Re: Marque MARK

Voici le script en question: Je pense qu'il est gros, mais complet.

#!/bin/sh
#
# Control the bandwith management between connections.
# Works in close collaboration with the rc.firewall script, which must
# be called *BEFORE* this one. (because of tagging)
OUTDEV=ppp0

# CLASS1+CLASS2+CLASS3 must equal MAX_UPLOAD_RATE
MAX_UPLOAD_RATE=15kbps
CLASS1=8kbps
CLASS2=4kbps
CLASS3=3kbps

echo Clearing Netfilter rules for mangle table. Also clear counters
iptables -t mangle -F
iptables -t mangle -Z

if ! ifconfig $OUTDEV >/dev/null 2>&1 ; then
echo Cannot find output interface $OUTDEV, delaying a little....
sleep 8
if ! ifconfig $OUTDEV > /dev/null 2>&1 ; then
echo Cannot find output interface $OUTDEV. Abort.
exit 1
fi
fi


echo Clearing the QoS disciplines
tc qdisc del dev $OUTDEV root handle 1: prio bands 3

if [ "1ドル" == "del" ]; then
exit 0
fi

# Setup the flow control.
# This apply to the OUTGOING interface : the cable modem
# We assume that the packets arriving from the net come much slower
# than the internal network, so the output queue on the local
# interface is empty 99.9% of time.
# Here is the schema :
# /------\
# | PRIO |
# \------/
# / | \
# / | \
# 1/ 2| 3\
# / | \
# / | \
# /-------\ /-------\ /------\
# | pfifo | | SFQ | | HTB |
# \-------/ \-------/ \------/
# / | \
# / | \
# 3.1/ 3.2| 3.3\
# / | \
# /-----\ /-----\ /-----\
# | SFQ | | SFQ | | SFQ |
# \-----/ \-----/ \-----/
#
# Links 1, 2, 3 are absolute priorities : No packet comme from 2 or 3 if
# the pipe 1 is not empty.
# Pipe 1 is for UDP DNS request or answers, and TCP ACK or SYN.
# Pipe 2 is for SSH connections and FTP-control
# Pipe 3 is for anything else.
#
# The pipe 3 is classed throught a HTB (Hierarchical Tocken Bucket)
# The classes can share the load between them, BUT, in case of congestion :
# Class 3 is 80% of the traffic : client interactive traffic :
# HTTP, Mail, IRC(both client and server), Webcam
# Class 4 is 10% of the traffic : server traffic :
# HTTP , Mail, Webmin, and FTP (both client and server)
# Class 5 is everything else ( kazaa, edonkey ...)

echo "Tagging packets"

# Class 4 : server : HTTP(80,443), Webmin(10001:10254), FTP(21,20,27000-27999)
# client : FTP_data in Active Mode mode (20)
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 80 -j MARK --set-mark 4
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 443 -j MARK --set-mark 4
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 21 -j MARK --set-mark 4
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 20 -j MARK --set-mark 4
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 27000:27999 -j MARK --set-mark 4
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 10001:10254 -j MARK --set-mark 4
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 20 -j MARK --set-mark 4
# Class 3 : client : HTTP(80,443), Mail(25,110,143,993,1093), IRC(6666,6667),
# ,ICQ(5190/TCP+UDP), Yahoo chat (5050/TCP), news(119)
# FTP_control (21)
# : server : IRC(6667) , Mail(993,25)
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 80 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 443 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 21 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 25 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 143 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 110 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 993 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 1093 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 119 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 6666:6667 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 5190 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --dport 5190 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 5050 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 25 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 993 -j MARK --set-mark 3
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 6667 -j MARK --set-mark 3

# Class 2 : ssh(22)
# Real-time traffic : Yahoo ( 5000/1/TCP, 5000/10/UDP, 5100/TCP)
# NetMeeting ( 1720/TCP, 20200/9/UDP+TCP ) via nmproxy (inetd)
# MSN ( 1863/TCP )
# Roger Wilco ( 3782/1/TCP+UDP ), ASRC ( 3290 TCP+UDP )
# VNC ( 5900/x/TCP , x is the number of simultaneous connection)
# Skype (27614)
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 22 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 22 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 5100 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 1863 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 5000:5001 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --dport 5000:5010 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --dport 3782:3783 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 3782:3783 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --dport 3290 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 3290 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 5900:5902 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 1720 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 1720 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --dport 1720 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --sport 1720 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 20200:20209 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 20200:20209 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --dport 20200:20259 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --sport 20200:20259 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --sport 27614 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --sport 27614 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --dport 27614 -j MARK --set-mark 2
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --dport 27614 -j MARK --set-mark 2

# Class 1 : TCP connection control (ACK,SYN,RST,FIN) , ICMP and DNS(53 UDP)
iptables -A POSTROUTING -t mangle -o $OUTDEV -p udp --dport 53 -j MARK --set-mark 1
iptables -A POSTROUTING -t mangle -o $OUTDEV -p icmp -j MARK --set-mark 1

iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --tcp-flags SYN SYN -j MARK --set-mark 1
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --tcp-flags RST RST -j MARK --set-mark 1
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --tcp-flags FIN FIN -j MARK --set-mark 1
iptables -A POSTROUTING -t mangle -o $OUTDEV -p tcp --tcp-flags ACK ACK -m length --length :74 -j MARK --set-mark 1

echo Adding QoS rules :
echo " Adding root PRIO discipline"
# All packets goes throught the last and default pipe
# The other ones are selected using filters
tc qdisc add dev $OUTDEV root handle 1: prio bands 3 priomap 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2

echo " Adding first level disciplines"
# First pipe is a standard fifo
# Second is a sfq ( for ssh connections )
# Third is a HTB filter, that will be subdivided
tc qdisc add dev $OUTDEV parent 1:1 handle 11: sfq perturb 10
tc qdisc add dev $OUTDEV parent 1:2 handle 12: sfq perturb 10
tc qdisc add dev $OUTDEV parent 1:3 handle 13: htb r2q 1 default 30

echo " Adding HTB Classes"
tc class add dev $OUTDEV parent 13: classid 13:1 htb rate $MAX_UPLOAD_RATE ceil $MAX_UPLOAD_RATE
# All classes could take the whole bandwidth, BUT they are not equal in front of congestion
tc class add dev $OUTDEV parent 13:1 classid 13:10 htb rate $CLASS1 ceil $MAX_UPLOAD_RATE mtu 1492
tc class add dev $OUTDEV parent 13:1 classid 13:20 htb rate $CLASS2 ceil $MAX_UPLOAD_RATE mtu 1492
tc class add dev $OUTDEV parent 13:1 classid 13:30 htb rate $CLASS3 ceil $MAX_UPLOAD_RATE mtu 1492

echo " Adding last level disciplines"
# Finally, the connections selected by the CBQ are delivered with an SFQ discipline
tc qdisc add dev $OUTDEV parent 13:10 handle 131: sfq perturb 10
tc qdisc add dev $OUTDEV parent 13:20 handle 132: sfq perturb 10
tc qdisc add dev $OUTDEV parent 13:30 handle 133: sfq perturb 10

echo Applying tags to QoS filter
# Filter the connections with the tags as key values
tc filter add dev $OUTDEV protocol ip parent 1: handle 1 fw flowid 1:1
tc filter add dev $OUTDEV protocol ip parent 1: handle 2 fw flowid 1:2
tc filter add dev $OUTDEV protocol ip parent 1: handle 3 fw flowid 1:3
tc filter add dev $OUTDEV protocol ip parent 1: handle 4 fw flowid 1:3
tc filter add dev $OUTDEV protocol ip parent 1: handle 5 fw flowid 1:3

tc filter add dev $OUTDEV protocol ip parent 13: handle 3 fw flowid 13:10
tc filter add dev $OUTDEV protocol ip parent 13: handle 4 fw flowid 13:20

export FLOW_CONTROL="Yes"

Le script rc.firewall est:

#!/bin/sh

accept() {
if [ -z "1ドル" -o -z "2ドル" -o -z "3ドル" ] ; then
return 1
fi
if [ ! -z "4ドル" ]; then
dest=2ドル:4ドル
else
dest=2ドル
fi
iptables -t nat -A PREROUTING -i $OUTIF -p 3ドル --dport 1ドル -j DNAT --to-destination $dest
iptables -A FORWARD -i $OUTIF -d 2ドル -p 3ドル --dport 1ドル -j ACCEPT
echo " - Prerouting port 1ドル to $dest ( 3ドル )"
}

accept() {
if [ -z "1ドル" -o -z "2ドル" ] ; then
return 1
fi
iptables -A INPUT -p 2ドル --dport 1ドル -j ACCEPT
echo " - Accepting port 1ドル ( 2ドル )"
}

output() {
if [ -z "1ドル" -o -z "2ドル" ] ; then
return 1
fi
iptables -A OUTPUT -p 2ドル --dport 1ドル -j ACCEPT
iptables -A FORWARD -o $OUTIF -p 2ドル --dport 1ドル -j ACCEPT
echo " - Output port 1ドル ( 2ドル )"
}
OUTIF=ppp0

echo "Firewall configuration :"
echo " - Loading modules"
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ip_queue

echo " - Locking mac addresses"
arp -f

echo " - Clearing rules"
# Clear rules and set default policies
iptables -F
iptables -t nat -F
iptables -t mangle -F

echo " - Setting default policies"
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

echo " - Setting internal network authorizations"
iptables -A INPUT -i lo -j ACCEPT

echo " - Setting default rules for masquerading and state control"

iptables -t nat -A POSTROUTING -o $OUTIF -j MASQUERADE
# ICMP are accepted. Floodping is avoid by icmp_ratelimit below
iptables -A INPUT -p icmp -j ACCEPT
# This ignore any packets in the NEW or INVALID state
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# This analysis any opening connection and close it immediatly if PG says so.
# (Warning, MoBlock must be running).
#iptables -A INPUT -i $OUTIF -m state --state NEW -j QUEUE
#iptables -A OUTPUT -o $OUTIF -m state --state NEW -j QUEUE

echo " - Starting services authorizations"
# DNS
accept 53 udp

# SSH
accept 22 tcp

# FTP
accept 21 tcp
accept 27000:27999 tcp

# Yahoo messenger webcam & audio redirection to Baileys
accept 5100:5110 tcp
accept 5000:5010 udp

# Skype network incoming
accept 27614 tcp
accept 27614 udp

# Peer to peer
# Bittorrent, non-default port
accept 45291:45293 tcp

# Donkey , non default ports
accept 64662 tcp
accept 64672 udp

echo " - Setting various kernel parameters to counter DoS"
#### Prevent various DoS conditions
# Turn off ECN since it brings problems with some sites
echo 0 > /proc/sys/net/ipv4/tcp_ecn
# Turn on TCP_SYNCOOKIES (avoid total DoS when under attack)
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# Set various icmp protections
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 100 > /proc/sys/net/ipv4/icmp_ratelimit
# Augment the number or connectection tracking to keep in table
echo 250000 > /proc/sys/net/ipv4/ip_conntrack_max

Voila !