Vlákno názorů k článku HTB - jemný úvod od marek - Nejak nemuzu rozchodit HTB v navaznosti na IPTABLES....

Nejak nemuzu rozchodit HTB v navaznosti na IPTABLES. Pekety (pravdepodobne) omarkuju a potom se jes nazim tridit pres tc. Nicmene nejak toto nefachci protoze vzdy se dostanu do defaultni tridy a to je na kocku. prikladam zde skriptik kteery sem vcera vnosi spachal a nechodi mi to podle nej.

Kdyz zmnenim tridici proavidlo v tc a tridim podle u32 dle cilove ip (ne dle znacky), tak to vypada ze to vsecko fachci alepson pro download. Nicmene ja potrebuju alepson UPLOAD do inetu znackovat bo sit bude za maskaradou.
Diky za kazdou pomoc , uz sem z toho upne off . Sedim nad tim asi 2 dny.


#!/bin/sh


# **************************** Definice parametru ****************************
TC=/sbin/tc
IPTABLES=/usr/local/sbin/iptables

INET_IFACE=eth0
LAN_IFACE=eth1

INET_SPEED_UPLOAD=500Kbit
INET_SPEED_DOWNLOAD=900Kbit


GARANCE1=32Kbit
GARANCE2=64Kbit
GARANCE3=128Kbit
GARANCE4=256Kbit

MAXIMUM1=32Kbit
MAXIMUM2=64Kbit
MAXIMUM3=128Kbit
MAXIMUM4=256Kbit

BURST=32k


USER1=10.154.83.2 #Uzivatel 1
USER2=172.20.20.70 #Uzivatel 2
USER3=10.154.83.4 #Uzivatel 3
USER4=10.154.83.5 #Uzivatel 4
USER5=10.154.83.6 #Uzivatel 5
USER6=10.154.83.7 #Uzivatel 6
USER7=10.154.83.8 #Uzivatel 7
USER8=10.154.83.9 #Uzivatel 8
USER9=10.154.83.10 #Uzivatel 8
USER10=10.154.83.11 #Uzivatel 10




# **************************** Definice parametru ****************************










############################## DOWNLOAD ############################




# Smazani vsech qdiscu na LAN interfacu

$TC qdisc del dev $LAN_IFACE root >/dev/null



# Pridani ROOT tridy na LAN interface

$TC qdisc add dev $LAN_IFACE root handle 1:0 htb default 20


#Nastaveni rychlosti tridy dle rychlosti pripojeno do internetu

$TC class add dev $LAN_IFACE parent 1:0 classid 1:1 htb rate $INET_SPEED_DOWNLOAD burst $BURST



#Nastaveni rychlosti trid na LAN rozhrani

$TC class add dev $LAN_IFACE parent 1:1 classid 1:11 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 1
$TC class add dev $LAN_IFACE parent 1:1 classid 1:12 htb rate $GARANCE1 ceil $MAXIMUM4 burst $BURST #Klient 2
$TC class add dev $LAN_IFACE parent 1:1 classid 1:13 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 3
$TC class add dev $LAN_IFACE parent 1:1 classid 1:14 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 4
$TC class add dev $LAN_IFACE parent 1:1 classid 1:15 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 5
$TC class add dev $LAN_IFACE parent 1:1 classid 1:16 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 6
$TC class add dev $LAN_IFACE parent 1:1 classid 1:17 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 7
$TC class add dev $LAN_IFACE parent 1:1 classid 1:18 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 8
$TC class add dev $LAN_IFACE parent 1:1 classid 1:19 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 9
$TC class add dev $LAN_IFACE parent 1:1 classid 1:20 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 10











# ******************** Markovani paketu **************************************

# Oznaceni paketu dle cilove IP adresy

$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -j ACCEPT

$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -d $USER1 -j MARK --set-mark 1
$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -d $USER2 -j MARK --set-mark 2
$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -d $USER3 -j MARK --set-mark 3
$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -d $USER4 -j MARK --set-mark 4
$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -d $USER5 -j MARK --set-mark 5
$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -d $USER6 -j MARK --set-mark 6
$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -d $USER7 -j MARK --set-mark 7
$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -d $USER8 -j MARK --set-mark 8
$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -d $USER9 -j MARK --set-mark 9
$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -d $USER10 -j MARK --set-mark 10



# Trizeni paketu do pridelenych trid

$TC filter add dev $LAN_IFACE parent 1:0 protocol ip handle 1 fw flowid 1:11
$TC filter add dev $LAN_IFACE parent 1:0 protocol ip handle 2 fw flowid 1:12
$TC filter add dev $LAN_IFACE parent 1:0 protocol ip handle 3 fw flowid 1:13
$TC filter add dev $LAN_IFACE parent 1:0 protocol ip handle 4 fw flowid 1:14
$TC filter add dev $LAN_IFACE parent 1:0 protocol ip handle 5 fw flowid 1:15
$TC filter add dev $LAN_IFACE parent 1:0 protocol ip handle 6 fw flowid 1:16
$TC filter add dev $LAN_IFACE parent 1:0 protocol ip handle 7 fw flowid 1:17
$TC filter add dev $LAN_IFACE parent 1:0 protocol ip handle 8 fw flowid 1:18
$TC filter add dev $LAN_IFACE parent 1:0 protocol ip handle 9 fw flowid 1:19
$TC filter add dev $LAN_IFACE parent 1:0 protocol ip handle 10 fw flowid 1:20















############################## UPLOAD ############################




# Smazani vsech qdiscu na INET interfacu

$TC qdisc del dev $INET_IFACE root >/dev/null



# Pridani ROOT tridy na LAN interface

$TC qdisc add dev $INET_IFACE root handle 1:0 htb default 20


#Nastaveni rychlosti tridy dle rychlosti pripojeno do internetu

$TC class add dev $INET_IFACE parent 1:0 classid 1:1 htb rate $INET_SPEED_UPLOAD burst $BURST



#Nastaveni rychlosti trid na INET rozhrani

$TC class add dev $INET_IFACE parent 1:1 classid 1:11 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 1
$TC class add dev $INET_IFACE parent 1:1 classid 1:12 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 2
$TC class add dev $INET_IFACE parent 1:1 classid 1:13 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 3
$TC class add dev $INET_IFACE parent 1:1 classid 1:14 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 4
$TC class add dev $INET_IFACE parent 1:1 classid 1:15 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 5
$TC class add dev $INET_IFACE parent 1:1 classid 1:16 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 6
$TC class add dev $INET_IFACE parent 1:1 classid 1:17 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 7
$TC class add dev $INET_IFACE parent 1:1 classid 1:18 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 8
$TC class add dev $INET_IFACE parent 1:1 classid 1:19 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 9
$TC class add dev $INET_IFACE parent 1:1 classid 1:20 htb rate $GARANCE1 ceil $MAXIMUM1 burst $BURST #Klient 10











# ******************** Markovani paketu **************************************

# Oznaceni paketu dle cilove IP adresy

$IPTABLES -t mangle -A POSTROUTING -o $LAN_IFACE -j ACCEPT

$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -s $USER1 -j MARK --set-mark 11
$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -s $USER2 -j MARK --set-mark 12
$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -s $USER3 -j MARK --set-mark 13
$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -s $USER4 -j MARK --set-mark 14
$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -s $USER5 -j MARK --set-mark 15
$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -s $USER6 -j MARK --set-mark 16
$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -s $USER8 -j MARK --set-mark 18
$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -s $USER9 -j MARK --set-mark 19
$IPTABLES -t mangle -A PREROUTING -i $LAN_IFACE -s $USER10 -j MARK --set-mark 20



# Trizeni paketu do pridelenych trid

$TC filter add dev $INET_IFACE parent 1:0 protocol ip handle 11 fw flowid 1:11
$TC filter add dev $INET_IFACE parent 1:0 protocol ip handle 12 fw flowid 1:12
$TC filter add dev $INET_IFACE parent 1:0 protocol ip handle 13 fw flowid 1:13
$TC filter add dev $INET_IFACE parent 1:0 protocol ip handle 14 fw flowid 1:14
$TC filter add dev $INET_IFACE parent 1:0 protocol ip handle 15 fw flowid 1:15
$TC filter add dev $INET_IFACE parent 1:0 protocol ip handle 16 fw flowid 1:16
$TC filter add dev $INET_IFACE parent 1:0 protocol ip handle 17 fw flowid 1:17
$TC filter add dev $INET_IFACE parent 1:0 protocol ip handle 18 fw flowid 1:18
$TC filter add dev $INET_IFACE parent 1:0 protocol ip handle 19 fw flowid 1:19
$TC filter add dev $INET_IFACE parent 1:0 protocol ip handle 20 fw flowid 1:20

Nečetl jsem to celé, ale zdá se mi, že jeden jasný problém jsem zachytil: máte tam nejdřív iptables -j ACCEPT, a potom přidáváte pravidla s akcí iptables -j MARK. ACCEPT ale ukončí zpracovávání pravidel v daném chainu, takže na ta další pravidla s označováním paketu už vůbec nedojde.