☰

如何使用 tc 减慢流量？

tag-icon • tag-icon wireless-networking iptables network-traffic traffic-shaping
如何使用 tc 减慢流量？

我在 Ubuntu 14.04 上；我想学习流量整形的基础知识，我制作了一个简单的脚本，可以减慢到端口 80 和 443 的 HTTP(S) 流量。

# usage: sudo ./filename.sh

#delete existing rules
# wlan0 is my WiFi
tc qdisc del root dev wlan0

iptables -t mangle -F

echo "Setting.."
# Turn on queuing discipline, enter:
tc qdisc add dev wlan0 root handle 1: htb
tc class add dev wlan0 parent 1: classid 1:1 htb rate 512kbps
# Define a class with limitations:
tc class add dev wlan0 parent 1:1 classid 1:5 htb rate 256kbps ceil 312kbps prio 1
# Define another class with limitations:
tc class add dev wlan0 parent 1:1 classid 1:6 htb rate 256kbps ceil 312kbps prio 0
# Assign it to appropriate qdisc:
tc filter add dev wlan0 parent 1:0 prio 1 protocol ip handle 5 fw flowid 1:5
# Assign it to appropriate qdisc:
tc filter add dev wlan0 parent 1:0 prio 0 protocol ip handle 6 fw flowid 1:6
# Port 80 is NOT defined anywhere in above class. You will use iptables mangle rule as follows:
iptables -A FORWARD -t mangle -p tcp --sport 80 -j MARK --set-mark 5
iptables -A OUTPUT -t mangle -p tcp --sport 80 -j MARK --set-mark 5
# Port 443 is NOT defined anywhere in above class. You will use iptables mangle rule as follows:
iptables -A FORWARD -t mangle -p tcp --sport 443 -j MARK --set-mark 6
iptables -A OUTPUT -t mangle -p tcp --sport 443 -j MARK --set-mark 6
iptables-save

输出为

RTNETLINK answers: No such file or directory
Setting..
# Generated by iptables-save v1.4.21 on Wed Sep  7 08:56:25 2016
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A FORWARD -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x5/0xffffffff
-A FORWARD -p tcp -m tcp --dport 443 -j MARK --set-xmark 0x6/0xffffffff
-A OUTPUT -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x5/0xffffffff
-A OUTPUT -p tcp -m tcp --dport 443 -j MARK --set-xmark 0x6/0xffffffff
COMMIT
# Completed on Wed Sep  7 08:56:25 2016

和sudo iptables -t mangle --list：

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
MARK       tcp  --  anywhere             anywhere             tcp dpt:http MARK set 0x5
MARK       tcp  --  anywhere             anywhere             tcp dpt:https MARK set 0x6

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
MARK       tcp  --  anywhere             anywhere             tcp dpt:http MARK set 0x5
MARK       tcp  --  anywhere             anywhere             tcp dpt:https MARK set 0x6

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

但浏览速度似乎仍然很快，Ookla 速度测试显示下载速度仍然超过 20 Mbps，上传速度仍然超过 30 Mbps。

是我做错了什么，还是这个脚本不足以减慢我的连接速度？

答案1

我并不是这方面的专家，但我使用 cbq 时取得了更好的效果（见下文）。此版本会使所有速度变慢，但我更愿意随着时间的推移减慢长时间下载的速度，同时保持交互式浏览速度。我知道我可以使用代理服务器做到这一点，但我想找到一种在此级别上做到这一点的方法。

rate=64kbps   # 64kbps (512 kbit/sec) = 450 Mb/2 hrs, for each IP address
irate=192kbps # 192kbps allows 490 Gb in 31 days, for the whole interface, max 3 simultaneous downloaders

iface=eth0 # LAN address (could be WiFi)
ranges="192.168.201.128/25"     # 192.168.1.128/255.255.255.128, only slow down DHCP dynamic addresses
alg=cbq # cbq or htb

echo "Throttling hotel network..."

# Clear existing
tc qdisc del dev $iface root 2>&1 | grep -v "No such"

# Limit interface rate
tc qdisc add dev $iface handle 1: root $alg avpkt 1000 bandwidth $irate
tc class add dev $iface parent 1: classid 1:1 $alg rate $rate allot 1500 prio 5 bounded isolated
# Limit rate of each IP address
for range in $ranges; do
        echo "$range"
        tc filter add dev $iface parent 1: protocol ip prio 16 u32 match ip dst $range flowid 1:1
        tc filter add dev $iface parent 1: protocol ip prio 16 u32 match ip src $range flowid 1:1
done

相关内容