![Tc:入口监管和 ifb 镜像](https://linux22.com/image/572748/Tc%EF%BC%9A%E5%85%A5%E5%8F%A3%E7%9B%91%E7%AE%A1%E5%92%8C%20ifb%20%E9%95%9C%E5%83%8F.png)
我正在尝试在 Linux 网关上设置流量整形写在这里。由于我有多个 LAN 接口,因此需要自定义脚本。因此,为了塑造 LAN 端,我计划创建一个 ifb 伪设备,如下所示:
modprobe ifb
ip link set dev ifb0 up
/sbin/tc qdisc add dev $WAN_INTERFACE ingress
/sbin/tc filter add dev $WAN_INTERFACE parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev ifb0
上面提到的 gist repo 中的脚本有以下几行:
/sbin/tc qdisc add dev $WAN_INTERFACE handle ffff: ingress
/sbin/tc filter add dev $WAN_INTERFACE parent ffff: protocol ip prio 1 u32 match ip sport $INTERACTIVE_PORT 0xffff flowid :1
/sbin/tc filter add dev $WAN_INTERFACE parent ffff: protocol ip prio 1 u32 match ip dport $INTERACTIVE_PORT 0xffff flowid :1
/sbin/tc filter add dev $WAN_INTERFACE parent ffff: protocol ip prio 5 0 u32 match ip src 0.0.0.0/0 police rate $MAX_DOWNRATE_INGRESS burst 20k drop flowid :2
此代码和 ifb 接口创建代码不能很好地协同工作。自定义脚本已执行,但 ifb0 设备未显示任何流量统计数据。如果我注释掉 ingress gist repo 代码(上面引用),则 ifb0 设备会显示传输的数据包数量。此外,这些行不能一起执行:
/sbin/tc qdisc add dev $WAN_INTERFACE ingress
/sbin/tc qdisc add dev $WAN_INTERFACE handle ffff: ingress
我收到文件存在错误。那么,我该如何调整 WAN_INTERFACE 上的入口,同时调整通过 ifb0 设备进入 LAN 的流量?
答案1
IFB 是 tc 过滤器的替代方案,用于处理入口流量,通过将其重定向到虚拟接口并将其视为出口流量。每个物理接口需要一个 ifb 接口,将入口流量从 eth0 重定向到 ifb0、从 eth1 重定向到 ifb1 等等。
插入 ifb 模块时,告诉它您需要的虚拟接口数量。默认值为 2:
modprobe ifb numifbs=1
现在,启用所有 ifb 接口:
ip link set dev ifb0 up # repeat for ifb1, ifb2, ...
并将入口流量从物理接口重定向到相应的 ifb 接口。对于 eth0 -> ifb0:
tc qdisc add dev eth0 handle ffff: ingress
tc filter add dev eth0 parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev ifb0
再次重复上述步骤,eth1 -> ifb1、eth2 -> ifb2 等等,直到覆盖所有想要塑造的接口。
现在,您可以应用所需的所有规则。eth0 的出口规则在 eth0 中照常运行。让我们限制带宽,例如:
tc qdisc add dev eth0 root handle 1: htb default 10
tc class add dev eth0 parent 1: classid 1:1 htb rate 1mbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 1mbit
不用说,对 eth1、eth2 重复...
eth0 的入口规则现在作为 ifb0 上的出口规则(进入 ifb0 的任何东西都必须流出,并且只有 eth0 入口流量才能进入 ifb0)。再次,带宽限制示例:
tc qdisc add dev ifb0 root handle 1: htb default 10
tc class add dev ifb0 parent 1: classid 1:1 htb rate 1mbit
tc class add dev ifb0 parent 1:1 classid 1:10 htb rate 1mbit
这种方法的优点是出口规则比入口过滤器灵活得多。例如,过滤器只允许您丢弃数据包,而不会引入等待时间。通过将入口流量作为出口处理,您可以设置队列规则,包括流量类别和过滤器(如果需要)。您可以访问整个 tc 树,而不仅仅是简单的过滤器。
答案2
根据 Sérgio Carvalho 的回答,我制作了一个小型 bash 脚本来限制带宽:
文件名:netspeed
#!/bin/bash
#USAGE: sudo ./netspeed -l limit_in_kbit -s
usage="sudo $(basename "$0") -l speed_limit -s
-l speed_limit - speed limit with units (eg. 1mbit, 100kbit, more on \`man tc\`)
-s - remove all limits
"
# default values
LIMIT=0
STOP=0
# hardcoded constats
IFACE=ifb0 # fake interface name which will be used for shaping the traffic
NETFACE=wlan0 # interface which in connected to the internet
# shift all required and leave only optional
while getopts ':hl:s' option; do
case "$option" in
l) LIMIT=$OPTARG
;;
s) STOP=1
;;
h) echo "$usage"
exit
;;
esac
done
#
# functions used in script
#
function limitExists { # detected by ingress on $NETFACE qdisc
# -n equals true if non-zero string length
if [[ -n `tc qdisc show | grep "ingress .* $NETFACE"` ]]
then
return 0 # true
else
return 1 # false
fi
}
function ifaceExists {
# -n equals true if non-zero string length
if [[ -n `ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d' | grep $IFACE` ]]
then
return 0 # true
else
return 1 # false
fi
}
function ifaceIsUp {
# -n equals true if non-zero string length
if [[ -n `ifconfig | sed 's/[ \t].*//;/^\(lo\|\)$/d' | grep $IFACE` ]]
then
return 0 # true
else
return 1 # false
fi
}
function createLimit {
#3. redirect ingress
tc qdisc add dev $NETFACE handle ffff: ingress
tc filter add dev $NETFACE parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev $IFACE
#4. apply egress rules to local inteface (like wlan0)
tc qdisc add dev $NETFACE root handle 1: htb default 10
tc class add dev $NETFACE parent 1: classid 1:1 htb rate $LIMIT
tc class add dev $NETFACE parent 1:1 classid 1:10 htb rate $LIMIT
#5. and same for our relaying virtual interfaces (to simulate ingress)
tc qdisc add dev $IFACE root handle 1: htb default 10
tc class add dev $IFACE parent 1: classid 1:1 htb rate $LIMIT
tc class add dev $IFACE parent 1:1 classid 1:10 htb rate $LIMIT
}
function updateLimit {
#3. redirect ingress
tc filter replace dev $NETFACE parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev $IFACE
#4. apply egress rules to local inteface (like wlan0)
tc class replace dev $NETFACE parent 1: classid 1:1 htb rate $LIMIT
tc class replace dev $NETFACE parent 1:1 classid 1:10 htb rate $LIMIT
#5. and same for our relaying virtual interfaces (to simulate ingress)
tc class replace dev $IFACE parent 1: classid 1:1 htb rate $LIMIT
tc class replace dev $IFACE parent 1:1 classid 1:10 htb rate $LIMIT
}
function removeLimit {
if limitExists ; then
tc qdisc del dev $NETFACE ingress
tc qdisc del dev $NETFACE root
tc qdisc del dev $IFACE root
fi
if ifaceIsUp ; then
ip link set dev $IFACE down
fi
}
#
# main script
#
if [[ `whoami` != "root" ]]; then
echo "WARNING: script must be executed with root privileges!"
echo $usage
exit 1
fi
if [ $STOP -eq 1 ]; then
echo "REMOVING limit"
removeLimit
echo "limit REMOVED"
elif [ "$LIMIT" != "0" ]; then
# prepare interface
if ! ifaceExists ; then
echo "CREATING $IFACE by modprobe"
modprobe ifb numifbs=1
if ! ifaceExists ; then
echo "creating $IFACE by modprobe FAILED"
echo "exit with ERROR code 2"
exit 2
fi
fi
# set interface up
if ifaceIsUp ; then
echo "$IFACE is already up"
else
echo "set $IFACE up"
ip link set dev $IFACE up # ( use ifconfig to see results)
if ifaceIsUp ; then
echo "$IFACE is up"
else
echo "enabling $IFACE by ip link FAILED"
echo "exit with ERROR code 3"
exit 3
fi
fi
# create/update limits
if limitExists ; then
echo "update limit"
updateLimit
else
echo "create limit"
createLimit
fi
echo "limit CREATED"
exit 0
else
echo $usage
fi
答案3
您有一个简单的脚本,可以在 Linux 路由器盒中执行传入和传出流量的操作:
https://github.com/rfrail3/misc/blob/master/tc/traffic-control.sh