iptables=iptables
function start {
tc qdisc  add dev eth0 root handle 2:0 htb r2q 100 default 210
tc class  add dev eth0 parent 2:0 classid 2:1 htb rate 128kbit ceil 128kbit prio 0  quantum 1500 burst 3k
#acks+tos , maxiumum prio
tc class  add dev eth0 parent 2:1 classid 2:110 htb rate 89.6kbit ceil 128kbit prio 0 quantum 3000 burst 1k
tc qdisc  add dev eth0 parent 2:110 handle 110:0 esfq perturb 5 depth 1024 hash src
tc filter add dev eth0 parent 2:0 protocol ip prio 0 handle 0x1869f fw classid 2:110
#games-class
tc class  add dev eth0 parent 2:1 classid 2:120 htb rate 102.4kbit ceil 128kbit prio 1 quantum 3000 burst 1k
tc qdisc  add dev eth0 parent 2:120 handle 120:0  esfq perturb 5 depth 1024 hash src
tc filter add dev eth0 parent 2:0 protocol ip prio 2 handle 0x1869d fw classid 2:120
#norm-class
tc class  add dev eth0 parent 2:1 classid 2:130 htb rate 12.8kbit ceil 96kbit prio 2 quantum 1500 burst 0k
tc qdisc  add dev eth0 parent 2:130 handle 210:0  esfq perturb 10 depth 1024 hash src
tc filter add dev eth0 parent 2:0 protocol ip prio 3 handle 0x1869c fw classid 2:130
#bulk-class
tc class  add dev eth0 parent 2:1 classid 2:140 htb rate 2kbit ceil 89.6kbit prio 3 quantum 1500
tc qdisc  add dev eth0 parent 2:140 handle 220:0  esfq perturb 10 depth 1024 hash src
tc filter add dev eth0 parent 2:0 protocol ip prio 4 handle 0x1869b fw classid 2:140
#same for eth1, execpt that we need a extra-(top)level for local generated stuff (i.e. squid/www @ full speed)
tc qdisc  add dev eth1 root handle 2:0 htb r2q 100 default 210
tc class  add dev eth1 parent 2:0 classid 2:1 htb rate 100240kbit ceil 100240kbit quantum 3000 burst 30k cburst 50k
tc class  add dev eth1 parent 2:1 classid 2:2 htb rate 50120kbit ceil 100240kbit prio 7 quantum 3000 burst 10k cburst 10k
tc qdisc  add dev eth1 parent 2:2 handle 10:0 pfifo
tc filter add dev eth1 parent 2:0 protocol ip prio 3 handle 0x1869a fw classid 2:2
tc class  add dev eth1 parent 2:1 classid 2:3 htb rate 1000kbit ceil 1000kbit quantum 3000 burst 3k cburst 1k
#acks , maxiumum prio
tc class  add dev eth1 parent 2:3 classid 2:110 htb rate 300kbit ceil 500kbit prio 0 quantum 3000 burst 1k
tc qdisc  add dev eth1 parent 2:110 handle 110:0 esfq perturb 5 depth 1024 hash dst
tc filter add dev eth1 parent 2:0 protocol ip prio 0 handle 0x1869f fw classid 2:110
# games-class
tc class  add dev eth1 parent 2:3 classid 2:120 htb rate 600kbit ceil 1000kbit prio 2 quantum 3000 burst 1k
tc qdisc  add dev eth1 parent 2:120 handle 120:0  esfq perturb 5 depth 1024 hash dst
tc filter add dev eth1 parent 2:0 protocol ip prio 2 handle 0x1869d fw classid 2:120
#normal traffic
tc class  add dev eth1 parent 2:3 classid 2:130 htb rate 200kbit ceil 750kbit prio 3 quantum 1500 burst 0k
tc qdisc  add dev eth1 parent 2:130 handle 210:0 esfq perturb 10 depth 1024 hash dst
tc filter add dev eth1 parent 2:0 protocol ip prio 3 handle 0x1869c fw classid 2:130
#bulk-class. lower prio than all others, no reserved bw
tc class  add dev eth1 parent 2:3 classid 2:140 htb rate 5kbit ceil 750kbit prio 6 quantum 1500
tc qdisc  add dev eth1 parent 2:140 handle 220:0 esfq perturb 10 depth 1024 hash dst
tc filter add dev eth1 parent 2:0 protocol ip prio 4 handle 0x1869b fw classid 2:140
# now iptables-mark-rules. BEWARE THE FACT that LAST MARK COUNTS (i.e. mark-rules are not terminating)
modprobe ip_conntrack
modprobe ip_conntrack_ftp
# Default: Everything forwarded is normal (obsolete because of htb-default filter, but... :)
$iptables -t mangle -A FORWARD
                                                         -j MARK --set-mark 0x1869c
# Local Generated Stuff gets into a special class, which is serves at full interface speed
$iptables -t mangle -A OUTPUT                                                                             -j MARK --set-mark 0
x1869a
# EVERYTING in a connection above 500k is bulk (gets only overridden by games perhaps, see below)
$iptables -t mangle -A FORWARD -m connbytes --connbytes 256000:
                         -j MARK --set-mark 0x1869b
# Some priorized Stuff
$iptables -t mangle -A FORWARD -p udp --destination-port 53                                               -j MARK --set-mark 0
x1869f
$iptables -t mangle -A FORWARD -p udp --source-port 53                                                    -j MARK --set-mark 0
x1869f
$iptables -t mangle -A FORWARD -p icmp -m limit --limit 2/second                                          -j MARK --set-mark 0
x1869f
$iptables -t mangle -A FORWARD -p tcp  -m tos --tos 0x10 -j MARK --set-mark 0x1869f
$iptables -t mangle -A FORWARD -p tcp --dport 22 -m tos --tos ! 0x8 -m connbytes --connbytes :200000 -j MARK --set-mark 0x1869
f
$iptables -t mangle -A FORWARD -p tcp --sport 22 -m tos --tos ! 0x8 -m connbytes --connbytes :200000 -j MARK --set-mark 0x1869
f
# GAME-MATCHES (PUT THEM IN HERE; NO WHERE ELSE, BECAUSE IPTABLES-MARKS ARE OVERRIDDEN BY THE LAST MATCH!)
# diablo 2
$iptables -t mangle -A FORWARD -p tcp  --dport 4000                   -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p tcp  --sport 4000                   -j MARK --set-mark 0x1869d
# teamspeak
$iptables -t mangle -A FORWARD -p udp  --dport 8767                   -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p udp  --sport 8767                   -j MARK --set-mark 0x1869d
# warcraft
$iptables -t mangle -A FORWARD -p tcp  --dport 6112                   -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p tcp  --sport 6112                   -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p udp  --dport 7777                   -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p udp  --sport 7777                   -j MARK --set-mark 0x1869d
# americas army
$iptables -t mangle -A FORWARD -p udp  --dport 1716                   -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p udp  --sport 1716                   -j MARK --set-mark 0x1869d
# very much games (unreal, TO, rtcw)
$iptables -t mangle -A FORWARD -p udp  --dport 20000:30000            -j MARK --set-mark 0x1869d
$iptables -t mangle -A FORWARD -p udp  --sport 20000:30000            -j MARK --set-mark 0x1869d
# Other (bulk) Matches
$iptables -t mangle -A FORWARD -m helper --helper ftp                            -j MARK --set-mark 0x1869b
$iptables -t mangle -A FORWARD -p tcp --destination-port 4660:4670    -j MARK --set-mark 0x1869b
$iptables -t mangle -A FORWARD -p tcp --source-port 4660:4670            -j MARK --set-mark 0x1869b
$iptables -t mangle -A FORWARD -p tcp --destination-port 25                      -j MARK --set-mark 0x1869b
$iptables -t mangle -A OUTPUT -p tcp  --tcp-flags ALL ACK -m length --length 40:52
         -j MARK --set-mark 0x1869f
$iptables -t mangle -A FORWARD -p tcp --tcp-flags ALL ACK -m length --length 40:52
         -j MARK --set-mark 0x1869f