Freesco, NND, CDN, EOS

                        ifconfig eth0 173.16.1.101 netmask 255.255.255.0 up
                        ifconfig eth2 173.16.0.100 netmask 255.255.255.0 up
                        ifconfig eth3 10.0.1.78 netmask 255.255.0.0 up
                       route add default gw  173.16.1.199

ifconfig eth1 192.168.0.199 netmask 255.255.255.0 up
ifconfig eth1:0 192.168.1.199 netmask 255.255.255.0 up

iptables -t mangle -A FORWARD -o eth0 -p tcp -m connlimit --connlimit-above 40 -j DROP
iptables -t mangle -A FORWARD -o eth2 -p tcp -m connlimit --connlimit-above 50 -j DROP
iptables -t mangle -A FORWARD -o eth3 -p tcp -m connlimit --connlimit-above 50 -j DROP

#!/bin/sh
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"

niceshaper stop
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter

echo "Czyszczenie"

ip route flush table T1
ip route flush table T2
ip route flush table T3
ip rule del fwmark 3 table T1
ip rule del fwmark 2 table T2
ip rule del fwmark 4 table T3

echo "dsl #1"
ip route add 192.168.0.0/16 dev eth1 table T1 # sieć lokalna 192.168.0.0/16
na interfejsie eth1
ip route add default via 173.16.1.199 table T1 # brama dla DSL #1
echo "dsl #2"
ip route add 192.168.0.0/16 dev eth1 table T3 # sieć lokalna 192.168.0.0/16
na interfejsie eth1
ip route add default via 173.16.0.199 table T3 # brama dla DSL #2
echo "dsl #3"
ip route add 192.168.0.0/16 dev eth1 table T2 # sieć lokalna 192.168.0.0/16
na interfejsie eth1
ip route add default via 10.0.0.1 table T2 # brama dla DSL #2

echo "ip rule"
ip rule add fwmark 3 table T1
ip rule add fwmark 2 table T2
ip rule add fwmark 4 table T3

echo "przygotowanie iptables"

# zatrzymujemy niceshapera
iptables -t mangle -F PREROUTING

# markujemy 
#iptables -t mangle -A PREROUTING -i eth1 -p udp -s 192.168.0.0/16 --dport 0 -j DROP

iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -j MARK --set-mark 4
#iptables -t mangle -A PREROUTING -i eth1 -s 192.168.1.0/24 -j MARK --set-mark 3

#iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -j MARK --set-mark 3

#iptables -t mangle -A PREROUTING -i eth1 -p udp -s 192.168.0.0/16 -j MARK --set-mark 3

# nadpisujemy numerkiem 3, to co ma być routowane drugim ł?czem

iptables -t mangle -A PREROUTING -i eth1 -p icmp -s 192.168.0.0/16 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 81:100 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 80 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 8080 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 443 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 4902 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 119 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 8074 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 3510 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 22 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 23 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 2510 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 2010 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 2225 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 995 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 17001 -j MARK --set-mark 3
#iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 88 -j MARK --set-mark 3

iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 25 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 21 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 20 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 110 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m layer7 --l7proto skypetoskype -j MARK --set-mark 2
# na tym zle dziala :(
#iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m layer7 --l7proto skypeout -j MARK --set-mark 2
#iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m layer7 --l7proto http -j MARK --set-mark 2
# programy p2p
############p2p   layer 7        #########################
##########################3################################
iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m layer7 --l7proto bittorrent -j MARK --set-mark 4
iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m layer7 --l7proto edonkey -j MARK --set-mark 4
#iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m layer7 --l7proto fasttrack -j MARK --set-mark 4
iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m layer7 --l7proto gnutella -j MARK --set-mark 4
#iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m layer7 --l7proto napster -j MARK --set-mark 4
#iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m layer7 --l7proto directconnect -j MARK --set-mark 4
iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m layer7 --l7proto ares -j MARK --set-mark 4
#blokada p2p na ###########################################
iptables -t mangle -A PREROUTING -i eth1 -s 192.168.0.0/16 -m ipp2p --ipp2p -j MARK --set-mark 4

##############################################################
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 7171 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p udp -s 192.168.0.0/16 --dport 7171 -j MARK --set-mark 3

##############################################################
# ostatecznie jednak nadpisujemy numerkiem
iptables -t mangle -A PREROUTING -i eth1 -p udp -s 192.168.0.0/16 --dport 53 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 --dport 53 -j MARK --set-mark 3

iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 192.168.0.0/16 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 173.16.1.0/24 -j MARK --set-mark 3 # podsieć dsl #1
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 173.16.0.0/24 -j MARK --set-mark 3  # podsieć dsl #2
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 10.0.0.0/16 -j MARK --set-mark 2  # podsieć dsl #2
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 173.16.0.199 --dport 80 -j MARK --set-mark 4 # podsieć dsl #2
#iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 173.16.2.199 --dport 80 -j MARK --set-mark 4 # podsieć dsl #4
iptables -t mangle -A PREROUTING -i eth1 -p udp -s 192.168.0.0/16 -d 192.168.0.199 --dport 53 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 192.168.0.199 --dport 53 -j MARK --set-mark 3

iptables -t mangle -A PREROUTING -i eth1  -s 192.168.0.0/16 -d 81.219.253.124 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1  -s 192.168.0.0/16 -d 194.228.111.109 -j MARK --set-mark 3
#iptables -t mangle -A PREROUTING -i eth1 -p udp -s 192.168.0.0/16 -d 81.219.253.124 -j MARK --set-mark 3
#iptables -t mangle -A PREROUTING -i eth1 -p udp -s 192.168.0.0/16 -d 194.228.111.109 -j MARK --set-mark 3

#iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 193.179.213.83 -j MARK --set-mark 3
#iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 193.179.213.84 -j MARK --set-mark 3
#iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 193.179.213.85 -j MARK --set-mark 3

#iptables -t mangle -A PREROUTING -i eth1 -p tcp -s 192.168.0.0/16 -d 173.16.0.199 --dport 80 -j MARK --set-mark 2 # podsieć dsl #2
# startujemy niceshapera
sleep 10
niceshaper start

iptables -A FORWARD -s 192.168.1.0/24 -p tcp --tcp-flags SYN,RST,ACK SYN -m connlimit --connlimit-above 100 --connlimit-mask 32 -j DROP