- 论坛徽章:
- 0
|
20可用积分
在一台nat网关上，内网口是eth2，外网口是eth3，用iptables来匹配流过的网络包，当内网的ip为10.0.1.7的用户从219.239.26.6下载时，用如下的脚本来限制下载速度到100kbps
#!/bin/sh
echo control
IDEV=eth2
ODEV=eth3
ulimit -HSn 65536
echo 1024 40000 > /proc/sys/net/ipv4/ip_local_port_range
echo 1 >/proc/sys/net/ipv4/ip_forward
echo 1 >/proc/sys/net/ipv4/tcp_syncookies
echo 1 >/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
modprobe ip_nat_ftp
modprobe xt_iprange
iptables -F -t nat
iptables -F -t filter
iptables -F -t mangle
iptables -F
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
DOWNLINK=10000
UPLINK=10000
modprobe xt_iprange
tc qdisc del dev eth2 root 2>/dev/null
tc qdisc del dev eth2 ingress 2>/dev/null
tc qdisc del dev eth3 root 2>/dev/null
tc qdisc add dev $IDEV root handle 1: htb default 9 r2q 1
tc class add dev $IDEV parent 1: classid 1:1 htb rate ${DOWNLINK}kbps ceil ${DOWNLINK}kbps
tc qdisc add dev $ODEV root handle 2: htb default 9 r2q 1
tc class add dev $ODEV parent 2: classid 2:1 htb rate ${UPLINK}kbps ceil ${UPLINK}kbps
tc class add dev $IDEV parent 1:1 classid 1:251 htb rate 100kbps ceil 100kbps prio 0
tc qdisc add dev $IDEV parent 1:251 handle 251: sfq
tc filter add dev $IDEV protocol ip parent 1:0 prio 0 handle 251 fw classid 1:251
tc class add dev $ODEV parent 2:1 classid 2:251 htb rate 100kbps ceil 100kbps prio 1
iptables -A PREROUTING -t mangle -p tcp -s 202.105.13.166/32 -j MARK --set-mark 251
iptables -A OUTPUT -t mangle -p tcp -s 202.105.13.166/32 -j MARK --set-mark 251
tc qdisc add dev $ODEV parent 2:251 handle 251: sfq
tc filter add dev $ODEV protocol ip parent 2:0 prio 1 handle 251 fw classid 2:251
iptables -t nat -A PREROUTING -i $IDEV -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
echo over
执行后，用iptables -L -t mangle -n -v可以看到有符合的包匹配成功了，如下：
Chain PREROUTING (policy ACCEPT 23M packets, 6992M bytes)
pkts bytes target prot opt in out source destination
15402 23M MARK tcp -- * * 202.105.13.166 0.0.0.0/0 MARK set 0xfb
Chain INPUT (policy ACCEPT 23M packets, 6975M bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 70239 packets, 17M bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 20M packets, 6774M bytes)
pkts bytes target prot opt in out source destination
0 0 MARK tcp -- * * 202.105.13.166 0.0.0.0/0 MARK set 0xfb
Chain POSTROUTING (policy ACCEPT 20M packets, 6790M bytes)
pkts bytes target prot opt in out source destination
但是tc -s -d class show dev eth2没有发现有包通过队列
[root@localhost ~]# tc -s -d class show dev eth2
class htb 1:1 root rate 80000Kbit ceil 80000Kbit burst 1590b/8 mpu 0b overhead 0b cburst 1590b/8 mpu 0b overhead 0b level 7
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
rate 0bit 0pps backlog 0b 0p requeues 0
lended: 0 borrowed: 0 giants: 0
tokens: 156 ctokens: 156
class htb 1:251 parent 1:1 leaf 251: prio 0 quantum 100000 rate 800000bit ceil 800000bit burst 1599b/8 mpu 0b overhead 0b cburst 1599b/8 mpu 0b overhead 0b level 0
Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
rate 0bit 0pps backlog 0b 0p requeues 0
lended: 0 borrowed: 0 giants: 0
tokens: 15624 ctokens: 15624
请问这是因为什么造成的？非常感谢！
[ 本帖最后由 setsuna 于 2009-12-30 20:42 编辑 ] |
|
免费注册
发表于 2009-12-30 19:13
