I wanted to limit 1 IP on the LAN. I've read and searched for quite some time and the question seemed to asked quite a lot, but the answers are usually quite complex. Complex scripts and the likes. I needed a very simple script for a seemingly simple thing. With big help of xMff on IRC I made the following script, all credit goes to xMff though, he supplied the code, I just made the script around it. This post is just for the archives as the wiki doesn't let me edit/add anything and I'm not a wiki guru.
It should be easy for anyone with some shell scripting experience to make this work and add/remove things as you like. There just one caveat here, I used a fairly non-elegant way to flush the mangle tables from iptables, if you use mangle for anything else please make sure you remove/edit the "iptables- F -t mangle line" from the script. Rates are in kbit.
#!/bin/sh
#
insmod cls_fw >/dev/null 2>&1
insmod cls_u32 >/dev/null 2>&1
insmod sch_htb >/dev/null 2>&1
insmod sch_sfq >/dev/null 2>&1
insmod sch_ingress >/dev/null 2>&1
DEV="br-lan"
CLIENT_MAC=00:11:22:33:44:55
CLIENT_IP=172.16.0.128
LIMIT_DOWN=200
LIMIT_DOWN_BURST=400
LIMIT_UP=400
start() {
tc qdisc del dev "$DEV" root handle 77:
tc qdisc add dev "$DEV" root handle 77: htb
tc class add dev "$DEV" parent 77: classid 77:1 htb rate 20000kbit
tc class add dev "$DEV" parent 77:1 classid 77:10 htb rate ${LIMIT_DOWN}kbit ceil ${LIMIT_DOWN_BURST}kbit prio 2
tc qdisc add dev "$DEV" parent 77:10 handle 78: sfq perturb 10
tc qdisc add dev "$DEV" ingress
tc filter add dev "$DEV" parent 77: protocol ip prio 2 handle 80 fw flowid 77:10
tc filter add dev "$DEV" parent ffff: protocol ip prio 1 handle 79 fw police rate ${LIMIT_UP}kbit mtu 6k burst 6k drop
iptables -t mangle -I PREROUTING -m mac --mac-source $CLIENT_MAC -j MARK --set-mark 79
iptables -t mangle -I POSTROUTING -d $CLIENT_IP -j MARK --set-mark 80
}
stop() {
tc qdisc del dev $DEV root
iptables -F -t mangle
}
restart() {
stop
sleep 1
start
}
show() {
tc -s qdisc ls dev $DEV
}
case "$1" in
start)
echo -n "Starting bandwidth shaping: "
start
echo "done"
;;
stop)
echo -n "Stopping bandwidth shaping: "
stop
echo "done"
;;
restart)
echo -n "Restarting bandwidth shaping: "
restart
echo "done"
;;
show)
echo "Bandwidth shaping status for $IF:"
show
echo ""
;;
*)
pwd=$(pwd)
echo "Usage: tc.bash {start|stop|restart|show}"
;;
esac
exit 0I hope this helps those looking to do the same thing as me; limit a single IP on the LAN when QoS or other measures don't seem to work this may do the job.
Feel free to post your own scripts in this thread, or make the above one even better.
I've tested this script on my Asus WL-500g v2, running Kamikaze v8.09.1. Forum mods, if I posted this in the wrong section please move it to the right place, cheers.
(Last edited by blerk on 22 Jan 2010, 00:04)