# give "overhead" packets highest priority
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --syn -m length --length 40:68 -j CLASSIFY \
  --set-class 1:10
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --tcp-flags ALL SYN,ACK -m length --length 40:68 \
  -j CLASSIFY --set-class 1:10
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --tcp-flags ALL ACK -m length --length 40:100 \
  -j CLASSIFY --set-class 1:10
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --tcp-flags ALL RST -j CLASSIFY --set-class 1:10
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --tcp-flags ALL ACK,RST -j CLASSIFY \
  --set-class 1:10
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --tcp-flags ALL ACK,FIN -j CLASSIFY \
  --set-class 1:10
# interactive SSH traffic
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --sport ssh -m length --length 40:100 \
  -j CLASSIFY --set-class 1:20
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --dport ssh -m length --length 40:100 \
  -j CLASSIFY --set-class 1:20
# interactive mail or web traffic
iptables -t mangle -A POSTROUTING -o eth0 -p tcp -m multiport --sport http,pop,imap,https,imaps \
  -j CLASSIFY --set-class 1:30
# dns lookups
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --dport domain -j CLASSIFY --set-class 1:30
# ICMP, UDP
iptables -t mangle -A POSTROUTING -o eth0 -p udp -j CLASSIFY --set-class 1:40
iptables -t mangle -A POSTROUTING -o eth0 -p icmp -m length --length 28:1500 -m limit \
  --limit 2/s --limit-burst 5 -j CLASSIFY --set-class 1:40
# bulk traffic
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --sport ssh -m length --length 101: \
  -j CLASSIFY --set-class 1:50
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --dport ssh -m length --length 101: \
  -j CLASSIFY --set-class 1:50
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --sport 25 -j CLASSIFY --set-class 1:50
iptables -t mangle -A POSTROUTING -o eth0 -p tcp --dport 6667 -j CLASSIFY --set-class 1:50