squid代理+tc限速在內部網絡的管理應用
Squid配置
acl you src 192.168.0.0/255.255.0.0
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
http_access allow manager localhost
http_access deny manager
http_access allow localhost
http_access allow you
http_access deny all
icp_access allow all
http_port 80 transparent
hierarchy_stoplist cgi-bin ?
cache_mem 500 MB
maximum_object_size_in_memory 6400 KB
cache_dir ufs /var/spool/squid 75000 16 256
maximum_object_size 40960 KB
cache_swap_low 80
cache_swap_high 85
logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
logfile_rotate 3
pid_filename /var/run/squid.pid
client_netmask 255.255.255.255
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
acl bitter urlpath_regex -i \.avi$ \.wmv$ \.rmvb$ \.mov$
http_access deny bitter
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i \.html$ 0 20% 720 reload-into-ims
refresh_pattern -i \.gif$ 0 20% 1440 reload-into-ims
refresh_pattern -i \.jpg$ 0 20% 1440 reload-into-ims
refresh_pattern -i \.png$ 0 20% 1440 reload-into-ims
refresh_pattern -i \.jpeg$ 0 20% 1440 reload-into-ims
refresh_pattern -i \.bmp$ 0 20% 1440 reload-into-ims
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
cache_mgr root
cache_effective_user squid
cache_effective_group squid
visible_hostname 192.168.2.1
dns_nameservers 202.96.134.33 8.8.8.8
hosts_file /etc/hosts
max_filedesc 65536
coredump_dir /var/spool/squid
ulimit 設置
ulimit –n 65535
vi /etc/security/limits.conf
* soft nofile 65535
* hard nofile 65535
內核參數優化
在/etc/sysctl.conf配置文件最後添加如下
net.ipv4.tcp_max_tw_buckets = 6000
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 16384 4194304
net.core.wmem_default = 8388608
net.core.rmem_default = 8388608
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 262144
net.core.somaxconn = 262144
net.ipv4.tcp_max_orphans = 3276800
net.ipv4.tcp_max_syn_backlog = 262144
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_synack_retries = 1
net.ipv4.tcp_syn_retries = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 94500000 915000000 927000000
net.ipv4.tcp_fin_timeout = 1
net.ipv4.tcp_keepalive_time = 30
net.ipv4.ip_local_port_range = 1024 65000
最後執行sysctl –p
iptables腳本如下
vi ipt.sh
#!/bin/bash
# this is squid iptables rules script
iptables -Z
iptables -F
iptables -X
iptables -t nat -Z
iptables -t nat -F
iptables -t nat -X
iptables -t nat -A PREROUTING -s 192.168.0.0/16 -p tcp --dport 80 -j REDIRECT --to-ports 80
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -P FORWARD ACCEPT
service iptables save
service iptables restart
然後運行chmod +x ipt.sh，最後運行./ipt.sh
tc限速腳本配置如下，對局域網內的每個ip進行限速
Vi tc.sh
tc qdisc del dev eth0 root
tc qdisc add dev eth0 root handle 1: htb r2q 1
tc class add dev eth0 parent 1: classid 1:1 htb rate 10000kbps burst 1500k
for ((p=2;p<250;p++))
do
tc class add dev eth0 parent 1:1 classid 1:$p htb rate 20kbps ceil 200kbps
tc qdisc add dev eth0 parent 1:$p handle $p: sfq perturb 10
tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dst 192.168.2.$p flowid 1:$p
if [ $p = 249 ];then
for ((i=250;i<500;i++))
do
tc class add dev eth0 parent 1:1 classid 1:$i htb rate 20kbps ceil 200kbps
tc qdisc add dev eth0 parent 1:$i handle $i: sfq perturb 10
c=`expr $i - $p + 1`
tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dst 192.168.1.$c flowid 1:$i
done
fi
done
然後運行chmod +x tc.sh，最後運行./tc.sh