outbound_shape() {
        # bandwidth
        # Set new traffic shaping configuration for external interface
        ###     $TC qdisc add dev $EXT_IF root tbf rate ${UPLINK}kbit latency 40ms burst $BURST

        #$TC link set dev $EXT_IF qlen 30

        $TC qdisc add dev $EXT_IF handle 10:0 root htb default 32
        $TC class add dev $EXT_IF parent 10:0 classid 1:1 htb rate ${UPLINK_MAX}kbit ceil ${UPLINK_MAX}kbit

        $TC class add dev $EXT_IF parent 10:10 classid 10:10 htb rate ${UPLINK_MIN_10}kbit ceil ${UPLINK_MAX_10}kbit prio 0 # VoIP
        $TC class add dev $EXT_IF parent 10:10 classid 10:11 htb rate ${UPLINK_MIN_11}kbit ceil ${UPLINK_MAX_11}kbit prio 1 # rest
        $TC class add dev $EXT_IF parent 10:10 classid 20:20 htb rate ${UPLINK_MIN_20}kbit ceil ${UPLINK_MAX_20}kbit prio 0 # streams
        $TC class add dev $EXT_IF parent 20:1 classid 20:21 htb rate ${UPLINK_MIN_21}kbit ceil ${UPLINK_MAX_21}kbit prio 1 # rest
        $TC class add dev $EXT_IF parent 30:1 classid 30:30 htb rate ${UPLINK_MIN_30}kbit ceil ${UPLINK_MAX_30}kbit prio 0
        $TC class add dev $EXT_IF parent 30:1 classid 30:31 htb rate ${UPLINK_MIN_31}kbit ceil ${UPLINK_MAX_31}kbit prio 1
        $TC class add dev $EXT_IF parent 30:1 classid 30:32 htb rate ${UPLINK_MIN_32}kbit ceil ${UPLINK_MAX_32}kbit prio 2
        $TC qdisc add dev $EXT_IF parent 10:10 handle 10: sfq perturb 10
        #$TC qdisc add dev $EXT_IF parent 10:11 handle 11: sfq perturb 10
        $TC qdisc add dev $EXT_IF parent 20:20 handle 20: sfq perturb 10
        #$TC qdisc add dev $EXT_IF parent 20:21 handle 21: sfq perturb 10
        $TC qdisc add dev $EXT_IF parent 30:30 handle 30: sfq perturb 10
        $TC qdisc add dev $EXT_IF parent 30:31 handle 31: sfq perturb 10
        $TC qdisc add dev $EXT_IF parent 30:32 handle 32: sfq perturb 10

        $TC filter add dev $EXT_IF parent 1:0 prio 0 protocol ip handle 30 fw flowid 1:30
        $TC filter add dev $EXT_IF parent 1:0 prio 0 protocol ip handle 31 fw flowid 1:31
        $TC filter add dev $EXT_IF parent 1:0 prio 0 protocol ip handle 32 fw flowid 1:32

        $IPTABLES -t mangle -N SHAPE-OUT
        $IPTABLES -t mangle -I POSTROUTING -o $EXT_IF -j SHAPE-OUT

        $IPTABLES -t mangle -A SHAPE-OUT -p icmp -j MARK --set-mark 30
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport ssh -j MARK --set-mark 30
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --sport ssh -j MARK --set-mark 30
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport telnet -j MARK --set-mark 30
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --sport telnet -j MARK --set-mark 30
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport ssh -j MARK --set-mark 30
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --sport ssh -j MARK --set-mark 30
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport telnet -j MARK --set-mark 30
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --sport telnet -j MARK --set-mark 30
        $IPTABLES -t mangle -A SHAPE-OUT -p udp --dport 53 -j MARK --set-mark 30 # dns
        $IPTABLES -t mangle -A SHAPE-OUT -p udp --sport 53 -j MARK --set-mark 30 # dns
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport 80 -j MARK --set-mark 31
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport 443 -j MARK --set-mark 31
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport 5000 -j MARK --set-mark 31 # radio
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport 6667:7000 -j MARK --set-mark 31
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp -m length --length :128 -j MARK --set-mark 30 # ack
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport 6000 -j MARK --set-mark 30 # skype
        $IPTABLES -t mangle -A SHAPE-OUT -p udp --dport 6000 -j MARK --set-mark 30 # skype
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport 8000 -j MARK --set-mark 31 # radio
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport 8100 -j MARK --set-mark 31 # radio
        $IPTABLES -t mangle -A SHAPE-OUT -p tcp --dport 9001:9002 -j MARK --set-mark 31 # tor

        $IPTABLES -t mangle -A SHAPE-OUT -m mark --mark 0 -j MARK --set-mark 32      # redundant packets

        $IPTABLES -t mangle -A SHAPE-OUT -j $EXT_IF

}

inbound_shape() {
        ######################################################################################
        # inbound IMQ
        ######################################################################################
        $MODPROBE imq numdevs=1
        $IP link set imq0 up

        # add qdisc - default low-prio class 1:21
        $TC qdisc add dev imq0 handle 1: root htb default 22

        # add main rate limit classes
        $TC class add dev imq0 parent 1: classid 1:1 htb rate ${DOWNLINK}kbit

        # add leaf classes - TCP traffic in 21, non TCP traffic in 20
        #
        $TC class add dev imq0 parent 1:1 classid 1:20 htb rate ${DOWNLINK_0}kbit ceil ${DOWNLINK_LIMIT_0}kbit prio 0
        $TC class add dev imq0 parent 1:1 classid 1:21 htb rate ${DOWNLINK_1}kbit ceil ${DOWNLINK_LIMIT_1}kbit prio 1
        $TC class add dev imq0 parent 1:1 classid 1:22 htb rate ${DOWNLINK_2}kbit ceil ${DOWNLINK_LIMIT_2}kbit prio 2

        # attach qdisc to leaf classes - here we at SFQ to each priority class.  SFQ insures that
        #                                within each class connections will be treated (almost) fairly.
        $TC qdisc add dev imq0 parent 1:20 handle 20: sfq perturb 10
        $TC qdisc add dev imq0 parent 1:21 handle 21: sfq perturb 10
        $TC qdisc add dev imq0 parent 1:22 handle 22: red limit 1000000 min 5000 max 100000 avpkt 1000 burst 50

        # filter traffic into classes by fwmark - here we direct traffic into priority class according to
        #                                         the fwmark set on the packet (we set fwmark with iptables
        #                                         later).  Note that above we've set the default priority
        #                                         class to 1:26 so unmarked packets (or packets marked with
        #                                         unfamiliar IDs) will be defaulted to the lowest priority
        #                                         class.
        $TC filter add dev imq0 parent 1:0 prio 0 protocol ip handle 20 fw flowid 1:20
        $TC filter add dev imq0 parent 1:0 prio 0 protocol ip handle 21 fw flowid 1:21
        $TC filter add dev imq0 parent 1:0 prio 0 protocol ip handle 22 fw flowid 1:22

        # add SHAPE-IN chain to the mangle table in iptables - this sets up the table we'll use
        #                                                      to filter and mark packets.
        $IPTABLES -t mangle -N SHAPE-IN
        $IPTABLES -t mangle -I PREROUTING -i $EXT_IF -j SHAPE-IN
       # add fwmark entries to classify different types of traffic - Set fwmark from 20-26 according to
        #                                                             desired class. 20 is highest prio.
        $IPTABLES -t mangle -A SHAPE-IN -p ! tcp -j MARK --set-mark 22              # Set non-tcp packets to highest priority
        $IPTABLES -t mangle -A SHAPE-IN -p tcp -m length --length :128 -j MARK --set-mark 20 # short TCP packets are probably ACKs
        $IPTABLES -t mangle -A SHAPE-IN -p icmp -j MARK --set-mark 20
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport ssh -j MARK --set-mark 20    # secure shell
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --sport ssh -j MARK --set-mark 20    # secure shell
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport telnet -j MARK --set-mark 20 # telnet (ew...)
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --sport telnet -j MARK --set-mark 20 # telnet (ew...)
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport 53 -j MARK --set-mark 20
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport 80 -j MARK --set-mark 21
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport 443 -j MARK --set-mark 21
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport 5000 -j MARK --set-mark 21 # radio
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport 6000 -j MARK --set-mark 20 # skype
        $IPTABLES -t mangle -A SHAPE-IN -p udp --dport 6000 -j MARK --set-mark 20 # skype
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport 6667:7000 -j MARK --set-mark 21 # irc
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport 8000 -j MARK --set-mark 21 # radio
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport 8100 -j MARK --set-mark 21 # radio
        $IPTABLES -t mangle -A SHAPE-IN -p tcp --dport 9001:9002 -j MARK --set-mark 21 # tor
        $IPTABLES -t mangle -A SHAPE-IN -m mark --mark 0 -j MARK --set-mark 22      # redundant packets

        # finally, instruct these packets to go through the imq0 we set up above
        $IPTABLES -t mangle -A SHAPE-IN -j IMQ

        # Done with inbound shaping
        #
        ####################################################

        echo "Inbound shaping added to $EXT_IF. Rate: ${DOWNLINK}Kbit/sec."
}