Hi List,
I provided myself the following rule with mastershaper.
With load the rules all connections are blocked.
Kernel 2.6.19
Iptables 1.3.8
l7-filter
ip2route
ipp2p
All kernelmodule is loaded
Why?
Thank you for each assistance
Stefan
Chain PREROUTING (policy ACCEPT 2922 packets, 883K bytes)
pkts bytes target prot opt in out source
destination
1257 101K ms-prerouting all -- * * 0.0.0.0/0
0.0.0.0/0
Chain INPUT (policy ACCEPT 1851 packets, 708K bytes)
pkts bytes target prot opt in out source
destination
Chain FORWARD (policy ACCEPT 2342 packets, 279K bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 600 packets, 605K bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 2925 packets, 883K bytes)
pkts bytes target prot opt in out source
destination
1105 79454 ms-all-chains all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-out eth1
146 16690 ms-all-chains all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-out eth0
Chain ms-all (2 references)
pkts bytes target prot opt in out source
destination
0 0 MARK all -- * * 0.0.0.0/0
192.168.100.0/24 PHYSDEV match --physdev-in eth0 MARK set 0x78512774
0 0 RETURN all -- * * 0.0.0.0/0
192.168.100.0/24 PHYSDEV match --physdev-in eth0
1105 79454 MARK all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth0 MARK set 0x537c74b1
1105 79454 RETURN all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth0
0 0 MARK all -- * * 192.168.100.0/24
0.0.0.0/0 PHYSDEV match --physdev-in eth1 MARK set 0xc0ed4017
0 0 RETURN all -- * * 192.168.100.0/24
0.0.0.0/0 PHYSDEV match --physdev-in eth1
146 16690 MARK all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth1 MARK set 0xebc013d6
146 16690 RETURN all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth1
Chain ms-all-chains (2 references)
pkts bytes target prot opt in out source
destination
0 0 ms-chain-eth1-1:11 all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK match 0x78512774
1105 79454 ms-chain-eth1-1:21 all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK match 0x537c74b1
0 0 ms-chain-eth0-1:11 all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK match 0xc0ed4017
146 16690 ms-chain-eth0-1:21 all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK match 0xebc013d6
Chain ms-chain-eth0-1:11 (1 references)
pkts bytes target prot opt in out source
destination
Chain ms-chain-eth0-1:21 (1 references)
pkts bytes target prot opt in out source
destination
0 0 CLASSIFY udp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 5008,5009 CLASSIFY set 1:22
0 0 RETURN udp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 5008,5009
0 0 CLASSIFY tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 20,21,80,443 CLASSIFY set 1:23
0 0 RETURN tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 20,21,80,443
146 16690 CLASSIFY all -- * * 0.0.0.0/0
0.0.0.0/0 CLASSIFY set 1:299
146 16690 RETURN all -- * * 0.0.0.0/0
0.0.0.0/0
Chain ms-chain-eth1-1:11 (1 references)
pkts bytes target prot opt in out source
destination
Chain ms-chain-eth1-1:21 (1 references)
pkts bytes target prot opt in out source
destination
0 0 CLASSIFY udp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 5008,5009 CLASSIFY set 1:22
0 0 RETURN udp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 5008,5009
0 0 CLASSIFY tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 20,21,80,443 CLASSIFY set 1:23
0 0 RETURN tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 20,21,80,443
1105 79454 CLASSIFY all -- * * 0.0.0.0/0
0.0.0.0/0 CLASSIFY set 1:299
1105 79454 RETURN all -- * * 0.0.0.0/0
0.0.0.0/0
Chain ms-prerouting (1 references)
pkts bytes target prot opt in out source
destination
1257 101K CONNMARK all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK restore
1105 79454 ms-all all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth0
146 16690 ms-all all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth1
1257 101K CONNMARK all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK save
/sbin/tc qdisc add dev eth1 handle 1: root hfsc default 1
/sbin/iptables -t mangle -N ms-all
/sbin/iptables -t mangle -N ms-all-chains
/sbin/iptables -t mangle -N ms-prerouting
/sbin/iptables -t mangle -A PREROUTING -j ms-prerouting
/sbin/iptables -t mangle -A ms-prerouting -j CONNMARK --restore-mark
/sbin/iptables -t mangle -A ms-prerouting -m physdev --physdev-in eth0
-j ms-all
/sbin/iptables -t mangle -A POSTROUTING -m physdev --physdev-out eth1 -j
ms-all-chains
/sbin/tc class add dev eth1 parent 1: classid 1:1 hfsc sc rate
102400Kbit ul rate 102400Kbit
/sbin/tc filter add dev eth1 parent 1:0 protocol all u32 match u32 0 0
classid 1:1
######### Incoming Rules
######### chain DMZ-ignore
/sbin/iptables -t mangle -N ms-chain-eth1-1:11
/sbin/iptables -t mangle -A ms-all-chains -m connmark --mark 0x78512774
-j ms-chain-eth1-1:11
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth0 -d
192.168.100.0/24 -j MARK --set-mark 0x78512774
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth0 -d
192.168.100.0/24 -j RETURN
######### chain WAN
/sbin/tc class add dev eth1 parent 1:1 classid 1:21 hfsc sc rate
2048Kbit rt rate 2048Kbit
/sbin/iptables -t mangle -N ms-chain-eth1-1:21
/sbin/iptables -t mangle -A ms-all-chains -m connmark --mark 0x537c74b1
-j ms-chain-eth1-1:21
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth0 -j MARK
--set-mark 0x537c74b1
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth0 -j
RETURN
######### generating pipes for WAN
######### pipe VoIP-Traffic
/sbin/tc class add dev eth1 parent 1:21 classid 1:22 hfsc sc umax 1500b
dmax 100ms rate 368Kbit ul rate 760Kbit rt umax 1500b dmax 100ms rate
368Kbit ul rate 760Kbit
/sbin/tc qdisc add dev eth1 handle 22: parent 1:22 hfsc
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -p 17 -m multiport --port
5008,5009 -j CLASSIFY --set-class 1:22
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -p 17 -m multiport --port
5008,5009 -j RETURN
######### pipe Web-Traffic
/sbin/tc class add dev eth1 parent 1:21 classid 1:23 hfsc sc umax 1500b
dmax 250ms rate 128Kbit ul rate 256Kbit rt umax 1500b dmax 250ms rate
128Kbit ul rate 256Kbit
/sbin/tc qdisc add dev eth1 handle 23: parent 1:23 hfsc
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -p 6 -m multiport --port
20,21,80,443 -j CLASSIFY --set-class 1:23
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -p 6 -m multiport --port
20,21,80,443 -j RETURN
/sbin/tc class add dev eth1 parent 1:21 classid 1:299 hfsc sc rate
256Kbit ul rate 10240Kbit rt rate 256Kbit ul rate 10240Kbit
/sbin/tc qdisc add dev eth1 handle 299: parent 1:299 hfsc
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -j CLASSIFY --set-class
1:299
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -j RETURN
/sbin/tc qdisc add dev eth0 handle 1: root hfsc default 1
/sbin/iptables -t mangle -A ms-prerouting -m physdev --physdev-in eth1
-j ms-all
/sbin/iptables -t mangle -A POSTROUTING -m physdev --physdev-out eth0 -j
ms-all-chains
/sbin/tc class add dev eth0 parent 1: classid 1:1 hfsc sc rate
102400Kbit ul rate 102400Kbit
/sbin/tc filter add dev eth0 parent 1:0 protocol all u32 match u32 0 0
classid 1:1
######### Outgoing Rules
######### chain DMZ-ignore
/sbin/iptables -t mangle -N ms-chain-eth0-1:11
/sbin/iptables -t mangle -A ms-all-chains -m connmark --mark 0xc0ed4017
-j ms-chain-eth0-1:11
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth1 -s
192.168.100.0/24 -j MARK --set-mark 0xc0ed4017
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth1 -s
192.168.100.0/24 -j RETURN
######### chain WAN
/sbin/tc class add dev eth0 parent 1:1 classid 1:21 hfsc sc rate
2048Kbit rt rate 2048Kbit
/sbin/iptables -t mangle -N ms-chain-eth0-1:21
/sbin/iptables -t mangle -A ms-all-chains -m connmark --mark 0xebc013d6
-j ms-chain-eth0-1:21
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth1 -j MARK
--set-mark 0xebc013d6
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth1 -j
RETURN
######### generating pipes for WAN
######### pipe VoIP-Traffic
/sbin/tc class add dev eth0 parent 1:21 classid 1:22 hfsc sc umax 1500b
dmax 100ms rate 368Kbit ul rate 760Kbit rt umax 1500b dmax 100ms rate
368Kbit ul rate 760Kbit
/sbin/tc qdisc add dev eth0 handle 22: parent 1:22 hfsc
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -p 17 -m multiport --port
5008,5009 -j CLASSIFY --set-class 1:22
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -p 17 -m multiport --port
5008,5009 -j RETURN
######### pipe Web-Traffic
/sbin/tc class add dev eth0 parent 1:21 classid 1:23 hfsc sc umax 1500b
dmax 250ms rate 128Kbit ul rate 256Kbit rt umax 1500b dmax 250ms rate
128Kbit ul rate 256Kbit
/sbin/tc qdisc add dev eth0 handle 23: parent 1:23 hfsc
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -p 6 -m multiport --port
20,21,80,443 -j CLASSIFY --set-class 1:23
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -p 6 -m multiport --port
20,21,80,443 -j RETURN
/sbin/tc class add dev eth0 parent 1:21 classid 1:299 hfsc sc rate
256Kbit ul rate 10240Kbit rt rate 256Kbit ul rate 10240Kbit
/sbin/tc qdisc add dev eth0 handle 299: parent 1:299 hfsc
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -j CLASSIFY --set-class
1:299
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -j RETURN
/sbin/iptables -t mangle -A ms-prerouting -j CONNMARK --save-mark
I provided myself the following rule with mastershaper.
With load the rules all connections are blocked.
Kernel 2.6.19
Iptables 1.3.8
l7-filter
ip2route
ipp2p
All kernelmodule is loaded
Why?
Thank you for each assistance
Stefan
Chain PREROUTING (policy ACCEPT 2922 packets, 883K bytes)
pkts bytes target prot opt in out source
destination
1257 101K ms-prerouting all -- * * 0.0.0.0/0
0.0.0.0/0
Chain INPUT (policy ACCEPT 1851 packets, 708K bytes)
pkts bytes target prot opt in out source
destination
Chain FORWARD (policy ACCEPT 2342 packets, 279K bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 600 packets, 605K bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 2925 packets, 883K bytes)
pkts bytes target prot opt in out source
destination
1105 79454 ms-all-chains all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-out eth1
146 16690 ms-all-chains all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-out eth0
Chain ms-all (2 references)
pkts bytes target prot opt in out source
destination
0 0 MARK all -- * * 0.0.0.0/0
192.168.100.0/24 PHYSDEV match --physdev-in eth0 MARK set 0x78512774
0 0 RETURN all -- * * 0.0.0.0/0
192.168.100.0/24 PHYSDEV match --physdev-in eth0
1105 79454 MARK all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth0 MARK set 0x537c74b1
1105 79454 RETURN all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth0
0 0 MARK all -- * * 192.168.100.0/24
0.0.0.0/0 PHYSDEV match --physdev-in eth1 MARK set 0xc0ed4017
0 0 RETURN all -- * * 192.168.100.0/24
0.0.0.0/0 PHYSDEV match --physdev-in eth1
146 16690 MARK all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth1 MARK set 0xebc013d6
146 16690 RETURN all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth1
Chain ms-all-chains (2 references)
pkts bytes target prot opt in out source
destination
0 0 ms-chain-eth1-1:11 all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK match 0x78512774
1105 79454 ms-chain-eth1-1:21 all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK match 0x537c74b1
0 0 ms-chain-eth0-1:11 all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK match 0xc0ed4017
146 16690 ms-chain-eth0-1:21 all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK match 0xebc013d6
Chain ms-chain-eth0-1:11 (1 references)
pkts bytes target prot opt in out source
destination
Chain ms-chain-eth0-1:21 (1 references)
pkts bytes target prot opt in out source
destination
0 0 CLASSIFY udp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 5008,5009 CLASSIFY set 1:22
0 0 RETURN udp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 5008,5009
0 0 CLASSIFY tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 20,21,80,443 CLASSIFY set 1:23
0 0 RETURN tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 20,21,80,443
146 16690 CLASSIFY all -- * * 0.0.0.0/0
0.0.0.0/0 CLASSIFY set 1:299
146 16690 RETURN all -- * * 0.0.0.0/0
0.0.0.0/0
Chain ms-chain-eth1-1:11 (1 references)
pkts bytes target prot opt in out source
destination
Chain ms-chain-eth1-1:21 (1 references)
pkts bytes target prot opt in out source
destination
0 0 CLASSIFY udp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 5008,5009 CLASSIFY set 1:22
0 0 RETURN udp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 5008,5009
0 0 CLASSIFY tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 20,21,80,443 CLASSIFY set 1:23
0 0 RETURN tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport ports 20,21,80,443
1105 79454 CLASSIFY all -- * * 0.0.0.0/0
0.0.0.0/0 CLASSIFY set 1:299
1105 79454 RETURN all -- * * 0.0.0.0/0
0.0.0.0/0
Chain ms-prerouting (1 references)
pkts bytes target prot opt in out source
destination
1257 101K CONNMARK all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK restore
1105 79454 ms-all all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth0
146 16690 ms-all all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in eth1
1257 101K CONNMARK all -- * * 0.0.0.0/0
0.0.0.0/0 CONNMARK save
/sbin/tc qdisc add dev eth1 handle 1: root hfsc default 1
/sbin/iptables -t mangle -N ms-all
/sbin/iptables -t mangle -N ms-all-chains
/sbin/iptables -t mangle -N ms-prerouting
/sbin/iptables -t mangle -A PREROUTING -j ms-prerouting
/sbin/iptables -t mangle -A ms-prerouting -j CONNMARK --restore-mark
/sbin/iptables -t mangle -A ms-prerouting -m physdev --physdev-in eth0
-j ms-all
/sbin/iptables -t mangle -A POSTROUTING -m physdev --physdev-out eth1 -j
ms-all-chains
/sbin/tc class add dev eth1 parent 1: classid 1:1 hfsc sc rate
102400Kbit ul rate 102400Kbit
/sbin/tc filter add dev eth1 parent 1:0 protocol all u32 match u32 0 0
classid 1:1
######### Incoming Rules
######### chain DMZ-ignore
/sbin/iptables -t mangle -N ms-chain-eth1-1:11
/sbin/iptables -t mangle -A ms-all-chains -m connmark --mark 0x78512774
-j ms-chain-eth1-1:11
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth0 -d
192.168.100.0/24 -j MARK --set-mark 0x78512774
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth0 -d
192.168.100.0/24 -j RETURN
######### chain WAN
/sbin/tc class add dev eth1 parent 1:1 classid 1:21 hfsc sc rate
2048Kbit rt rate 2048Kbit
/sbin/iptables -t mangle -N ms-chain-eth1-1:21
/sbin/iptables -t mangle -A ms-all-chains -m connmark --mark 0x537c74b1
-j ms-chain-eth1-1:21
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth0 -j MARK
--set-mark 0x537c74b1
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth0 -j
RETURN
######### generating pipes for WAN
######### pipe VoIP-Traffic
/sbin/tc class add dev eth1 parent 1:21 classid 1:22 hfsc sc umax 1500b
dmax 100ms rate 368Kbit ul rate 760Kbit rt umax 1500b dmax 100ms rate
368Kbit ul rate 760Kbit
/sbin/tc qdisc add dev eth1 handle 22: parent 1:22 hfsc
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -p 17 -m multiport --port
5008,5009 -j CLASSIFY --set-class 1:22
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -p 17 -m multiport --port
5008,5009 -j RETURN
######### pipe Web-Traffic
/sbin/tc class add dev eth1 parent 1:21 classid 1:23 hfsc sc umax 1500b
dmax 250ms rate 128Kbit ul rate 256Kbit rt umax 1500b dmax 250ms rate
128Kbit ul rate 256Kbit
/sbin/tc qdisc add dev eth1 handle 23: parent 1:23 hfsc
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -p 6 -m multiport --port
20,21,80,443 -j CLASSIFY --set-class 1:23
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -p 6 -m multiport --port
20,21,80,443 -j RETURN
/sbin/tc class add dev eth1 parent 1:21 classid 1:299 hfsc sc rate
256Kbit ul rate 10240Kbit rt rate 256Kbit ul rate 10240Kbit
/sbin/tc qdisc add dev eth1 handle 299: parent 1:299 hfsc
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -j CLASSIFY --set-class
1:299
/sbin/iptables -t mangle -A ms-chain-eth1-1:21 -j RETURN
/sbin/tc qdisc add dev eth0 handle 1: root hfsc default 1
/sbin/iptables -t mangle -A ms-prerouting -m physdev --physdev-in eth1
-j ms-all
/sbin/iptables -t mangle -A POSTROUTING -m physdev --physdev-out eth0 -j
ms-all-chains
/sbin/tc class add dev eth0 parent 1: classid 1:1 hfsc sc rate
102400Kbit ul rate 102400Kbit
/sbin/tc filter add dev eth0 parent 1:0 protocol all u32 match u32 0 0
classid 1:1
######### Outgoing Rules
######### chain DMZ-ignore
/sbin/iptables -t mangle -N ms-chain-eth0-1:11
/sbin/iptables -t mangle -A ms-all-chains -m connmark --mark 0xc0ed4017
-j ms-chain-eth0-1:11
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth1 -s
192.168.100.0/24 -j MARK --set-mark 0xc0ed4017
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth1 -s
192.168.100.0/24 -j RETURN
######### chain WAN
/sbin/tc class add dev eth0 parent 1:1 classid 1:21 hfsc sc rate
2048Kbit rt rate 2048Kbit
/sbin/iptables -t mangle -N ms-chain-eth0-1:21
/sbin/iptables -t mangle -A ms-all-chains -m connmark --mark 0xebc013d6
-j ms-chain-eth0-1:21
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth1 -j MARK
--set-mark 0xebc013d6
/sbin/iptables -t mangle -A ms-all -m physdev --physdev-in eth1 -j
RETURN
######### generating pipes for WAN
######### pipe VoIP-Traffic
/sbin/tc class add dev eth0 parent 1:21 classid 1:22 hfsc sc umax 1500b
dmax 100ms rate 368Kbit ul rate 760Kbit rt umax 1500b dmax 100ms rate
368Kbit ul rate 760Kbit
/sbin/tc qdisc add dev eth0 handle 22: parent 1:22 hfsc
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -p 17 -m multiport --port
5008,5009 -j CLASSIFY --set-class 1:22
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -p 17 -m multiport --port
5008,5009 -j RETURN
######### pipe Web-Traffic
/sbin/tc class add dev eth0 parent 1:21 classid 1:23 hfsc sc umax 1500b
dmax 250ms rate 128Kbit ul rate 256Kbit rt umax 1500b dmax 250ms rate
128Kbit ul rate 256Kbit
/sbin/tc qdisc add dev eth0 handle 23: parent 1:23 hfsc
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -p 6 -m multiport --port
20,21,80,443 -j CLASSIFY --set-class 1:23
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -p 6 -m multiport --port
20,21,80,443 -j RETURN
/sbin/tc class add dev eth0 parent 1:21 classid 1:299 hfsc sc rate
256Kbit ul rate 10240Kbit rt rate 256Kbit ul rate 10240Kbit
/sbin/tc qdisc add dev eth0 handle 299: parent 1:299 hfsc
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -j CLASSIFY --set-class
1:299
/sbin/iptables -t mangle -A ms-chain-eth0-1:21 -j RETURN
/sbin/iptables -t mangle -A ms-prerouting -j CONNMARK --save-mark