这篇文章上次修改于 1895 天前，可能其部分内容已经发生变化，如有疑问可询问作者。 ``` #Linux advanced router ip link show #显示链路 ip addr show #显示地址(或ifconfig) ip route show #显示路由(route -n) ip neigh show #显示arp表(ping 192.168.95.50，如果主机在同一局域网内，直接加到arp表) ip neigh delete 192.168.95.50 dev eth0 #删除arp条目，条目仍然存在状态为stale，下次通信需要确认 ip rule show #显示缺省规则 ip route del default dev eth0 #删除接口路由 ip route show table local #查看本地静态路由 ip route show table main #查看直连路由 ########### 未测 ########### echo 200 John >>/etc/iproute2/rt_tables #设置名字对于数值 ip rule add from 10.0.0.10 table John #指定源地址 ip route add default via 192.168.44.128 dev ppp2 table John #将数据指向该表网关 ip route flush cache ################################################################# #测试双线上网,负载均衡 ################################################################# #Local environment： #Output interface: #eth0:192.168.222.128 gateway:192.168.222.2 #eth2:192.168.1.109 gateway:192.168.1.109 #Input interface: #eth1:192.168.95.2 netmaks 255.255.255.0 ip rule add from 192.168.222.128 table 150 ip rule add from 192.168.1.109 table 151 ip route add default via 192.168.222.2 table 150 ip route add default via 192.168.1.1 table 151 #ip route add 192.168.222.0/24 dev eth0 src 192.168.222.128 table 150 #ip route add 192.168.1.0/24 dev eth2 src 192.168.1.109 table 151 ip route replace default scope global nexthop via 192.168.222.2 dev eth0 weight 1 nexthop via 192.168.1.1 dev eth2 weight 1 ip route flush cache iptables -t nat -A POSTROUTING -o eth0 -s 192.168.95.0/24 -j SNAT --to-source 192.168.222.128 iptables -t nat -A POSTROUTING -o eth2 -s 192.168.95.0/24 -j SNAT --to-source 192.168.1.109 echo "nameserver 210.21.4.130" >/etc/resole.conf ################################################## #测试双线上网,负载均衡，跟上面一样的，写法稍微好点 ################################################## #Local environment： #Output interface: #eth0:192.168.222.128 gateway:192.168.222.2 #eth2:192.168.1.109 gateway:192.168.1.109 #Input interface: #eth1:192.168.95.2 netmaks 255.255.255.0 ip rule add pref 10 from 192.168.222.128 table 10 ip rule add pref 10 from 192.168.1.109 table 20 ip route replace default via 192.168.222.2 dev eth0 table 10 ip route replace default via 192.168.1.1 dev eth2 table 20 #下面两句主要增加 #物理机通过nat接口(与eth0在同一网段)访问需要在网关加一条路由，通过bridged接口(与eth2在同一网段)访问正常 #ip route add 192.168.222.0/24 dev eth0 src 192.168.222.128 table 150 #ip route add 192.168.1.0/24 dev eth2 src 192.168.1.109 table 151 ip route replace default nexthop via 192.168.222.2 dev eth0 weight 4 nexthop via 192.168.1.1 dev eth2 weight 1 ip route flush cache iptables -t nat -A POSTROUTING -o eth0 -s 192.168.95.0/24 -j SNAT --to-source 192.168.222.128 iptables -t nat -A POSTROUTING -o eth2 -s 192.168.95.0/24 -j SNAT --to-source 192.168.1.109 #iptables -t nat -A POSTROUTING -m iprange --src-range 192.168.22.3-192.168.22.255 -j SNAT --to-source 192.168.1.254 #iptables -t nat -A POSTROUTING -m iprange --src-range 192.168.22.3-192.168.22.255 -j SNAT --to-source 192.168.233.2 echo "nameserver 210.21.4.130" >/etc/resole.conf ######################################################### #网络上个一个例子 ######################################################### #Link: http://www.study-area.org/tips/multipath.htm #實作指令 5.1 獲取當前各界面之 ip ： # ip address show 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo 2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:02:44:84:26:4f brd ff:ff:ff:ff:ff:ff inet 220.130.96.21/24 brd 220.130.96.255 scope global eth0 3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:20:ed:36:f9:74 brd ff:ff:ff:ff:ff:ff inet 192.168.100.2/24 brd 192.168.100.255 scope global eth1 4: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:02:b3:4b:69:49 brd ff:ff:ff:ff:ff:ff inet 10.1.2.3/24 brd 10.1.2.255 scope global eth2 15: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1492 qdisc pfifo_fast qlen 3 link/ppp inet 210.64.33.27 peer 210.64.33.1/32 scope global ppp0 5.2 設定 ip rule ： # ip rule add pref 10 from 220.130.96.21 table 10 # ip rule add pref 20 from 192.168.100.2 table 20 # ip rule add pref 30 from 210.64.33.27 table 30 5.3 設定 ip route 各 table ： # ip route replace default via 220.130.96.254 dev eth0 table 10 # ip route replace default via 192.168.100.1 dev eth1 table 20 # ip route replace default via 210.64.33.1 dev ppp0 table 30 5.4 設定 ip route main table： # ip route replace default \ > nexthop via 220.130.96.254 dev eth0 weight 4 \ > nexthop via 192.168.100.1 dev eth1 weight 1 \ > nexthop via 210.64.33.1 dev ppp0 weight 1 5.5 檢視 main table 規則： # ip route show 210.64.33.1 dev ppp0 proto kernel scope link src 210.64.33.27 192.168.100.0/24 dev eth1 scope link 220.130.96.0/24 dev eth0 scope link 10.1.2.0/24 dev eth2 scope link 169.254.0.0/16 dev eth2 scope link 127.0.0.0/8 dev lo scope link default nexthop via 220.130.96.254 dev eth0 weight 4 nexthop via 192.168.100.1 dev eth1 weight 1 nexthop via 210.64.33.1 dev ppp0 weight 1 5.6 刷新 route cache： # ip route flush cache 5.7 測試及確認連線生效： 基本上，若在輸入上述命令中沒遇到 error ，那設定就已完成。 接下來可起用多個對外連線(或用 ping)， 然後使用 tcpdump -i any 來查看封包是否能分攤在每一條連線上。 ################################################################# ######################################### ################################################################ tc 流量控制: #测试环境 Output: eth0 192.168.222.128 Input： eth1 192.168.95.2 ################################################################ #限制单个地址已测 #队列规定 qdisc(queueing discipline) ,类(class)和分类器(Classifiers) #清除接口所有规则 tc qdisc del dev eth1 root 2>/dev/null tc -s qdisc show dev eth1 #查看总的流量 #限制单个ip流量 tc qdisc add dev eth1 root handle 1: htb r2q 1 tc class add dev eth1 parent 1: classid 1:1 htb rate 100kbit ceil 200kbit tc filter add dev eth1 parent 1: protocol ip prio 1 u32 match ip dst 192.168.95.50 flowid 1:1 ################################################## #实际流量是这里6倍 tc qdisc del dev eth1 root 2>/dev/null tc qdisc add dev eth1 root handle 1: htb default 30 tc class add dev eth1 parent 1: classid 1:1 htb rate 15kbit ceil 15kbit tc class add dev eth1 parent 1:1 classid 1:10 htb rate 10kbit ceil 10kbit tc class add dev eth1 parent 1:1 classid 1:20 htb rate 5kbit ceil 5kbit tc qdisc add dev eth1 parent 1:10 handle 10: sfq perturb 10 tc qdisc add dev eth1 parent 1:20 handle 20: sfq perturb 10 tc filter add dev eth1 parent 1: protocol ip prio 1 u32 match ip dst 192.168.95.50 flowid 1:10 tc filter add dev eth1 parent 1: protocol ip prio 1 u32 match ip dst 192.168.95.51 flowid 1:20 tc class show dev eth1 classid 1:1 tc class show dev eth1 classid 1:10 tc class show dev eth1 classid 1:20 tc -s filter show dev eth1 tc -s class show dev eth1 tc -s class show dev eth1 classid 1:1 tc -s class show dev eth1 classid 1:10 tc -s class show dev eth1 classid 1:20 ################################################## iptables -t filter -F iptables -t filter -X iptables -t filter -Z iptables -t mangle -F iptables -t mangle -X iptables -t mangle -Z iptables -t nat -F iptables -t nat -X iptables -t nat -Z tc qdisc del dev eth1 root 2>/dev/null tc qdisc add dev eth1 root handle 1: htb default 30 tc class add dev eth1 parent 1: classid 1:1 htb rate 15kbit ceil 15kbits tc class add dev eth1 parent 1:1 classid 1:10 htb rate 10kbit ceil 10kbit tc class add dev eth1 parent 1:1 classid 1:20 htb rate 5kbit ceil 5kbit tc qdisc add dev eth1 parent 1:10 handle 10: sfq perturb 10 tc qdisc add dev eth1 parent 1:20 handle 20: sfq perturb 10 tc filter add dev eth1 parent 1: protocol ip prio 1 handle 6 fw flowid 1:10 tc filter add dev eth1 parent 1: protocol ip prio 1 handle 7 fw flowid 1:20 #对路由到本地的包有效速度控制 iptables -t mangle -A OUTPUT -o eth1 --destination 192.168.95.50 -j MARK --set-mark 0x6 iptables -t mangle -A OUTPUT -o eth1 --destination 192.168.95.51 -j MARK --set-mark 0x7 #对转发包速度控制 iptables -t mangle -A PREROUTING -i eth1 --source 192.168.95.50 -j MARK --set-mark 0x6 iptables -t mangle -A PREROUTING -i eth1 --source 192.168.95.51 -j MARK --set-mark 0x7 iptables -t filter -nvL iptables -t mangle -nvL ``` 参考： https://baturin.org/docs/iproute2/ https://developers.redhat.com/blog/2018/10/22/introduction-to-linux-interfaces-for-virtual-networking/
没有评论