#!/bin/bash
#shell by vqiu
#blog:http://blog.163.com/qiushuhui1989@126

IP=/sbin/iptables
NET=172.16.10.0/24
TC=/sbin/tc
WAN=eth0
LAN=eth1


$IP -F
$IP -X
$IP -Z

$IP -A INPUT -p tcp --dport 22 -j ACCEPT

$IP -t nat -F
$IP -t nat -Z
$IP -t nat -X

$IP -t nat -A POSTROUTING -s $NET -o eth0 -j MASQUERADE




$IP -t mangle -F
$IP -t mangle -Z
$IP -t mangle -X
#down mark prio 1
$IP -t mangle -A FORWARD -d $NET -p udp --sport 53 -j MARK --set-mark 11
$IP -t mangle -A FORWARD -d $NET -p udp --sport 53 -j RETURN
$IP -t mangle -A FORWARD -d $NET -p tcp --sport 53 -j MARK --set-mark 11
$IP -t mangle -A FORWARD -d $NET -p tcp --sport 53 -j RETURN
$IP -t mangle -A FORWARD -d $NET -p icmp -j MARK --set-mark 11
$IP -t mangle -A FORWARD -d $NET -p icmp -j RETURN
$IP -t mangle -A FORWARD -d $NET -p gre -j MARK --set-mark 11
$IP -t mangle -A FORWARD -d $NET -p gre -j RETURN
#down mark prio 3
$IP -t mangle -A FORWARD -d $NET -p tcp -m multiport --sport 22,25,110,143 -j MARK --set-mark 13
$IP -t mangle -A FORWARD -d $NET -p tcp -m multiport --sport 22,25,110,143 -j RETURN
$IP -t mangle -A FORWARD -d $NET -p udp -m multiport --sport 8000 -j MARK --set-mark 13
$IP -t mangle -A FORWARD -d $NET -p udp -m multiport --sport 8000 -j RETURN
#down mark prio 4
$IP -t mangle -A FORWARD -d $NET -p tcp -m multiport --sport 80,443 -j MARK --set-mark 14
$IP -t mangle -A FORWARD -d $NET -p tcp -m multiport --sport 80,443 -j RETURN
#down mark prio 7
$IP -t mangle -A FORWARD -d $NET -j MARK --set-mark 17
$IP -t mangle -A FORWARD -d $NET -j RETURN


#Fulsh root queue
$TC qdisc del dev $LAN root 
#Create root
$TC qdisc add dev $LAN root handle 1: htb
#total rate
$TC class add dev $LAN parent 1: classid 1:1 htb rate 12mbit ceil 12mbit
#dns&ICMP&PPTP
$TC class add dev $LAN parent 1:1 classid 1:10 htb rate 1mbit ceil 4mbit prio 1
#MAIL&ICMP
$TC class add dev $LAN parent 1:1 classid 1:20 htb rate 2mbit ceil 8mbit prio 3
#HTTP
$TC class add dev $LAN parent 1:1 classid 1:30 htb rate 4mbit ceil 10mbit prio 4
#OTH
$TC class add dev $LAN parent 1:1 classid 1:40 htb rate 4mbit ceil 10mbit prio 7

#add sfq
$TC qdisc add dev $LAN parent 1:10 handle 11: sfq quantum 1500b perturb 10
$TC qdisc add dev $LAN parent 1:20 handle 13: sfq quantum 1500b perturb 10
$TC qdisc add dev $LAN parent 1:30 handle 14: sfq quantum 1500b perturb 10
$TC qdisc add dev $LAN parent 1:40 handle 17: sfq quantum 1500b perturb 10

$TC filter add dev $LAN parent 1: protocol ip prio 1 handle 11 fw classid 1:10
$TC filter add dev $LAN parent 1: protocol ip prio 3 handle 13 fw classid 1:20
$TC filter add dev $LAN parent 1: protocol ip prio 4 handle 14 fw classid 1:30
$TC filter add dev $LAN parent 1: protocol ip prio 7 handle 17 fw classid 1:40


#....................................up......................................
#up mark prio 1
$IP -t mangle -A FORWARD -s $NET -p udp --dport 53 -j MARK --set-mark 21
$IP -t mangle -A FORWARD -s $NET -p udp --dport 53 -j RETURN
$IP -t mangle -A FORWARD -s $NET -p tcp --dport 53 -j MARK --set-mark 21
$IP -t mangle -A FORWARD -s $NET -p tcp --dport 53 -j RETURN
$IP -t mangle -A FORWARD -s $NET -p icmp -j MARK --set-mark 21
$IP -t mangle -A FORWARD -s $NET -p icmp -j RETURN
$IP -t mangle -A FORWARD -s $NET -p gre -j MARK --set-mark 21
$IP -t mangle -A FORWARD -s $NET -p gre -j RETURN
#up mark prio 3
$IP -t mangle -A FORWARD -s $NET -p tcp -m multiport --dport 22,25,110,143 -j MARK --set-mark 23
$IP -t mangle -A FORWARD -s $NET -p tcp -m multiport --dport 22,25,110,143 -j RETURN
$IP -t mangle -A FORWARD -s $NET -p udp -m multiport --dport 8000 -j MARK --set-mark 23
$IP -t mangle -A FORWARD -s $NET -p udp -m multiport --dport 8000 -j RETURN
#up mark prio 4
$IP -t mangle -A FORWARD -s $NET -p tcp -m multiport --dport 80,443 -j MARK --set-mark 24
$IP -t mangle -A FORWARD -s $NET -p tcp -m multiport --dport 80,443 -j RETURN
#up mark prio 7
$IP -t mangle -A FORWARD -s $NET -j MARK --set-mark 27
$IP -t mangle -A FORWARD -s $NET -j RETURN

#Fulsh root queue
$TC qdisc del dev $WAN root
#Create root
$TC qdisc add dev $WAN root handle 2: htb
#total rate
$TC class add dev $WAN parent 2: classid 2:1 htb rate 12mbit ceil 12mbit
#dns&ICMP&PPTP
$TC class add dev $WAN parent 2:1 classid 2:10 htb rate 1mbit ceil 4mbit prio 1
#MAIL&ICMP
$TC class add dev $WAN parent 2:1 classid 2:20 htb rate 2mbit ceil 8mbit prio 3
#HTTP
$TC class add dev $WAN parent 2:1 classid 2:30 htb rate 4mbit ceil 10mbit prio 4
#OTH
$TC class add dev $WAN parent 2:1 classid 2:40 htb rate 4mbit ceil 10mbit prio 7

#add sfq
$TC qdisc add dev $WAN parent 2:10 handle 21: sfq quantum 1500b perturb 10
$TC qdisc add dev $WAN parent 2:20 handle 23: sfq quantum 1500b perturb 10
$TC qdisc add dev $WAN parent 2:30 handle 24: sfq quantum 1500b perturb 10
$TC qdisc add dev $WAN parent 2:40 handle 27: sfq quantum 1500b perturb 10

$TC filter add dev $WAN parent 2: protocol ip prio 1 handle 21 fw classid 2:10
$TC filter add dev $WAN parent 2: protocol ip prio 3 handle 23 fw classid 2:20
$TC filter add dev $WAN parent 2: protocol ip prio 4 handle 24 fw classid 2:30
$TC filter add dev $WAN parent 2: protocol ip prio 7 handle 27 fw classid 2:40