Forum Debian Users Gang

http://www.dug.net.pl/texty/htb.pdf

## /etc/niceshaper0.6/config.ns

<global>
    run download upload squid
    mark-on-ifaces eth0 eth1
    #stats file /var/www/stats/nsstats.txt unit kb/s owner root group root mode 644
    lang pl
</global>

<squid>
    iface eth1 match dstip 172.20.0.1/24
    default imq autoredirect false
    section speed 2000kbit
    section shape 1950kbit
    default low 128kbit
    default ceil 1900kbit
    default htb prio 5
    default hold 600s
    default htb scheduler esfq
    default esfq hash dst
    iptables insert-hook POSTROUTING
    reload 1s
</squid>

<download>
    iface imq0 match dstip 172.20.0.0/24
    default imq autoredirect true
    section speed 2000kbit
    section shape 1000kbit
    default low 1kbit
    default ceil 16kbit
    default htb prio 4
    default hold 600s
    default htb scheduler esfq
    default esfq hash dst
    iptables hook POSTROUTING
    reload 4s
</download>

<upload>
    iface imq1 match srcip 172.20.0.0/24
    default imq autoredirect true
    section speed 250kbit
    section shape 245kbit
    default low 16kbit
    default ceil 240kbit
    default htb prio 4
    default hold 600s
    default htb scheduler esfq
    default esfq hash src
    iptables hook PREROUTING
    reload 2s
</upload>

## /etc/niceshaper0.6/class.ns

# Klasy dla Squida
# Zamiast dla kazdego ip osobno mozna dla wszystkich razem tzn:
#
#class squid eth0 squid_Wszys
#    match from localhost srcip 10.10.0.1 dstip 10.10.0.2/27 proto tcp tos 0x8

class squid eth1 kilinskiego17
    match from localhost srcip 172.20.0.40 dstip 172.20.0.1 proto tcp tos 0x8


#Pasmo dla ssh i strony www lokalnie

class download imq0 ssh_www_ping
     match srcip 172.20.0.1 srcport 22 proto tcp dstip 172.20.0.0/24
     match srcip 172.20.0.1 srcport 80 proto tcp dstip 172.20.0.0/24
     match srcip 172.20.0.1 proto icmp dstip 172.20.0.0/24
     rate 512kbit
     wrapper
class upload imq1 ssh_www_ping
     match dstip 172.20.0.1 dstport 22 proto tcp srcip 172.20.0.0/24
     match dstip 172.20.0.1 dstport 80 proto tcp srcip 172.20.0.0/24
     match dstip 172.20.0.1 proto icmp srcip 172.20.0.0/24
     rate 200kbit
     wrapper

# Dodatkowe pasmo dla Skypa znakowanie za pomoca Layer7
# w wersji przykladowej zablokowane :-)
#class download imq0 skype
#    match dstip 10.10.0.0/27 mark 0x998
#    match dstip 10.10.0.0/27 mark 0x999
#     htb prio 3
#     low 128kbit
#     ceil 150kbit
#class upload imq1 skype
#    match srcip 10.10.0.0/27 mark 0x998
#    match srcip 10.10.0.0/27 mark 0x999
#     htb prio 3
#     low 24kbit
#     ceil 150kbit

# Klasy dla downloadu i uploadu zrealizowane na interfejsach wirtualnych

class download imq0 kilinskiego17
    match dstip 172.20.0.40
    ceil 950kbit
class upload imq1 kilinskiego17
    match srcip 172.20.0.40
    ceil 64kbit

iptables -P FORWARD DROP
iptables -A FORWARD -p TCP -m multiport --dports 80,22,443 -j ACCEPT
iptables -A FORWARD -m connlimit ! --connlimit-above 50 -j ACCEPT