router uses shaper

[firewall-squeep] / router.sh

diff --git a/router.sh b/router.sh
index 2ff05af1d1e0b5476b393f20c92f4b0097c04b96..b45d988dbb46fd412fc66d4562c037f9d9658d09 100755 (executable)
--- a/router.sh
+++ b/router.sh
@@ -104,83 +104,7 @@ $IP6TABLES -P INPUT DROP
 $IP6TABLES -P OUTPUT DROP
 $IP6TABLES -P FORWARD DROP
 
-# clear and reset traffic control
-(
-set +e
-if $TC qdisc del dev ${EXT_IF}
-then
-       echo "removed existing qdisc"
-else
-       echo "new qdisc"
-fi
-if $TC qdisc add dev ${EXT_IF} root handle 1: htb default 30
-then
-       echo "qdisc root exists"
-else
-       echo "new qdisc root"
-fi
-$TC class add dev ${EXT_IF} parent 1: classid 1:1 htb rate ${UPLINK}kbit burst ${BURST}k
-$TC class add dev ${EXT_IF} parent 1:1 class 1:10 htb rate ${UPLINK}kbit burst ${BURST}k prio 1
-$TC class add dev ${EXT_IF} parent 1:1 class 1:20 htb rate ${UPLINK}kbit burst ${BURST}k prio 2
-$TC class add dev ${EXT_IF} parent 1:1 class 1:30 htb rate $(expr 9 \* ${UPLINK} / 10)kbit burst ${BURST}k prio 3
-$TC class add dev ${EXT_IF} parent 1:1 class 1:40 htb rate $(expr 5 \* ${UPLINK} / 10)kbit burst ${BURST}k prio 4
-$TC class add dev ${EXT_IF} parent 1:1 class 1:50 htb rate $(expr 5 \* ${UPLINK} / 10)kbit burst $(expr 2 \* ${BURST} / 3)k prio 5
-
-for x in $(seq 5)
-do
-       $TC qdisc add dev ${EXT_IF} parent 1:${x}0 handle ${x}0: sfq perturb 10
-       $TC filter add dev ${EXT_IF} parent 1: prio 0 protocol ip handle ${x} fw flowid 1:${x}0
-done
-)
-
-SHAPE_CHAIN='SHAPER-OUT'
-# shaper marking
-$IPTABLES -t mangle -X ${SHAPE_CHAIN}
-$IPTABLES -t mangle -N ${SHAPE_CHAIN}
-$IP6TABLES -t mangle -X ${SHAPE_CHAIN}
-$IP6TABLES -t mangle -N ${SHAPE_CHAIN}
-
-function shape() {
-       local PRIO=$1
-       shift
-       if ! $IPTABLES -t mangle -C ${SHAPE_CHAIN} "$@" -j MARK --set-mark ${PRIO} >/dev/null 2>&1
-       then
-               $IPTABLES -t mangle -A ${SHAPE_CHAIN} "$@" -j MARK --set-mark ${PRIO}
-       fi
-       if ! $IP6TABLES -t mangle -C ${SHAPE_CHAIN} "$@" -j MARK --set-mark ${PRIO} >/dev/null 2>&1
-       then
-               $IP6TABLES -t mangle -A ${SHAPE_CHAIN} "$@" -j MARK --set-mark ${PRIO}
-       fi
-}
-
-# prioritize small and responsive things
-shape 1 -p icmp
-shape 1 -p ipv6-icmp
-shape 1 -p udp
-#shape 1 -p tcp -m length :64
-#shape 1 -p tcp --syn -m length 40:68
-#shape 1 -p tcp --tcp-flags ALL ACK -m length --length 40:100
-shape 1 -p tcp --tcp-flags ALL RST
-shape 1 -p tcp --tcp-flags ALL ACK,RST
-shape 1 -p tcp --tcp-flags ALL ACK,FIN
-
-# favor ssh
-shape 2 -p tcp --dport 22
-
-# defavor ftp
-shape 4 -p tcp --dport 20
-shape 4 -p tcp --dport 115
-
-# bulk bittorrent
-shape 5 -p tcp --dport 8881:8899
-shape 5 -p tcp --sport 8881:8899
-  
-# default everything else to middle
-shape 3 -m mark --mark 0
-
-# tag traffic
-$IPTABLES -t mangle -I POSTROUTING -o ${EXT_IF} -j ${SHAPE_CHAIN}
-
+./shaper.sh ${EXT_IF}
 
 # reserve a special place in hell for some people
 $IPTABLES -N xenophobe