Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Traffic control mark with nftables
#! /usr/sbin/nft -f
chain tc-wan {
# check default priority
mark & 0xff0 == 0x130 ip dscp set af22 return
# real-time application
## Dota2
udp dport 27000-27200 \
meta mark set mark & 0xfffff00f ^ 0x110 ip dscp set af41 return
## ICMP
ip protocol icmp \
meta mark set mark & 0xfffff00f ^ 0x110 ip dscp set af41 return
## TCP low-flow
meter wan-11-tcp { tcp sport . ip saddr timeout 10s limit rate 8 kbytes/second burst 16 kbytes } \
meta mark set mark & 0xfffff00f ^ 0x110 ip dscp set af42 return
## UDP low-flow
meter wan-11-udp { udp sport . ip saddr timeout 10s limit rate 8 kbytes/second burst 16 kbytes } \
meta mark set mark & 0xfffff00f ^ 0x110 ip dscp set af42 return
# TCP midium-flow
meter wan-12 { tcp sport . ip saddr timeout 3s limit rate 64 kbytes/second burst 512 kbytes } \
meta mark set mark & 0xfffff00f ^ 0x120 ip dscp set af31 return
# TCP high-flow & UDP {midium,high}-flow (default)
meta mark set mark & 0xfffff00f ^ 0x130 ip dscp set af22
}
chain tc-lan {
# check default priority
mark & 0xff0 == 0x130 ip dscp set af23 return
# internal traffic
ip saddr $lan_subnet \
meta mark set mark & 0xfffff00f ^ 0x200 ip dscp set af21 return
# real-time application
## Dota2
udp sport 27000-27200 \
meta mark set mark & 0xfffff00f ^ 0x110 ip dscp set af41 return
## ICMP
ip protocol icmp \
meta mark set mark & 0xfffff00f ^ 0x110 ip dscp set af41 return
## TCP low-flow
mark & 0xff0 != 0x120 \
meter lan-11-tcp { tcp dport . ip daddr timeout 10s limit rate 16 kbytes/second burst 32 kbytes } \
meta mark set mark & 0xfffff00f ^ 0x110 ip dscp set af42 return
## UDP low-flow
mark & 0xff0 != 0x120 \
meter lan-11-udp { udp dport . ip daddr timeout 10s limit rate 16 kbytes/second burst 32 kbytes } \
meta mark set mark & 0xfffff00f ^ 0x110 ip dscp set af42 return
# TCP midium-flow
meter lan-12 { tcp dport . ip daddr timeout 3s limit rate 512 kbytes/second burst 2 mbytes } \
meta mark set mark & 0xfffff00f ^ 0x120 ip dscp set af31 return
# TCP high-flow & UDP {midium,high}-flow (default)
meta mark set mark & 0xfffff00f ^ 0x130 ip dscp set af23
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.