用linux做网桥做流量控制

我菜我怕谁

You’ll need Fedora Core 1 (2.4 kernel includes traffic control (tc) – this should work on FC2 but is not tested) which can be downloaded onto 3 CDs. We’ll actually only use discs 1 and 3 if you don’t want to download disc 2.

Use my scripts:

* bridge

Original:

* shape.eth0.sh

VoIP Gets Priority:

* shape.eth0.sh

Create a copy of shape.eth0.sh once you've configured it. Simply change the name to shape.eth1.sh, and change the one line in the script where e=eth0.

Before installing, write down both NIC MAC addresses, and label the NICs on the outside so you know which label corresponds to which MAC address. This should be documented for the network administrators as it can come in handy for tweaking. Although we’ll be applying the same settings for upload as for download, these can be adjusted differently. Download needs to be throttled back slightly more than upload as we need to eliminate all possible queues upstream at the ISP level. This way the QoS box becomes the queue so you can manage downloads and uploads.

FC1 install
- Skip Media Check
- Welcome Screen – Next
- Language Selection – Next
- Keyboard Configuration – Next
- Mouse – Generic 2 Button PS2 – Next
- Monitor Configuration – Generic CRT Display - 800x600 – Next
- Upgrade Examine – Install Fedora Core – Next
- Installation Type – Custom – Next
- Disk Partitioning Setup – Automatically Partition
- Automatic Partitioning – “Remove all partitions on this system” – Next
Click yes to the warning
- Disk Setup – Leave defaults there – Next
- Boot Loader Configuration – Leave GRUB as the default – Next
- Network Configuration
- Active on Boot – Check this for both cards
- Leave both cards set to DHCP
- Set the hostname manually. I used WellsFargoQoS1 for the primary
- Firewall Configuration - No Firewall – Next – Hit Proceed to Warning
- Additional Language Support – Next
- Time Zone Selection – Pick Your Time Zone – Next
- Set Root Password – Enter your password – Next
- Package Group Selection – Scroll to bottom and select Minimal – Next
- About to Install – Next
- Create a boot diskette if you want
- Reboot with only 1 ethernet cable hooked in (keeps routes simple while setting up)
- Login as root
- insert Disc 3 so you can copy over the bridge-utils RPM
[root@WellsFargoQoS1 root]# mount /dev/cdrom /mnt/cdrom/
[root@WellsFargoQoS1 root]# rpm –ivh /mnt/cdrom/Fedora/RPMS/bridge-utils-0.9.6-2.i386.rpm

You should see it go to 100%.
The brctl command should now show options. You may have to type ‘exit’ and login again for this to work.
[root@WellsFargoQoS1 root]# brctl

Unmount the cdrom and remove it.
[root@WellsFargoQoS1 root]# umount /mnt/cdrom

This will show your network configuration (like an ipconfig in windows) for each card. This way you can discover the ip of the card that is hooked up, so you can ssh to it.
[root@WellsFargoQoS1 root]# ip a

Install Windows Utilities

OK, now you need to hit that Linux box from Windows. Download and install these utilities:
WinSCP: http://winscp.sourceforge.net/eng/
PuTTY: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html


Configure files:
All files have variables to modify at the top. I suggest you use TextPad to modify these files. It is a free download from http://www.textpad.com/ . I’ve found that Microsoft products tend to insert extra carriage return characters and things that will prevent your script from running. In other words, you are on your own if you use Notepad or WordPad.

bridge:
These variable names should make sense.

BRIDGENAME="myBridge1"   **
GATEWAY="192.168.1.1"
BRIDGE_IP="192.168.1.50"
BRIDGE_NETMASK="255.255.255.0"

Ok, these parameters depend if you’re setting these up for a failover Spanning Tree Protocol setup.




** BRIDGENAME can be anything. It’s just for reference internally, not how it appears on the network.

shape.eth0.sh
shape.eth1.sh
Both of these files should be configured identically. For sites with T1 connections, you may want to leave this as-is.
e=eth0       # interface
t1=1.25Mbit  # size of your WAN - remember you can't max this or you'll experience latency. 75-80% of max is a good place to start.
el=100Mbit   # size of eth0
w=0.125Mbit   # weighting of your WAN (10% of t1)
t2=0.3Mbit   # traffic group 1
t3=0.7Mbit   # traffic group 2
t4=0.25Mbit  # traffic group 3
w2=0.03Mbit  # weighting of $t2
w3=0.07Mbit  # weighting of $t3
w4=0.025Mbit # weighting of $t4
Colo1="XXX.XXX.XXX.XXX"
Colo2="XXX.XXX.XXX.XXX"

OK, now that you’ve modified the files, let’s transfer them to the Linux box. Fire up WinSCP and connect as root. Transfer the files to /etc/rc.d/init.d/

Start up PuTTY and connect as root. Type the following commands:
cd /etc/rc.d/init.d/
chmod 755 bridge.sh
chmod 755 shape.eth0.sh
chmod 755 shape.eth1.sh
chkconfig --add bridge
service bridge start

After starting the bridge service your ssh session will get killed. But guess what? You’re done. You should now be able to ssh to the box with the IP you gave it in the bridge file. The IP will work from either side. Think of the bridge as a managed switch. No matter what port your Ethernet cable is plugged into, the bridge still has the same IP.

Tweaks:
Login to the bridge and type ‘setup’
Select System services
-Deselect apmd, isdn, kudzu, pcmcia, sendmail
apmd is important. This disables power management.
suggest
I suggest you do some stuff to speed up the boot time. Typical things for the BIOS:
• Turn off boot-up floppy seek
• Set the boot order to C: first, so it doesn’t check for CD-ROMs or floppies

• ssh into the linux box, and type ‘setup’ at the command line. Turn off kudzu service for faster startup time (this service does a scan for new hardware).

• Edit /boot/grub/grub.conf and lower the timeout setting for a faster timeout on the splash screen. I set it to 2 seconds for good speed.

Commands:
You can edit these files on the Linux box using vi.
Example:
vi /etc/rc.d/init.d/shape.eth0.sh
Hit ‘i’ to go into insert mode.
Change what you want.
Hit ESC
SHIFT-Z-Z to save and close
If you screw up, force a quit. Hit ESC to make sure you’re no longer in insert mode.
Type :q!ENTER   (colon first indicates a command is coming)

To make sure that traffic is being routed to the different queues as expected, you can issue the following command and see how many packets have been assigned and routed by each queue discipline:
tc -s class show dev eth0

我菜我怕谁

*Bridge :

#! /bin/sh
#
#
# /sbin/init.d/bridge
# chkconfig: 345 25 75
# description: bridge configuration script for HLI by Ron Senykoff

# . /etc/rc.config

return=$rc_done
BRIDGENAME="MyBridge1"
GATEWAY="X.X.X.X"
BRIDGE_IP="X.X.X.X"
BRIDGE_NETMASK="X.X.X.X"
STP_ON="yes"
STP_PRIO="1"

case "$1" in

    start)
       echo "Starting service bridge"
       ifconfig eth0 promisc up
ifconfig eth1 promisc up
brctl addbr $BRIDGENAME  ||  return=$rc_failed                           
      brctl addif $BRIDGENAME eth0  ||  return=$rc_failed                        
       brctl addif $BRIDGENAME eth1  ||  return=$rc_failed                        
       ifconfig eth0 0.0.0.0  ||  return=$rc_failed                        
       ifconfig eth1 0.0.0.0  ||  return=$rc_failed                        
       brctl sethello $BRIDGENAME 1  ||  return=$rc_failed                        
       brctl setmaxage $BRIDGENAME 4  ||  return=$rc_failed                     
      brctl setfd $BRIDGENAME 4  ||  return=$rc_failed
       brctl stp $BRIDGENAME $STP_ON
       brctl setbridgeprio $BRIDGENAME $STP_PRIO
ifconfig $BRIDGENAME $BRIDGE_IP netmask $BRIDGE_NETMASK up

ip route flush cache
ip route add default via $GATEWAY

sh /etc/rc.d/init.d/shape.eth0.sh
sh /etc/rc.d/init.d/shape.eth1.sh

      echo -e "$return"
      

    stop)
       echo "Shutting down service bridge"
       brctl delif $BRIDGENAME eth1  ||  return=$rc_failed                        
       brctl delif $BRIDGENAME eth0  ||  return=$rc_failed
ifconfig $BRIDGENAME down || return=$rc_failed                        
       brctl delbr $BRIDGENAME  ||  return=$rc_failed                           
      rmmod bridge || return=$rc_failed

        echo -e "$return"
      

    status)
       ifconfig $BRIDGENAME
       brctl showbr $BRIDGENAME
;;

    restart)
       $0 stop && $0 start || return=$rc_failed
      

    *)
       echo "Usage: $0 {start|stop|status|restart}"
       exit 1
esac

test "$return" = "$rc_done" || exit 1
exit 0

我菜我怕谁

*shape.eth0.sh


#!/bin/sh
#
# Script copyright Matt Critcher, 4 Dec. 2001.  This and the rest of the
# work done by us on the Dante project is released under the GPL (gnu.org) unless
# otherwise stated.  mucho thanks to the 2.4 Advanced Routing How-To at ds9a.nl
#
# -- this script sets up the traffic control on the interfaces.  see notation
# before each set of code.
#
# NOTE -- You need one of these scripts for each interface on the bridge, or
# you will be shaping traffic in only one direction
#
# modified by Ron Senykoff for HarrisLogic, Inc. 2004

#####################################
############ VARIABLES ##############
#                                   #
e=eth0       # interface
t1=2.20Mbit  # size of your WAN - remember you can't max this or you'll experience latency. 75-80% of max is a good place to start.
el=100Mbit   # size of eth0
w=0.22Mbit   # weighting of your WAN (10% of t1)

sizeCitrix=0.4Mbit
sizeVoIP=0.8Mbit
sizeVideo=0.8Mbit
sizeBulk=0.1Mbit
sizeSametime=0.1Mbit

weightCitrix=0.04Mbit
weightVoIP=0.08Mbit
weightVideo=0.08Mbit
weightBulk=0.01Mbit
weightSametime=0.01Mbit

COLO1="X.X.X.X"
COLO2="X.X.X.X"
SAMETIME="X.X.X.X"
#                                   #
#####################################
#####################################

# Delete any old rules #
tc qdisc del root dev $e

## each class is able to take more bandwidth as it is available, but must
## surrender it as the higher priorities (2, 3, then 4) need it.
## The lower the priority number, the more priority it gets. Thus when
## there is extra bandwidth available, the lower number classes get it as
## they need it.

# root qdisc /  qdisc = queueing discipline #
tc qdisc add dev $e root handle 1:0 cbq bandwidth 100Mbit avpkt 1000 cell 8

tc class add dev $e parent 1:0 classid 1:1 cbq bandwidth 100Mbit rate $t1 weight $w prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded

# child qdiscs (like child nodes on a tree) #
tc class add dev $e parent 1:1 classid 1:3 cbq bandwidth 100Mbit rate $sizeVoIP weight $weightVoIP prio 8 allot 1514 cell 8 maxburst 20 avpkt 83 isolated

tc class add dev $e parent 1:1 classid 1:5 cbq bandwidth 100Mbit rate $sizeCitrix weight $weightCitrix prio 8 allot 1514 cell 8 maxburst 20 avpkt 204 isolated

tc class add dev $e parent 1:1 classid 1:6 cbq bandwidth 100Mbit rate $sizeVideo weight $weightVideo prio 8 allot 1514 cell 8 maxburst 20 avpkt 580 bounded

tc class add dev $e parent 1:1 classid 1:7 cbq bandwidth 100Mbit rate $sizeSametime weight $weightSametime prio 8 allot 1514 cell 8 maxburst 20 avpkt 550

tc class add dev $e parent 1:1 classid 1:9 cbq bandwidth 100Mbit rate $sizeBulk weight $weightBulk prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
tc qdisc add dev $e parent 1:9 handle 90: sfq perturb 20

#####################################
############### VoIP ################
#                                   #

# IAX # this is the old format - IAX2 should be what's really seen going on
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip sport 5036 0xffff flowid 1:3
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dport 5036 0xffff flowid 1:3

# IAX2 #
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip sport 4569 0xffff flowid 1:3
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dport 4569 0xffff flowid 1:3

# match icmp echo request
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip icmp_type 0x08 0xff flowid 1:3

# match icmp echo reply
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip icmp_type 0x00 0xff flowid 1:3

#####################################
############### Citrix ##############
#                                   #

# SSH #
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip sport 22 0xffff flowid 1:5
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dport 22 0xffff flowid 1:5

# CITRIX/ICA #
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip sport 1494 0xffff flowid 1:5
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dport 1494 0xffff flowid 1:5

# CITRIX Metaframe #
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip src $COLO1/32 flowid 1:5
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dst $COLO1/32 flowid 1:5

tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip src $COLO2/32 flowid 1:5
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dst $COLO2/32 flowid 1:5



#####################################
############### Video ###############
#                                   #

# H323 #
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 1720 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 1720 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 15328 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 15328 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 15329 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 15329 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 15330 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 15330 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 15331 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 15331 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 15332 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 15332 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3230 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3230 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3231 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3231 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3232 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3232 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3233 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3233 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3234 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3234 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3235 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3235 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3236 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3236 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3237 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3237 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3238 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3238 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3239 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3239 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3240 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3240 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3241 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3241 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3242 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3242 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3243 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3243 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3244 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3244 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3245 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3245 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3246 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3246 0xffff flowid 1:6

tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip sport 3247 0xffff flowid 1:6
tc filter add dev $e protocol ip parent 1:0 prio 2 u32 match ip dport 3247 0xffff flowid 1:6

#####################################
############ Sametime ###############
#                                   #

tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip src $SAMETIME/32 flowid 1:7
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dst $SAMETIME/32 flowid 1:7

#####################################
######### Bulk / Default ############
#                                   #

tc filter add dev $e protocol ip parent 1:0 prio 3 u32 match ip src 0.0.0.0/0 flowid 1:9
tc filter add dev $e protocol ip parent 1:0 prio 3 u32 match ip dst 0.0.0.0/0 flowid 1:9

我菜我怕谁

网上做流量控制的实践例子不多,希望和大家共同研究.偶还听说有一种方法用tcss
希望做过这个的一同交流!

硬纸卡片

高级路由的例子确实不过，支持蔡兄一把

yyf_007

头好晕

sorock

tc的下一代：tcng ，值得研究。