iproute2和tc的高级路由用法

#Linux advanced router
ip link show                             #显示链路
ip addr show                          #显示地址(或ifconfig)
ip route show                            #显示路由(route -n)
ip neigh show                            #显示arp表(ping 192.168.95.50，如果主机在同一局域网内，直接加到arp表)
ip neigh delete 192.168.95.50 dev eth0   #删除arp条目，条目仍然存在状态为stale，下次通信需要确认
ip rule show                             #显示缺省规则
ip route del default dev eth0            #删除接口路由
ip route show table local                #查看本地静态路由
ip route show table main                 #查看直连路由

###########
未测
###########
echo 200 John >>/etc/iproute2/rt_tables  #设置名字对于数值
ip rule add from 10.0.0.10 table John    #指定源地址
ip route add default via 192.168.44.128 dev ppp2 table John #将数据指向该表网关
ip route flush cache


#################################################################
#测试双线上网,负载均衡
#################################################################
#Local environment：
#Output interface:
#eth0:192.168.222.128 gateway:192.168.222.2
#eth2:192.168.1.109   gateway:192.168.1.109

#Input interface:
#eth1:192.168.95.2 netmaks 255.255.255.0

ip rule add from 192.168.222.128 table 150
ip rule add from 192.168.1.109 table 151

ip route add default via 192.168.222.2 table 150
ip route add default via 192.168.1.1 table 151


#ip route add 192.168.222.0/24 dev eth0 src 192.168.222.128 table 150
#ip route add 192.168.1.0/24 dev eth2 src 192.168.1.109 table 151

ip route replace default scope global nexthop via 192.168.222.2 dev eth0 weight 1 nexthop via 192.168.1.1 dev eth2 weight 1
ip route flush cache


iptables -t nat -A POSTROUTING -o eth0 -s 192.168.95.0/24 -j SNAT --to-source 192.168.222.128
iptables -t nat -A POSTROUTING -o eth2 -s 192.168.95.0/24 -j SNAT --to-source 192.168.1.109

echo "nameserver 210.21.4.130" >/etc/resole.conf






##################################################
#测试双线上网,负载均衡，跟上面一样的，写法稍微好点
##################################################
#Local environment：
#Output interface:
#eth0:192.168.222.128 gateway:192.168.222.2
#eth2:192.168.1.109   gateway:192.168.1.109

#Input interface:
#eth1:192.168.95.2 netmaks 255.255.255.0


ip rule add pref 10 from 192.168.222.128 table 10
ip rule add pref 10 from 192.168.1.109 table 20

ip route replace default via 192.168.222.2 dev eth0 table 10
ip route replace default via 192.168.1.1 dev eth2 table 20

#下面两句主要增加
#物理机通过nat接口(与eth0在同一网段)访问需要在网关加一条路由，通过bridged接口(与eth2在同一网段)访问正常
#ip route add 192.168.222.0/24 dev eth0 src 192.168.222.128 table 150
#ip route add 192.168.1.0/24 dev eth2 src 192.168.1.109 table 151

ip route replace default nexthop via 192.168.222.2 dev eth0 weight 4 nexthop via 192.168.1.1 dev eth2 weight 1
ip route flush cache


iptables -t nat -A POSTROUTING -o eth0 -s 192.168.95.0/24 -j SNAT --to-source 192.168.222.128
iptables -t nat -A POSTROUTING -o eth2 -s 192.168.95.0/24 -j SNAT --to-source 192.168.1.109

#iptables -t nat -A POSTROUTING -m iprange --src-range 192.168.22.3-192.168.22.255 -j SNAT --to-source 192.168.1.254
#iptables -t nat -A POSTROUTING -m iprange --src-range 192.168.22.3-192.168.22.255 -j SNAT --to-source 192.168.233.2

echo "nameserver 210.21.4.130" >/etc/resole.conf





#########################################################
#网络上个一个例子
#########################################################
#Link: http://www.study-area.org/tips/multipath.htm
#實作指令

5.1 獲取當前各界面之 ip ：
# ip address show
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:02:44:84:26:4f brd ff:ff:ff:ff:ff:ff
    inet 220.130.96.21/24 brd 220.130.96.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:20:ed:36:f9:74 brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.2/24 brd 192.168.100.255 scope global eth1
4: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:02:b3:4b:69:49 brd ff:ff:ff:ff:ff:ff
    inet 10.1.2.3/24 brd 10.1.2.255 scope global eth2
15: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1492 qdisc pfifo_fast qlen 3
    link/ppp
    inet 210.64.33.27 peer 210.64.33.1/32 scope global ppp0

5.2 設定 ip rule ：
# ip rule add pref 10 from 220.130.96.21 table 10
# ip rule add pref 20 from 192.168.100.2 table 20
# ip rule add pref 30 from 210.64.33.27 table 30

5.3 設定 ip route 各 table ：
# ip route replace default via 220.130.96.254 dev eth0 table 10
# ip route replace default via 192.168.100.1 dev eth1 table 20
# ip route replace default via 210.64.33.1 dev ppp0 table 30

5.4 設定 ip route main table：
# ip route replace default 
> nexthop via 220.130.96.254 dev eth0 weight 4 
> nexthop via 192.168.100.1 dev eth1 weight 1 
> nexthop via 210.64.33.1 dev ppp0 weight 1

5.5 檢視 main table 規則：
# ip route show
210.64.33.1 dev ppp0  proto kernel  scope link  src 210.64.33.27
192.168.100.0/24 dev eth1  scope link
220.130.96.0/24 dev eth0  scope link
10.1.2.0/24 dev eth2  scope link
169.254.0.0/16 dev eth2  scope link
127.0.0.0/8 dev lo  scope link
default
        nexthop via 220.130.96.254  dev eth0 weight 4
        nexthop via 192.168.100.1  dev eth1 weight 1
        nexthop via 210.64.33.1  dev ppp0 weight 1

5.6 刷新 route cache：
# ip route flush cache

5.7 測試及確認連線生效：
基本上，若在輸入上述命令中沒遇到 error ，那設定就已完成。
接下來可起用多個對外連線(或用 ping)，
然後使用 tcpdump -i any 來查看封包是否能分攤在每一條連線上。
#################################################################




#########################################










































################################################################
tc 流量控制:
#测试环境
Output: eth0 192.168.222.128
Input： eth1 192.168.95.2
################################################################
#限制单个地址已测

#队列规定 qdisc(queueing discipline) ,类(class)和分类器(Classifiers)

#清除接口所有规则
tc qdisc del dev eth1 root 2>/dev/null
tc -s qdisc show dev eth1   #查看总的流量


#限制单个ip流量
tc qdisc add dev eth1 root handle 1: htb r2q 1
tc class add dev eth1 parent 1: classid 1:1 htb rate 100kbit ceil 200kbit
tc filter add dev eth1 parent 1: protocol ip prio 1 u32 match ip dst 192.168.95.50 flowid 1:1



##################################################
#实际流量是这里6倍
tc qdisc del dev eth1 root 2>/dev/null
tc qdisc add dev eth1 root handle 1: htb default 30
tc class add dev eth1 parent 1: classid 1:1 htb rate 15kbit ceil 15kbit
tc class add dev eth1 parent 1:1 classid 1:10 htb rate 10kbit ceil 10kbit
tc class add dev eth1 parent 1:1 classid 1:20 htb rate 5kbit ceil 5kbit

tc qdisc add dev eth1 parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev eth1 parent 1:20 handle 20: sfq perturb 10

tc filter add dev eth1 parent 1: protocol ip prio 1 u32 match ip dst 192.168.95.50 flowid 1:10
tc filter add dev eth1 parent 1: protocol ip prio 1 u32 match ip dst 192.168.95.51 flowid 1:20
 

tc class show dev eth1 classid 1:1
tc class show dev eth1 classid 1:10
tc class show dev eth1 classid 1:20
 
tc -s filter show dev eth1
tc -s class show dev eth1
tc -s class show dev eth1 classid 1:1
tc -s class show dev eth1 classid 1:10
tc -s class show dev eth1 classid 1:20


##################################################

iptables -t filter -F
iptables -t filter -X
iptables -t filter -Z

iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z

iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z

tc qdisc del dev eth1 root 2>/dev/null
tc qdisc add dev eth1 root handle 1: htb default 30
tc class add dev eth1 parent 1: classid 1:1 htb rate 15kbit ceil 15kbits
tc class add dev eth1 parent 1:1 classid 1:10 htb rate 10kbit ceil 10kbit
tc class add dev eth1 parent 1:1 classid 1:20 htb rate 5kbit ceil 5kbit

tc qdisc add dev eth1 parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev eth1 parent 1:20 handle 20: sfq perturb 10
 
tc filter add dev eth1 parent 1: protocol ip prio 1 handle 6 fw flowid 1:10
tc filter add dev eth1 parent 1: protocol ip prio 1 handle 7 fw flowid 1:20


#对路由到本地的包有效速度控制
iptables -t mangle -A OUTPUT -o eth1 --destination 192.168.95.50 -j MARK --set-mark 0x6
iptables -t mangle -A OUTPUT -o eth1 --destination 192.168.95.51 -j MARK --set-mark 0x7

#对转发包速度控制
iptables -t mangle -A PREROUTING -i eth1 --source 192.168.95.50 -j MARK --set-mark 0x6
iptables -t mangle -A PREROUTING -i eth1 --source 192.168.95.51 -j MARK --set-mark 0x7


iptables -t filter -nvL
iptables -t mangle -nvL