tailieunhanh - Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT, and filter phần 9

Internet giao thông cho người sử dụng # chúng tôi cho phép tối thiểu là 1 / 4 tổng số băng thông cho lưu lượng truy cập internet AC 01:01 classid 1:50 tỷ lệ HTB $ {} kbit ceil $ {BW} kbit PRIO 4 $ AQ 1:50 xử lý 500: pfifo hạn 5 tc lọc thêm dev eth0 ip cha mẹ giao thức 01:00 PRIO 5 u32 phù hợp với ip src $ flowid 01:50 | Medium Networks Case Studies tc class add dev eth0 parent 1 0 classid 1 10 htb rate 100Mbit upload to our network tc class add dev eth0 parent 1 10 classid 1 100 htb rate 96Mbit tc qdisc add dev eth0 parent 1 100 sfq quantum 1514b perturb 15 tc filter add dev eth0 protocol ip parent 1 0 prio 5 u32 match ip dst 24 flowid 1 100 Upload to the internet from the tech department - 2Mbps tc class add dev eth0 parent 1 10 classid 1 200 htb rate 2Mbit tc qdisc add dev eth0 parent 1 200 sfq quantum 1514b perturb 15 tc filter add dev eth0 protocol ip parent 1 0 prio 5 u32 match ip src 29 flowid 1 200 Upload to the internet from the other departments - 2Mbps tc class add dev eth0 parent 1 10 classid 1 300 htb rate 2Mbit tc qdisc add dev eth0 parent 1 300 sfq quantum 1514b perturb 15 tc filter add dev eth0 protocol ip parent 1 0 prio 5 handle 1 fw flowid 1 300 For Eth2 we created the class 1 100 of 98 Mbps and attached a tc filter to match our nfmark 1 which matches all traffic from our network and the internal departments networks. The rest of the traffic going to 29 is internet traffic so the 1 200 class of Eth2 has a 2Mbps limit. The packets that go out of Eth1 are either from our class C 24 or from other hosts on the Internet so we created the 1 100 class of 98Mbps for traffic from our network to the internal departments and the 1 200 class of 2Mbps for internet traffic. The upload is limited on Eth0 for which we created the 96Mbps class 1 100 with a filter to match all packets going to hosts in our network. If packets going out of Eth0 are not destined to 24 then they will not match the 1 100 class and if they are from 29 they will match the 1 200 class of 2Mbps and it means that this is upload traffic from the technical department to the Internet. Traffic going out of Eth0 that is marked with nfmark 1 is from the NATed internal departments and is matched on the 1 300 class of 2Mbps. QoS on the Core Router The core router