: pfifo
# Tc qdisc add dev eth1 parent handle 104: pfifo
# Tc qdisc add dev eth1 parent handle 105: pfifo
# Tc qdisc add dev eth1 parent 10: 60 handle 106: pfifo
# Tc qdisc add dev eth1 parent 10: 70 handle 107: pfifo
# Tc qdisc add dev eth1 parent handle 101: sfq perturb 10
# Tc qdisc add dev eth1 parent handle 102: sfq perturb 10
# Tc qdisc add dev eth1 parent handle 103: sfq perturb 10
Tc qdisc add dev eth1 parent handle 104: sfq perturb 5
Tc qdisc add dev eth1 parent handle 105: sfq perturb 10
Tc qdisc add dev eth1 parent 10: 60 handle 106: sfq perturb 10
Tc qdisc add dev eth1 parent 10: 70 handle 107: sfq perturb 10
# Define fw for ipfilter
# Tc filter add dev eth1 parent 10: protocol ip prio 100 handle 10 fw classid 10: 10
# Tc filter add dev eth1 parent 10: protocol ip prio 100 handle 20 fw classid 10: 20
# Tc filter add dev eth1 parent 10: protocol ip prio 100 handle 30 fw classid 10: 30
Tc filter add dev eth1 parent 10: protocol ip prio 100 handle 40 fw classid 10: 40
Tc filter add dev eth1 parent 10: protocol ip prio 100 handle 50 fw classid 10: 50
Tc filter add dev eth1 parent 10: protocol ip prio 100 handle 60 fw classid 10: 60
Tc filter add dev eth1 parent 10: protocol ip prio 100 handle 70 fw classid 10: 70
######################################## #####################################
# Define iptables rules
Echo "Enabling iptables rules"
# Enabling iptables rules
# Clear original content of each chain
# Reset the default policies ies in the tables
Iptables-P INPUT ACCEPT
Iptables-P FORWARD ACCEPT
Iptables-P OUTPUT ACCEPT
Iptables-t nat-P PREROUTING ACCEPT
Iptables-t nat-P POSTROUTING ACCEPT
Iptables-t nat-P OUTPUT ACCEPT
Iptables-t mangle-P PREROUTING ACCEPT
Iptables-t mangle-P OUTPUT ACCEPT
Iptables-F
Iptables-t nat-F
Iptables-t mangle-F
Iptables-X
Iptables-t nat-X
Iptables-t mangle-X
# Define the default chain policy (all rejected) to open the policy only when necessary
# Set policies
Iptables-P INPUT DROP
Iptables-P OUTPUT DROP
Iptables-P FORWARD DROP
######################################## ####################################
# Allow the local machine to perform ping loop testing
# Allow ping localhost, ping 192.168.0.1/2
# Allow loopback access
Iptables-a input-p icmp-I lo-j ACCEPT
Iptables-a output-p icmp-o lo-j ACCEPT
# Allow ping a microcomputer from the local machine
# Allow ping LAN
Iptables-a input-p ALL-I $ LAN_IF-s $ LAN_IP_RANGE-j ACCEPT
Iptables-a output-p ALL-o $ LAN_IF-d $ LAN_IP_RANGE-j ACCEPT
# Define the packets that are sent out of the ppp0 port and that are in the response package
# Allow ppp0
Iptables-a input-p ALL-I $ INET_IF-m state -- state ESTABLISHED, RELATED-j ACCEPT
Iptables-a output-p ALL-o $ INET_IF-j ACCEPT
# Define a new custom chain
# Creat userspecified chains
Iptables-N allowed
Iptables-N tcp_packets
Iptables-N bad_tcp_packets
Iptables-N icmp_packets
Iptables-N limited_packets
# Define the bad packet detection mechanism in the bad_tcp_packets chain
# Bad_tcp_packets rules chain
Iptables-A bad_tcp_packets-p tcp -- tcp-flags SYN, ack syn, ACK-m state -- state NEW-j REJECT -- reject-with tcp-reset
Iptables-A bad_tcp_packets-p tcp! -- Syn-m state -- state NEW-j LOG -- log-prefix "New not syn :"
Iptables-A bad_tcp_packets-p tcp! -- Syn-m state -- state NEW-j DROP
# Define conditions for detecting packets that can pass
# Allowed rules chain
Iptables-A allo
Linux Alliance
Collect and organize
Wed-p tcp -- syn-j ACCEPT
Iptables-A allowed-p tcp-m state -- state ESTABLISHED, RELATED-j ACCEPT
Iptables-A allowed-p tcp-j DROP
# Define an icmp rule packet to prevent ping attacks
# ICMP rules chain
Iptables-A icmp_packets-p icmp-s 0/0 -- icmp-type 8-j ACCEPT
Iptables-A icmp_packets-p icmp-s 0/0 -- icmp-type 11-j ACCEPT
# Limited_packets rules chain
# Iptables-A limited_packets-p tcp! -- Syn-m state -- state NEW-j DROP
# Iptables-a input-I $ INET_IF-s 192.168.0.0/16-j DROP
# Iptables-a input-p udp-I $ LAN_IF -- dport 67 -- sport 68-j ACCEPT
#
######################################## ##############################
# Perform bad_tcp_packets filtering on the input chain
# The first bad_tcp_packets filter of INPUT chain
Iptables-a input-p tcp-j bad_tcp_packets
# Icmp_packets filter the input chain
# The second icmp_packets filter of INPUT chain
Iptables-a input-p icmp-I $ INET_IF-j icmp_packets
# Open trusted ports
# Echo "Open trusted ports ....."
# Iptables-N services
# For PORT in $ TRUSTED_TCP_PORT; do
# Iptables-A tcp_packets-s 0/0-p tcp -- dport $ PORT-j allowed
# Done
# For PORT in $ TRUSTED_UDP_PORT; do
# Iptables-A tcp_packets-s 0/0-p udp -- dport $ PORT-j allowed
# Done
# The trust port of INPUT chain
# Iptables-a input-p tcp-I $ INET_IF-j tcp_packets
# Reject spoofing attacks
# Deny local cheat
Iptables-a input-I $ INET_IF-s 192.168.0.0/16-j DROP
Iptables-a input-I $ INET_IF-s 10.0.0.0/8-j DROP
Iptables-a input-I $ INET_IF-s 172.16.0.0/12-j DROP
Iptables-a input-I $ INET_IF-s 127.0.0.0/8-j DROP
# Allow DHCP_packets from LAN
# Iptables-a input-p udp-I $ LAN_IF -- dport 67 -- sport 68-j ACCEPT
# Reject burst attacks
# Deny attack of hack to input chain
Iptables-a input-m limit -- limit 3/minute -- limit-burst 3-j LOG -- log-level INFO -- log-prefix "ept input packets died :"
# Define rules on the forward chain
# FORWARD chain
# Bad_tcp_packets filter check
# Bad_tcp_packets filter
Iptables-a forward-p tcp-j bad_tcp_packets
# Address of limited filter
# Iptables-a forward-p tcp-j limited_packets
# No extra traffic limit for packages going out of the intranet
# Allow the packets from LAN to WAN
Iptables-a forward-o $ INET_IF-s $ LAN_IP_RANGE-j ACCEPT
Iptables-a forward-I $ LAN_IF-s $ LAN_IP_RANGE-j ACCEPT
# Define the rules for packets imported from ppp0 to pass the foward chain
# Allow the packets from wan to lan
Iptables-a forward-I $ INET_IF-d $ LAN_IP_RANGE-m state -- state ESTABLISHED, RELATED-j ACCEPT
# Perform burst detection on forward
# Deny attack of hack to forward chain
Iptables-a forward-m limit -- limit 3/minute -- limit-burst 3-j LOG -- log-level DEBUG -- log-prefix "ert forward packets died :"
# Perform icmp (ping attack) detection on the forward chain
# Deny ping attack of hack
Iptables-a forward-f-m limit -- limit 100/s -- limit-burst 100-j ACCEPT
Iptables-a forward-p icmp-m limit -- limit 1/s -- limit-burst 10-j ACCEPT
# Simple ddos defense for the forward chain
# Deny DDOS attack
Iptables-a forward-p tcp -- tcp-flags SYN, ACK, FIN, RST-m limit -- limit 1/s-j ACCEPT
# Disguise (net conversion)
# Allow UDP
# Iptables-a forward-p udp-d $ LAN_IP_RANGE-I $ EXT_IF-j ACCEPT
# The servies of www to the port for Squid
# Iptables-t nat-a prerouting-I eth1-p tcp-m tcp -- dport 80-j REDIRECT -- to-ports 3128
# The other servies use nat chain to masquerade
Iptables-t nat-a postrouting-s 192.168.0.0/24-o ppp0-j MASQUERADE
########### Mark for mangle filter ############
Echo "Enabling mangle"
# Uploads
# Iptables-t mangle-a prerouting-s 192.168.0.6-m layer7 -- l7proto dns-j MARK -- set-mark 10
# Iptables-t mangle-a prerouting-s 192.168.0.6-m layer7 -- l7proto smtp-j MARK -- set-mark 20
# Iptables-t mangle-a prerouting-s 192.168.0.6-m layer7 -- l7proto http-j MARK -- set-mark 30
# Marking IP addresses for traffic control-Upload
# Iptables-t mangle-a prerouting-s 192.168.0.52-j MARK -- set-mark 40
# Iptables-t mangle-a prerouting-s 192.168.0.0/24-j MARK -- set-mark 70
# Iptables-t mangle-a prerouting-s 192.168.0.3-j MARK -- set-mark 60
# Downloads
# Iptables-t mangle-a postrouting-d 192.168.0.6-m layer7 -- l7proto dns-j MARK -- set-mark 10
# Iptables-t mangle-a postrouting-d 192.168.0.6-m layer7 -- l7proto smtp-j MARK -- set-mark 20
# Iptables-t mangle-a postrouting-d 192.168.0.6-m layer7 -- l7proto http-j MARK -- set-mark 30
# Mark IP addresses for traffic control-Download
# Iptables-t mangle-a postrouting-d 192.168.0.52-j MARK -- set-mark 40
# Iptables-t mangle-a postrouting-d 192.168.0.0/24-j MARK -- set-mark 70
# Iptables-t mangle-a postrouting-d 192.168.0.3-j MARK -- set-mark 60
################################### Iptables END ### #####################################
Echo "iptables END"
# Echo "Enabling Squid"
#/Usr/local/squid/sbin/squid
Echo "Enabling ADSL"
Adsl-start
######################################## ##################
Each person's linux installation is different, and the netfilter module is loaded differently. it is estimated that you need to fine-tune the module loading. just remove the # pre-loaded module and several estimates, you can fine-tune the tc according to your actual situation.
This configuration has been running for three years, and there is no problem (configuration), but if a master is eyeing you, it is estimated that .... Hey hey, this is the technology. there is no absolute. my configuration (p3 Sai Yang 600,128 mpc100, 10 GB hard drive, 810e motherboard, dual 8139d MB Nic, debian woody 2.4.32 core) no shutdown does not cause any exceptions except normal cleaning every two months (because there are no restrictions on the intranet, it is important to clean the moles ). I am very grateful for your comments. Linux learning should be more like this.