TC=/sbin/tc
IFETH=ens3 # Interface
$TC qdisc add dev $IFETH root handle 1: htb
$TC class add dev $IFETH parent 1:0 classid 1:5 htb rate 5mbit
$TC filter add dev $IFETH parent 1:0 protocol ip handle 5 fw flowid 1:5
/usr/sbin/iptables-legacy -A OUTPUT -t mangle -p tcp -d 0.0.0.0/0 -j MARK --set-mark 6
/usr/sbin/iptables-legacy -A OUTPUT -t mangle -p tcp -d 10.0.0.0/8 -j MARK --set-mark 2
/usr/sbin/iptables-legacy -A OUTPUT -t mangle -p tcp -d 192.168.0.0/16 -j MARK --set-mark 2
I want a kind of mark or priority to except my local Clients from the world to limit the outbound traffic.
table inet nft-qos-static {
define PRIVATE = {
192.168.0.0/16,
127.0.0.1,
10.0.0.0/8
}
chain local {
type filter hook prerouting priority 0; policy accept;
#ip protocol tcp ip saddr $PRIVATE limit rate over 10100 kbytes/second drop
}
chain upload {
type filter hook prerouting priority 1; policy accept;
ip protocol tcp ip saddr $PRIVATE limit rate over 51100 kbytes/second drop
ip protocol tcp limit rate over 2100 kbytes/second drop
}
chain download {
type filter hook postrouting priority 0; policy accept;
}
}
table netdev nft-qos-priority {
chain filter {
type filter hook ingress device ens3 priority 0; policy accept;
}
}