#!/bin/ash
#
# adapted from http://lartc.org/howto/
# adapted by jzaw 04 Aug 2004
# adapted by uncle_ziba from jzaw on Sept 22,2004
# works on Alchemy pre 5.3 with fwbuilder generated policy/nat
# ADSL/Verizon 128k advertised uplink

 
 IPT=/usr/sbin/iptables 
 IP=/usr/sbin/ip 
 TC=/usr/sbin/tc 

# Specify interface device, Queue length, and MTU size 
# ((qlen * mtu) / rate) / 1024 = time 
#DEV=vlan1		# vers 2.x WRT54g h/w
#DEV=eth1		# vers 1.0 1.1 WRT54g h/w
 DEV=ppp0		# dialled via pppoe to my ADSL provider
 OUT_QLEN=30 
#MTU=1500		# need to sort out ... currently jzaws MTU is 1460 

# Set to ~80% of tested maximum bandwidth - jzaw has 256kbit/s trial and error settled on 224k for UPLINK
 UPLINK=112
 P2PC=96 # upload ceiling For p2p stuff

# specify class rates - We grant each class at LEAST its "fair share" of 
# bandwidth. this way no class will ever be starved by another class. 
# these are the minimum guarranteed rates devoted to each class 
# the sum of these should be no more than $UPLINK
 UPLINK_1_R=64  # ssh and other interactive traffic
 UPLINK_2_R=32  # Interactive / control pkts ftp 21 carracho 6700  ssh 22 outbound httpd 80 - allows fast browsing of my server
 UPLINK_3_R=8  # Everything else not other wise specified 
 UPLINK_4_R=8  # P2P bulk data ftp 20 carracho 6701 

# Each class is also permitted to consume all of the available bandwidth 
# if no other classes are in use. 
# these are the max rates permitted for each class 
# set lower rates if you want to cap a particular class
 UPLINK_1_C=${UPLINK} 
 UPLINK_2_C=${UPLINK} 
 UPLINK_3_C=${UPLINK} 
 UPLINK_4_C=${P2PC}

# remove old qdiscs 
 $TC qdisc del dev $DEV root 2> /dev/null > /dev/null 
 $TC qdisc del dev $DEV ingress 2> /dev/null > /dev/null 

# reset iptables rules 
 $IPT -t mangle -D POSTROUTING -o $DEV -j QOS_OUT 
 $IPT -t mangle -F QOS_OUT 
 $IPT -t mangle -X QOS_OUT 
 $IPT -t mangle -F PREROUTING

# mark packets coming from br0
# you may have to comment these out if your br0 packets already marked
 $IPT -t mangle -A PREROUTING -i br0 -j RETURN -m mark ! --mark 0x0
 $IPT -t mangle -A PREROUTING -i br0 -j MARK --set-mark 0x100

# set outgoing queue length 
 $IP link set dev $DEV qlen ${OUT_QLEN} 

# Create HTB root qdisc with an htb default of 40 
 $TC qdisc add dev $DEV root handle 1: htb default 40 

# create main rate limit class 
 $TC class add dev $DEV parent 1: classid 1:1 htb rate ${UPLINK}kbit 

# create leaf rate limit classes 
 $TC class add dev $DEV parent 1:1 classid 1:10 htb rate ${UPLINK_1_R}kbit ceil ${UPLINK_1_C}kbit prio 0 
 $TC class add dev $DEV parent 1:1 classid 1:20 htb rate ${UPLINK_2_R}kbit ceil ${UPLINK_2_C}kbit prio 1 
 $TC class add dev $DEV parent 1:1 classid 1:30 htb rate ${UPLINK_3_R}kbit ceil ${UPLINK_3_C}kbit prio 2 
 $TC class add dev $DEV parent 1:1 classid 1:40 htb rate ${UPLINK_4_R}kbit ceil ${UPLINK_4_C}kbit prio 3 

# attach qdisc to leaf classes - here we at SFQ to each priority class. SFQ 
# insures that within each class connections will be treated (almost) fairly. 
 $TC qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10 
 $TC qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10 
 $TC qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10 
 $TC qdisc add dev $DEV parent 1:40 handle 40: sfq perturb 10 

# add QOS_OUT chain to the mangle table in $IPT - this sets up the table 
# we use to filter and mark packets. 
 $IPT -t mangle -N QOS_OUT 
 $IPT -t mangle -I POSTROUTING -o $DEV -j QOS_OUT 

############################ 
# outgoing ack rule -- for ack packets smaller than 64 bytes
# it must be added using tc filter instead of iptables for now because the 
# length module appears to be broken and/or missing from the wrt54g iptables
# jzaw set ack pkts with top priority ... downloads MUST continue at full speed otherwise set 1:20
 
  $TC filter add dev $DEV parent 1:0 protocol ip prio 1 u32 \
   match ip protocol 6 0xff \
   match u8 0x05 0x0f at 0 \
   match u16 0x0000 0xffc0 at 2 \
   match u8 0x10 0xff at 33 \
   flowid 1:10
#
############################

# SEE LAYER-7 FILTER NEAR EOF

# outgoing VOIP rules - special
# $IPT -t mangle -A QOS_OUT -p tcp --sport 5060:5064 -j CLASSIFY --set-class 1:10 
# $IPT -t mangle -A QOS_OUT -p tcp --dport 5060:5064 -j CLASSIFY --set-class 1:10 
# $IPT -t mangle -A QOS_OUT -p udp --sport 5060:5064 -j CLASSIFY --set-class 1:10 
# $IPT -t mangle -A QOS_OUT -p udp --dport 5060:5064 -j CLASSIFY --set-class 1:10 
  
# defaults for outgoing interactive ports rules 
#
 
# outgoing ftp control rule
 $IPT -t mangle -A QOS_OUT -p tcp --sport 21 -j CLASSIFY --set-class 1:20 
 $IPT -t mangle -A QOS_OUT -p tcp --dport 21 -j CLASSIFY --set-class 1:20
 
# outgoing irc chat rule
 $IPT -t mangle -A QOS_OUT -p tcp --sport 6667 -j CLASSIFY --set-class 1:20 
 $IPT -t mangle -A QOS_OUT -p tcp --dport 6667 -j CLASSIFY --set-class 1:20
 
# outgoing webserver rules and allows my fast browsing
 $IPT -t mangle -A QOS_OUT -p tcp --sport 80 -j CLASSIFY --set-class 1:20 
 $IPT -t mangle -A QOS_OUT -p tcp --dport 80 -j CLASSIFY --set-class 1:20 
 $IPT -t mangle -A QOS_OUT -p tcp --sport 443 -j CLASSIFY --set-class 1:20 
 $IPT -t mangle -A QOS_OUT -p tcp --dport 443 -j CLASSIFY --set-class 1:20 
 $IPT -t mangle -A QOS_OUT -p tcp --sport 8080:8081 -j CLASSIFY --set-class 1:20 
 $IPT -t mangle -A QOS_OUT -p tcp --dport 8080:8081 -j CLASSIFY --set-class 1:20 

# cheap outgoing ping rule 
# we want ICMP unreachables to get out FAST, especially if MTU is < 1500
 $IPT -t mangle -A QOS_OUT -p icmp -j CLASSIFY --set-class 1:10 

# outgoing DNS rule 
 $IPT -t mangle -A QOS_OUT -p udp --dport domain -j CLASSIFY --set-class 1:20 

# outgoing ssh connection rule 
# I really like responsive terminal windows!
 $IPT -t mangle -A QOS_OUT -p tcp --sport ssh -j CLASSIFY --set-class 1:10 
 $IPT -t mangle -A QOS_OUT -p tcp --dport ssh -j CLASSIFY --set-class 1:10 

# outgoing irc dcc connection rule this can give up all is b/w if necessary
 $IPT -t mangle -A QOS_OUT -p tcp --sport 10010:10020 -j CLASSIFY --set-class 1:40 
 $IPT -t mangle -A QOS_OUT -p tcp --dport 10010:10020 -j CLASSIFY --set-class 1:40 
 $IPT -t mangle -A QOS_OUT -p tcp --sport 10110:10120 -j CLASSIFY --set-class 1:40 
 $IPT -t mangle -A QOS_OUT -p tcp --dport 10110:10120 -j CLASSIFY --set-class 1:40 

# outgoing ftp data rule - low prio
 $IPT -t mangle -A QOS_OUT -p tcp --sport 20 -j CLASSIFY --set-class 1:40 
 $IPT -t mangle -A QOS_OUT -p tcp --dport 20 -j CLASSIFY --set-class 1:40
 
# outgoing iChat/AIM rules -- these are close to last b/c they use relatively costly layer 7 matching ---- HI PRIORITY
# these only kick in once the protocol is recognised - takes a moment or two and usually only at the beginign of a stream
# $IPT -t mangle -A QOS_OUT -m layer7 --l7dir /etc/l7-protocols/protocols --l7proto aim -j CLASSIFY --set-class 1:10 

# outgoing bittorrent connection rule this can give up all is b/w if necessary
#$IPT -t mangle -A QOS_OUT -p tcp --sport 6881:6999 -j CLASSIFY --set-class 1:40 
#$IPT -t mangle -A QOS_OUT -p tcp --dport 6881:6999 -j CLASSIFY --set-class 1:40 

# outgoing P2P rules -- these are close to last b/c they use relatively costly layer 7 matching 
# these only kick in once the protocol is recognised - takes a moment or two and usually only at the beginign of a stream
 $IPT -t mangle -A QOS_OUT -m layer7 --l7dir /etc/l7-protocols/protocols --l7proto bittorrent -j CLASSIFY --set-class 1:40 
 
# outgoing default rule - unmarked packets get schleped into second to lowest prio 
 $IPT -t mangle -A QOS_OUT -m mark --mark 0 -j CLASSIFY --set-class 1:30 

# All done, exit ok 
 exit 0