☰

CentOS 7 上的 OpenVPN 流量控制

tag-icon • tag-icon linux centos openvpn bandwidth traffic-shaping
CentOS 7 上的 OpenVPN 流量控制

我正在尝试为我的 OpenVPN 提供一些带宽限制。例如，我希望为每个用户提供 10Mb/s 的上传和下载速度。我尝试了以下答案（当新用户连接时自动调用脚本并调整连接带宽），但似乎并没有改变限制。

这是我的server.conf：

port 1194
proto udp
dev tun
user openvpn
group nobody
script-security 2
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server_3sO9TzCVUQf73j0R.crt
key server_3sO9TzCVUQf73j0R.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
log /var/log/openvpn.log
verb 3
down-pre
up "/usr/bin/sudo /etc/openvpn/tc.sh"
down "/usr/bin/sudo /etc/openvpn/tc.sh"
client-connect "/usr/bin/sudo /etc/openvpn/tc.sh"
client-disconnect "/usr/bin/sudo /etc/openvpn/tc.sh"

剧本tc.sh：

#!/bin/bash
exec >>/tmp/ov.log 2>&1
chmod 666 /tmp/ov.log 2>/dev/null
echo
date
id
echo "PATH=$PATH"
printenv
TC=$(which tc)
interface="eth0"
interface_speed="100mbit"
client_ip="$trusted_ip"
client_ip_vpn="$ifconfig_pool_remote_ip"
download_limit="10mbit"
upload_limit="10mbit"
handle=`echo "$client_ip_vpn" | cut -d. -f4`

function start_tc {
  tc qdisc show dev $interface | grep -q "qdisc pfifo_fast 0"
  [ "$?" -gt "0" ] && tc qdisc del dev $interface root; sleep 1

  $TC qdisc add dev $interface root handle 1: htb default 30
  $TC class add dev $interface parent 1: classid 1:1 htb rate $interface_speed burst 15k
  $TC class add dev $interface parent 1:1 classid 1:10 htb rate $download_limit burst 15k
  $TC class add dev $interface parent 1:1 classid 1:20 htb rate $upload_limit burst 15k
  $TC qdisc add dev $interface parent 1:10 handle 10: sfq perturb 10
  $TC qdisc add dev $interface parent 1:20 handle 20: sfq perturb 10
}

function stop_tc {
  tc qdisc show dev $interface | grep -q "qdisc pfifo_fast 0"
  [ "$?" -gt "0" ] && tc qdisc del dev $interface root
}

function filter_add {
  $TC filter add dev $interface protocol ip handle ::${handle} parent 1: prio 1 u32 match ip ${1} ${2}/32 flowid 1:${3}
}

function filter_del {
  $TC filter del dev $interface protocol ip handle 800::${handle} parent 1: prio 1 u32
}

function ip_add {
  filter_add "dst" $client_ip_vpn "10"
  filter_add "src" $client_ip_vpn "20"
}

function ip_del {
  filter_del
  filter_del
}

if [ "$script_type" == "up" ]; then
        start_tc
elif [ "$script_type" == "down" ]; then
        stop_tc
elif [ "$script_type" == "client-connect" ]; then
        ip_add
elif [ "$script_type" == "client-disconnect" ]; then
        ip_del
fi

TC的状态（tc -s qdisc ls dev eth0）：

qdisc mq 0: root
 Sent 8177286642 bytes 10438838 pkt (dropped 0, overlimits 0 requeues 6271)
 backlog 0b 0p requeues 6271
qdisc pfifo_fast 0: parent :4 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 1602437629 bytes 2633658 pkt (dropped 0, overlimits 0 requeues 1623)
 backlog 0b 0p requeues 1623
qdisc pfifo_fast 0: parent :3 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 1165086682 bytes 1882591 pkt (dropped 0, overlimits 0 requeues 990)
 backlog 0b 0p requeues 990
qdisc pfifo_fast 0: parent :2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 1060987843 bytes 1677074 pkt (dropped 0, overlimits 0 requeues 657)
 backlog 0b 0p requeues 657
qdisc pfifo_fast 0: parent :1 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 4348774488 bytes 4245515 pkt (dropped 0, overlimits 0 requeues 3001)
 backlog 0b 0p requeues 3001

以下是速度测试： 速度测试

答案1

问题是你控制的是 eth0 接口中的流量，而不是 tun0 接口中的流量。使用 tc 的诀窍是使用 iptables 标记流量并根据用户或流量类型设置 QoS 策略。

相关内容