QoS

Aus Gentoo Linux Wiki

Dieser Artikel ist Teil der Security Sammlung.

Firewall • Dienste absichern • Verschlüsselung • alphabetischer Security Index

Index Iptables für Anfänger Iptables für Fortgeschrittene Iptables Installation und Kernelkonfiguration Frontends und andere Tools für Iptables Bandbreitenmanagement mittels Iptables und Tc bearbeiten

---

## Datenraten
DR_MAX="800kbit"
DR_VIP_MAX="800kbit"
DR_VIP_MIN="750kbit"
DR_FAST_MAX="750kbit"
DR_FAST_MIN="500kbit"
DR_SLOW_MAX="500kbit"
DR_SLOW_MIN="300kbit"
DR_SLOWEST_MAX="300kbit"
DR_SLOWEST_MIN="56kbit"

##############################
##### MANGLE POSTROUTING #####

## Pakete markieren für Bandbreitenmanagement

## Standardmarkierung
iptables -t mangle -A POSTROUTING -o ppp0 -j MARK --set-mark 0x3 

## Klassifizierung anhand TOS-Tabelle
iptables -t mangle -A POSTROUTING -o ppp0 -m tos --tos 0x00 -j MARK --set-mark 0x3 #Normal
iptables -t mangle -A POSTROUTING -o ppp0 -m tos --tos 0x02 -j MARK --set-mark 0x3 #Minimale Kosten
iptables -t mangle -A POSTROUTING -o ppp0 -m tos --tos 0x04 -j MARK --set-mark 0x3 #Maximale Zuverlässigkeit
iptables -t mangle -A POSTROUTING -o ppp0 -m tos --tos 0x08 -j MARK --set-mark 0x3 #Maximaler Durchsatz
iptables -t mangle -A POSTROUTING -o ppp0 -m tos --tos 0x10 -j MARK --set-mark 0x1 #Minimale Verzögerung

#tcp/ACK Pakete
iptables -t mangle -A POSTROUTING -o ppp0 -p tcp -m length --length 1:64 -j MARK --set-mark 0x1

#icmp
iptables -t mangle -A POSTROUTING -o ppp0 -p icmp -j MARK --set-mark 0x1

## Klassifizierung anhand Ports
 
#DNS
iptables -t mangle -A POSTROUTING -o ppp0 -p udp --dport 53 -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -p udp --dport 53 -j MARK --set-mark 0x1
 
#FTP
iptables -t mangle -A POSTROUTING -o ppp0 -p tcp --sport 21 -j MARK --set-mark 0x2
iptables -t mangle -A POSTROUTING -o ppp0 -p tcp --dport 21 -j MARK --set-mark 0x2 

## Klassifizierung anhand Layer 7
#games
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto counterstrike-source -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto dayofdefeat-source -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto halflife2-deathmatch -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto quake-halflife -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto quake1 -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto doom3 -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto worldofwarcraft -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto teamspeak -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto ventrilo -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto irc -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto ssh -j MARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto imap -j MARK --set-mark 0x3
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto pop3 -j MARK --set-mark 0x3
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto http -j MARK --set-mark 0x2
iptables -t mangle -A POSTROUTING -o eth0 -m layer7 --l7proto fasttrack -j MARK --set-mark 0x4
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto fasttrack -j MARK --set-mark 0x4
iptables -t mangle -A POSTROUTING -o eth0 -m layer7 --l7proto edonkey -j MARK --set-mark 0x4
iptables -t mangle -A POSTROUTING -o ppp0 -m layer7 --l7proto edonkey -j MARK --set-mark 0x4
 
#################################
##### Bandbreitenmanagement #####

tc qdisc del dev ppp0 root

### root qdisc ###
tc qdisc add dev ppp0 root handle 1: hfsc default 30

### begrenzung bandbreite ausgehend auf maximaler DSL-Upload ###
tc class add dev ppp0 parent 1: classid 1:1 hfsc sc rate $DR_MAX ul rate $DR_MAX

### wichtige Pakete ###
tc class add dev ppp0 parent 1:1 classid 1:2 hfsc sc umax 1488b dmax 30ms rate $DR_VIP_MIN ul rate $DR_VIP_MAX

### weniger wichtige Pakete ###
tc class add dev ppp0 parent 1:1 classid 1:3 hfsc sc rate $DR_FAST_MIN ul rate $DR_FAST_MAX

### weniger unwichtige Pakete ###
tc class add dev ppp0 parent 1:1 classid 1:4 hfsc sc rate $DR_SLOW_MIN ul rate $DR_SLOW_MAX

### unwichtige Pakete ###
tc class add dev ppp0 parent 1:1 classid 1:5 hfsc sc rate $DR_SLOWEST_MIN ul rate $DR_SLOWEST_MAX

### Warteschlangen ###
tc qdisc add dev ppp0 parent 1:2 handle 2: sfq perturb 20
tc qdisc add dev ppp0 parent 1:3 handle 3: sfq perturb 20
tc qdisc add dev ppp0 parent 1:4 handle 4: sfq perturb 20
tc qdisc add dev ppp0 parent 1:5 handle 5: sfq perturb 20

### Filtereinstellungen ###
tc filter add dev ppp0 protocol ip parent 1: prio 1 handle 0x1 fw flowid 1:2
tc filter add dev ppp0 protocol ip parent 1: prio 2 handle 0x2 fw flowid 1:3
tc filter add dev ppp0 protocol ip parent 1: prio 3 handle 0x3 fw flowid 1:4
tc filter add dev ppp0 protocol ip parent 1: prio 4 handle 0x4 fw flowid 1:5