Skip to content

Instantly share code, notes, and snippets.

@eqhmcow
Last active February 12, 2020 10:35
Show Gist options
  • Save eqhmcow/1278a928d11279cb5846688e05dfd363 to your computer and use it in GitHub Desktop.
Save eqhmcow/1278a928d11279cb5846688e05dfd363 to your computer and use it in GitHub Desktop.
let me eat cake
# /etc/iptables.rules
# Generated by iptables-save v1.6.1 on Sat Oct 19 09:21:09 2019
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:MINIUPNPD - [0:0]
# when using two cakes, prioritizing small packets is probably a bad idea
#-A PREROUTING -m length --length 0:128 -j MARK --set-mark 2
-A PREROUTING -i eth0 -j MINIUPNPD
COMMIT
# Completed on Sat Oct 19 09:21:09 2019
# Generated by iptables-save v1.6.1 on Sat Oct 19 09:21:09 2019
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
-A INPUT -p icmp -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 68 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 68 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
## DROP QUIC
-A INPUT -i eth0 -p udp -m udp --sport 80 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i eth0 -p udp -m udp --sport 443 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -p icmp -j ACCEPT
## DROP QUIC
-A FORWARD -i eth0 -p udp -m udp --sport 80 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i eth0 -p udp -m udp --sport 443 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i eth1 -p udp -m udp --dport 80 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i eth1 -p udp -m udp --dport 443 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -d 192.168.133.0/24 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.133.0/24 -i eth1 -j ACCEPT
-A FORWARD -i eth1 -o eth1 -j ACCEPT
-A FORWARD -i eth0 ! -o eth0 -j MINIUPNPD
-A FORWARD -o eth1 -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A FORWARD -i eth1 -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A FORWARD -o eth1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i eth1 -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Sat Oct 19 09:21:09 2019
# Generated by iptables-save v1.6.1 on Sat Oct 19 09:21:09 2019
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
-A PREROUTING -i eth0 -j MINIUPNPD
-A POSTROUTING -o eth0 -j MINIUPNPD-POSTROUTING
-A POSTROUTING -s 192.168.133.0/24 ! -d 192.168.133.0/24 -j MASQUERADE
COMMIT
# Completed on Sat Oct 19 09:21:09 2019
# ping -f over the LAN
while [[ 1 ]] ; do date ; time ping -f -s1400 -c10000 192.168.133.152 ; echo ; echo ; done | tee /dev/tty | rotatelogs local-ping-log 128M
tail -f local-ping-log.1573372564 | egrep --line-buffered '2019|max' | perl -p -e 'm!((?:\d+\.\d+/?){4})(.*)!,or next; $a=join("\t",split(m!/!,$1)); $_="$a\n\n"'
#!/bin/bash
WAN_INTERFACE=eth0
LAN_INTERFACE=eth1
TC=/usr/sbin/tc
bandwidth=50Mbit
$TC qdisc del dev $WAN_INTERFACE root 2> /dev/null
$TC qdisc del dev $LAN_INTERFACE root 2> /dev/null
$TC qdisc add dev $WAN_INTERFACE root handle 1: prio bands 2 priomap 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
$TC qdisc add dev $WAN_INTERFACE parent 1:1 cake besteffort internet nat egress ethernet
$TC qdisc add dev $WAN_INTERFACE parent 1:2 cake bandwidth $bandwidth besteffort internet nat egress ethernet
# dest ports only - 0xfc00 = 1023 ports from the base
for i in 20000 21000 22000 23000 24000 25000 26000 27000 28000 29000 30000 31000 32000 33000 34000 35000 36000 37000 38000 39000 40000 41000 42000 43000 44000 45000 ; do
$TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip dport $i 0xfc00 flowid 1:1
done
# src and dest ports - 0xfc00 = 1023 ports from the base
for i in 3074 4500 9000 19000 ; do
$TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip sport $i 0xfc00 flowid 1:1
$TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip dport $i 0xfc00 flowid 1:1
done
# src and dest ports - 0xffff
for i in 22 53 ; do
$TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip sport $i 0xffff flowid 1:1
$TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip dport $i 0xffff flowid 1:1
done
$TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip protocol 1 0xff flowid 1:1
# LAN
$TC qdisc add dev $LAN_INTERFACE root handle 1: prio bands 2 priomap 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
$TC qdisc add dev $LAN_INTERFACE parent 1:1 cake besteffort internet nat ingress ethernet
$TC qdisc add dev $LAN_INTERFACE parent 1:2 cake bandwidth $bandwidth besteffort internet nat ingress ethernet
# src ports only - 0xfc00 = 1023 ports from the base
for i in 20000 21000 22000 23000 24000 25000 26000 27000 28000 29000 30000 31000 32000 33000 34000 35000 36000 37000 38000 39000 40000 41000 42000 43000 44000 45000 ; do
$TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip sport $i 0xfc00 flowid 1:1
done
# src and dest ports - 0xfc00 = 1023 ports from the base
for i in 3074 4500 9000 19000 ; do
$TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip sport $i 0xfc00 flowid 1:1
$TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip dport $i 0xfc00 flowid 1:1
done
# src and dest ports - 0xffff
for i in 22 53 ; do
$TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip sport $i 0xffff flowid 1:1
$TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip dport $i 0xffff flowid 1:1
done
$TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip protocol 1 0xff flowid 1:1
exit 0
#!/bin/bash
# /etc/rc.local
echo never > /sys/kernel/mm/transparent_hugepage/enabled
#for i in xt_u32 cls_u32 em_u32 act_mirred cls_u32 cls_flow cls_fw sch_cake \
# nfnetlink_cthelper ip_tables iptable_nat nf_nat_ftp nf_nat_irc nf_nat_sip \
# nf_nat_tftp nf_nat_pptp nf_nat_h323 ; do
# /usr/sbin/modprobe $i
#done
for i in nfnetlink_cthelper ip_tables iptable_nat ; do
/usr/sbin/modprobe $i
done
/usr/bin/systemctl stop miniupnpd
/usr/sbin/iptables-restore < /etc/iptables.rules
/usr/sbin/sysctl -p
for i in eth0 eth1 ; do
for j in rx tx sg tso ufo gso gro lro ntuple rxhash ; do
/usr/sbin/ethtool -K $i $j off
done
# defaults:
#RX: 9709
#TX: 170
/usr/sbin/ethtool -G $i rx 9709 tx 170
done
/usr/bin/systemctl start miniupnpd
bash prio-cake.sh
#!/bin/bash
# eth0 is WAN
# eth1 is LAN
/usr/sbin/tc qdisc del dev eth0 root 2> /dev/null
/usr/sbin/tc qdisc del dev eth1 root 2> /dev/null
/usr/sbin/tc qdisc add dev eth0 root cake besteffort internet nat egress ethernet
/usr/sbin/tc qdisc add dev eth1 root cake besteffort internet nat ingress ethernet
# /etc/sysctl.conf
net.ipv4.ip_forward=1
net.netfilter.nf_conntrack_helper=1
net.ipv4.tcp_ecn=2
net.ipv4.tcp_sack=1
net.ipv4.tcp_dsack=1
net.core.wmem_max=212992
net.ipv4.tcp_wmem=4096 16384 4194304
net.core.rmem_max=212992
net.ipv4.tcp_rmem=4096 131072 4194304
net.core.dev_weight=64
net.core.netdev_max_backlog=1000
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment