#!/bin/sh

# 100MBit/s
#DEV=eth0
#RATE=102400

# 1000MBit/s
#DEV=eth0
#RATE=1024000

# 800KBit/s
DEV=ppp0
RATE=800

FACTOR=85 # 85% der Bandbreite zur Verfuegung stellen
IPTABLES="/usr/sbin/iptables"
IP="/usr/sbin/ip"
TC="/usr/sbin/tc"

RATEUP=$((($RATE * $FACTOR) / 100))

if [ "$1" = "status" ]
then
#        echo "[qdisc]"
#        tc -s qdisc show dev $DEV
#        tc -s qdisc show dev imq0
#        echo "[class]"
#        tc -s class show dev $DEV
#        tc -s class show dev imq0
#        echo "[filter]"
#        tc -s filter show dev $DEV
#        tc -s filter show dev imq0
        echo "[iptables]"
        $IPTABLES -t mangle -L MYSHAPER-OUT -v -x 2> /dev/null
        $IPTABLES -t mangle -L MYSHAPER-IN -v -x 2> /dev/null
        exit
fi

# Reset everything to a known state (cleared)"
$TC qdisc del dev $DEV root    2> /dev/null > /dev/null
$IPTABLES -t mangle -D POSTROUTING -o $DEV -j MYSHAPER-OUT 2> /dev/null > /dev/null
$IPTABLES -t mangle -F MYSHAPER-OUT 2> /dev/null > /dev/null
$IPTABLES -t mangle -X MYSHAPER-OUT 2> /dev/null > /dev/null

if [ "$1" = "stop" ]
then
        echo "Shaping removed on $DEV."
        exit
fi

###########################################################
#
# Outbound Shaping (limits total bandwidth to RATEUP)

# Set queue size to give latency of about 2 seconds on low-prio packets"
$IP link set dev $DEV qlen 30

# changes mtu on the outbound device.  Lowering the mtu will result
# in lower latency but will also cause slightly lower throughput due
# to IP and TCP protocol overhead.
#ip link set dev $DEV mtu 1492

# add HTB root qdisc"
$TC qdisc add dev $DEV root handle 1: htb default 23 r2q 6

# add main rate limit classes"
$TC class add dev $DEV parent 1: classid 1:1 htb rate ${RATEUP}kbit

# add leaf classes - We grant each class at LEAST it's "fair share" of bandwidth."
#                    this way no class will ever be starved by another class.  Each
#                    class is also permitted to consume all of the available bandwidth
#                    if no other classes are in use.
RATEUP7=$(($RATEUP / 7))
$TC class add dev $DEV parent 1:1 classid 1:20 htb rate ${RATEUP7}kbit ceil ${RATEUP}kbit prio 0
$TC class add dev $DEV parent 1:1 classid 1:21 htb rate ${RATEUP7}kbit ceil ${RATEUP}kbit prio 1
$TC class add dev $DEV parent 1:1 classid 1:22 htb rate ${RATEUP7}kbit ceil ${RATEUP}kbit prio 2
$TC class add dev $DEV parent 1:1 classid 1:23 htb rate ${RATEUP7}kbit ceil ${RATEUP}kbit prio 3
$TC class add dev $DEV parent 1:1 classid 1:24 htb rate ${RATEUP7}kbit ceil ${RATEUP}kbit prio 4
$TC class add dev $DEV parent 1:1 classid 1:25 htb rate ${RATEUP7}kbit ceil ${RATEUP}kbit prio 5
$TC class add dev $DEV parent 1:1 classid 1:26 htb rate ${RATEUP7}kbit ceil ${RATEUP}kbit prio 6

# attach qdisc to leaf classes - here we at SFQ to each priority class.  SFQ insures that"
#                                within each class connections will be treated (almost) fairly.
$TC qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10
$TC qdisc add dev $DEV parent 1:21 handle 21: sfq perturb 10
$TC qdisc add dev $DEV parent 1:22 handle 22: sfq perturb 10
$TC qdisc add dev $DEV parent 1:23 handle 23: sfq perturb 10
$TC qdisc add dev $DEV parent 1:24 handle 24: sfq perturb 10
$TC qdisc add dev $DEV parent 1:25 handle 25: sfq perturb 10
$TC qdisc add dev $DEV parent 1:26 handle 26: sfq perturb 10

# filter traffic into classes by fwmark - here we direct traffic into priority class according to
#                                         the fwmark set on the packet (we set fwmark with iptables
#                                         later).  Note that above we've set the default priority
#                                         class to 1:26 so unmarked packets (or packets marked with
#                                         unfamiliar IDs) will be defaulted to the lowest priority
#                                         class.
$TC filter add dev $DEV parent 1:0 prio 0 protocol ip handle 20 fw flowid 1:20
$TC filter add dev $DEV parent 1:0 prio 0 protocol ip handle 21 fw flowid 1:21
$TC filter add dev $DEV parent 1:0 prio 0 protocol ip handle 22 fw flowid 1:22
$TC filter add dev $DEV parent 1:0 prio 0 protocol ip handle 23 fw flowid 1:23
$TC filter add dev $DEV parent 1:0 prio 0 protocol ip handle 24 fw flowid 1:24
$TC filter add dev $DEV parent 1:0 prio 0 protocol ip handle 25 fw flowid 1:25
$TC filter add dev $DEV parent 1:0 prio 0 protocol ip handle 26 fw flowid 1:26

# add MYSHAPER-OUT chain to the mangle table in iptables - this sets up the table we'll use
#                                                      to filter and mark packets.
$IPTABLES -t mangle -N MYSHAPER-OUT
$IPTABLES -t mangle -I POSTROUTING -o $DEV -j MYSHAPER-OUT

# add fwmark entries to classify different types of traffic - Set fwmark from 20-26 according to
#                                                             desired class. 20 is highest prio.

# Prio 0 (Ultra Time critical)
$IPTABLES -t mangle -A MYSHAPER-OUT -p udp --dport 53 -j MARK --set-mark 20                     # DNS
$IPTABLES -t mangle -A MYSHAPER-OUT -p icmp -j MARK --set-mark 20                               # ICMP

# Prio 1 (Time critical)
$IPTABLES -t mangle -A MYSHAPER-OUT -p udp -s ! 192.168.1.1 -j MARK --set-mark 21                # UDP Traffic der User
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp -m tcp --tcp-flags ACK ACK -j MARK --set-mark 21     # TCP ACKs

# Prio 2 (Time critical local Services)
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --dport 22 -j MARK --set-mark 22                     # SSH
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --sport 22 -j MARK --set-mark 22
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --dport 5900 -j MARK --set-mark 22                   # VNC (LAN->WAN)
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --sport 5900 -j MARK --set-mark 22
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --sport 3979 -j MARK --set-mark 22                   # OpenTTD Server
$IPTABLES -t mangle -A MYSHAPER-OUT -p udp --sport 3979 -j MARK --set-mark 22
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --sport 587 -j MARK --set-mark 22                    # OpenVPN Server

# Prio 3 (Network Users)
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --dport 25 -j MARK --set-mark 23                     # SMTP
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --dport 110 -j MARK --set-mark 23                    # POP3
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --dport 80 -j MARK --set-mark 23                     # HTTP
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --dport 443 -j MARK --set-mark 23                    # HTTPS

# Prio 4 (Important local Services and less important Network User Traffic)
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --sport 80 -j MARK --set-mark 24                     # Web-Server
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --dport 21 -j MARK --set-mark 24                     # FTP (LAN->WAN)

# Prio 5 (P2P)
$IPTABLES -t mangle -A MYSHAPER-OUT -m layer7 --l7proto edonkey -j MARK --set-mark 25           # Esel
$IPTABLES -t mangle -A MYSHAPER-OUT -m layer7 --l7proto edonkey-dl -j MARK --set-mark 25
$IPTABLES -t mangle -A MYSHAPER-OUT -m layer7 --l7proto bittorrent -j MARK --set-mark 25

# Prio 6 (Bulk)
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --sport 21 -j MARK --set-mark 26                     # FTP-Server
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --sport 65000:65009 -j MARK --set-mark 26
$IPTABLES -t mangle -A MYSHAPER-OUT -p tcp --sport 873 -j MARK --set-mark 26                    # Rsync-Server
$IPTABLES -t mangle -A MYSHAPER-OUT -p udp --sport 873 -j MARK --set-mark 26

# Rest (Prio 3)
$IPTABLES -t mangle -A MYSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 23                      # Rest

# Done with outbound shaping
#
####################################################

echo "Outbound shaping added to $DEV.  Rate: ${RATEUP}Kbit/sec."