#!/bin/bash
internetDev="eth0" # 互联网接口
privateNetDev="switch0" # 私有网络接口
uploadRate="20mbit" # 互联网上行带宽
uploadP2PRate="1mbit" # P2P上行带宽
uploadEmerRate=${uploadRate} # 最低延迟上行带宽
uploadPrioRate=${uploadRate} # 优先传送上行带宽
uploadNormalRate="10mbit" # 普通流量上行带宽
downloadRate="100mbit" # 互联网下行带宽
downloadP2PRate="80mbit" # P2P下行带宽
downloadEmerRate=${downloadRate} # 最低延迟传送下行带宽
downloadPrioRate=${downloadRate} # 优先传送下行带宽
# For QoS, MARK 100
iptables -t mangle -F MARK_100 > /dev/null 2>&1
iptables -t mangle -N MARK_100 > /dev/null 2>&1
iptables -t mangle -A MARK_100 -p udp -m length ! --length 0:1350 -j MARK --set-mark 100
while iptables -t mangle -D PREROUTING -i ${privateNetDev} -j MARK_100 >/dev/null 2>&1; do continue; done
iptables -t mangle -I PREROUTING -i ${privateNetDev} -j MARK_100
tc qdisc del dev ${internetDev} root >/dev/null 2>&1
tc qdisc add dev ${internetDev} root handle 1: htb default 50
tc class add dev ${internetDev} parent 1: classid 1:1 htb rate ${uploadRate}
tc class add dev ${internetDev} parent 1:1 classid 1:100 htb rate ${uploadP2PRate} ceil ${uploadP2PRate} prio 7
tc class add dev ${internetDev} parent 1:1 classid 1:10 htb rate ${uploadEmerRate} prio 0
tc class add dev ${internetDev} parent 1:1 classid 1:20 htb rate ${uploadPrioRate} prio 2
tc class add dev ${internetDev} parent 1:1 classid 1:50 htb rate ${uploadNormalRate} prio 5
tc qdisc add dev ${internetDev} parent 1:100 handle 100: sfq perturb 10
tc qdisc add dev ${internetDev} parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev ${internetDev} parent 1:20 handle 20: sfq perturb 10
tc qdisc add dev ${internetDev} parent 1:50 handle 50: sfq perturb 10
# Match TCP SYN
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 1 u32 \
match u8 0x10 0xff at 33 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match TCP ACK Small Packet (< 64 Bytes)
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 1 u32 \
match u8 0x10 0xff at 33 \
match u8 0x06 0xff at 9 \
match u16 0x0000 0xffc0 at 2 \
flowid 1:10
# Match TCP DESTINATION PORT 22
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0016 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match TCP DESTINATION PORT 23
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0017 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match TCP DESTINATION PORT 25
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0019 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match TCP DESTINATION PORT 53
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0035 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match UDP DESTINATION PORT 53
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0035 0xffff at 22 \
match u8 0x11 0xff at 9 \
flowid 1:10
# Match TCP DESTINATION PORT 80
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0050 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match TCP DESTINATION PORT 443
tc filter add dev ${internetDev} protocol ip parent 1: pref 10 u32 \
match u16 0x01bb 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match UDP DESTINATION PORT 443 (QUIC Protocol)
tc filter add dev ${internetDev} protocol ip parent 1: pref 10 u32 \
match u16 0x01bb 0xffff at 22 \
match u8 0x11 0xff at 9 \
flowid 1:20
# Match TCP DESTINATION PORT 465
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x01d1 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match TCP DESTINATION PORT 993
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x03e1 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match TCP DESTINATION PORT 3306
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0cea 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match TCP DESTINATION PORT 3389
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0d3d 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match UDP DESTINATION PORT 3389
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0d3d 0xffff at 22 \
match u8 0x11 0xff at 9 \
flowid 1:10
# Match UDP DESTINATION PORT 8000 (QQ Port)
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x1f40 0xffff at 22 \
match u8 0x11 0xff at 9 \
flowid 1:10
# Match TCP DESTINATION PORT 8080 (WeChat Port)
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x1f90 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match TCP DESTINATION PORT 9418 (GIT)
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x24ca 0xffff at 22 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Limit UDP Huge Packet Rate
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 20 u32 \
match mark 0x0064 0x00ff \
flowid 1:100
# For QoS, MARK 200
iptables -t mangle -F PRIVATE_NET_MARK_200 >/dev/null 2>&1
iptables -t mangle -N PRIVATE_NET_MARK_200 >/dev/null 2>&1
iptables -t mangle -A PRIVATE_NET_MARK_200 -p tcp -j CONNMARK --restore-mark
iptables -t mangle -A PRIVATE_NET_MARK_200 -m mark --mark 200 -j RETURN
iptables -t mangle -A PRIVATE_NET_MARK_200 -m connlimit --connlimit-above 4 --connlimit-mask 24 --connlimit-saddr -m hashlimit --hashlimit-above 512kb/second --hashlimit-burst 5mb --hashlimit-mode srcip,dstip --hashlimit-dstmask 24 --hashlimit-srcmask 32 --hashlimit-name packetRateLimit -j MARK --set-mark 200
iptables -t mangle -A PRIVATE_NET_MARK_200 -j CONNMARK --save-mark
while iptables -t mangle -D POSTROUTING -o ${privateNetDev} -j PRIVATE_NET_MARK_200 >/dev/null 2>&1; do continue; done
iptables -t mangle -I POSTROUTING -o ${privateNetDev} -j PRIVATE_NET_MARK_200
tc qdisc del dev ${privateNetDev} root >/dev/null 2>&1
tc qdisc add dev ${privateNetDev} root handle 1: htb default 100
tc class add dev ${privateNetDev} parent 1: classid 1:1 htb rate ${downloadRate}
tc class add dev ${privateNetDev} parent 1:1 classid 1:100 htb rate ${downloadP2PRate} ceil ${downloadP2PRate} prio 7
tc class add dev ${privateNetDev} parent 1:1 classid 1:10 htb rate ${downloadEmerRate} prio 0
tc class add dev ${privateNetDev} parent 1:1 classid 1:20 htb rate ${downloadPrioRate} prio 2
tc qdisc add dev ${privateNetDev} parent 1:100 handle 100: sfq perturb 10
tc qdisc add dev ${privateNetDev} parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev ${privateNetDev} parent 1:20 handle 20: sfq perturb 10
# Match TCP SYN ACK
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 1 u32 \
match u8 0x12 0xff at 33 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match TCP ACK Small Packet (< 64 Bytes)
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 1 u32 \
match u8 0x10 0xff at 33 \
match u8 0x06 0xff at 9 \
match u16 0x0000 0xffc0 at 2 \
flowid 1:10
# Match multip thread download
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 5 u32 \
match mark 0x00c8 0x00ff \
flowid 1:100
# Match TCP SOURCE PORT 22
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0016 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match TCP SOURCE PORT 23
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0017 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match TCP SOURCE PORT 25
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0019 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match TCP SOURCE PORT 53
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0035 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match UDP SOURCE PORT 53
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0035 0xffff at 20 \
match u8 0x11 0xff at 9 \
flowid 1:10
# Match TCP SOURCE PORT 80
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0050 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match TCP SOURCE PORT 443
tc filter add dev ${privateNetDev} protocol ip parent 1: pref 10 u32 \
match u16 0x01bb 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match UDP SOURCE PORT 443 (QUIC Protocol)
tc filter add dev ${privateNetDev} protocol ip parent 1: pref 10 u32 \
match u16 0x01bb 0xffff at 20 \
match u8 0x11 0xff at 9 \
flowid 1:20
# Match TCP SOURCE PORT 465
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x01d1 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match TCP SOURCE PORT 993
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x03e1 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match TCP SOURCE PORT 3306
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0cea 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:20
# Match TCP SOURCE PORT 3389
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0d3d 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match UDP SOURCE PORT 3389
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x0d3d 0xffff at 20 \
match u8 0x11 0xff at 9 \
flowid 1:10
# Match UDP SOURCE PORT 8000 (QQ Port)
tc filter add dev ${internetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x1f40 0xffff at 20 \
match u8 0x11 0xff at 9 \
flowid 1:10
# Match TCP SOURCE PORT 8080 (WeChat Port)
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x1f90 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:10
# Match TCP SOURCE PORT 9418 (GIT)
tc filter add dev ${privateNetDev} protocol ip parent 1:0 pref 10 u32 \
match u16 0x24ca 0xffff at 20 \
match u8 0x06 0xff at 9 \
flowid 1:20