let me eat cake

iptables.rules

# /etc/iptables.rules

# Generated by iptables-save v1.6.1 on Sat Oct 19 09:21:09 2019
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:MINIUPNPD - [0:0]
# when using two cakes, prioritizing small packets is probably a bad idea
#-A PREROUTING -m length --length 0:128 -j MARK --set-mark 2
-A PREROUTING -i eth0 -j MINIUPNPD
COMMIT
# Completed on Sat Oct 19 09:21:09 2019
# Generated by iptables-save v1.6.1 on Sat Oct 19 09:21:09 2019
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:MINIUPNPD - [0:0]
-A INPUT -p icmp -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 68 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 68 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT

## DROP QUIC
-A INPUT -i eth0 -p udp -m udp --sport 80 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i eth0 -p udp -m udp --sport 443 -j REJECT --reject-with icmp-port-unreachable

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -p icmp -j ACCEPT

## DROP QUIC
-A FORWARD -i eth0 -p udp -m udp --sport 80 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i eth0 -p udp -m udp --sport 443 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i eth1 -p udp -m udp --dport 80 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i eth1 -p udp -m udp --dport 443 -j REJECT --reject-with icmp-port-unreachable

-A FORWARD -d 192.168.133.0/24 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.133.0/24 -i eth1 -j ACCEPT
-A FORWARD -i eth1 -o eth1 -j ACCEPT
-A FORWARD -i eth0 ! -o eth0 -j MINIUPNPD
-A FORWARD -o eth1 -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A FORWARD -i eth1 -p tcp -m tcp -j REJECT --reject-with tcp-reset
-A FORWARD -o eth1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i eth1 -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Sat Oct 19 09:21:09 2019
# Generated by iptables-save v1.6.1 on Sat Oct 19 09:21:09 2019
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
-A PREROUTING -i eth0 -j MINIUPNPD
-A POSTROUTING -o eth0 -j MINIUPNPD-POSTROUTING
-A POSTROUTING -s 192.168.133.0/24 ! -d 192.168.133.0/24 -j MASQUERADE
COMMIT
# Completed on Sat Oct 19 09:21:09 2019

local-ping-test

# ping -f over the LAN
while [[ 1 ]] ; do date ; time ping -f -s1400 -c10000 192.168.133.152 ; echo ; echo ; done | tee /dev/tty | rotatelogs local-ping-log 128M

tail -f local-ping-log.1573372564 | egrep --line-buffered '2019|max' | perl -p -e 'm!((?:\d+\.\d+/?){4})(.*)!,or next; $a=join("\t",split(m!/!,$1)); $_="$a\n\n"'

prio-cake.sh

#!/bin/bash

WAN_INTERFACE=eth0
LAN_INTERFACE=eth1

TC=/usr/sbin/tc

bandwidth=50Mbit

$TC qdisc del dev $WAN_INTERFACE root 2> /dev/null
$TC qdisc del dev $LAN_INTERFACE root 2> /dev/null

$TC qdisc add dev $WAN_INTERFACE root handle 1: prio bands 2 priomap  1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
$TC qdisc add dev $WAN_INTERFACE parent 1:1 cake besteffort internet nat egress ethernet
$TC qdisc add dev $WAN_INTERFACE parent 1:2 cake bandwidth $bandwidth besteffort internet nat egress ethernet


# dest ports only - 0xfc00 = 1023 ports from the base
for i in 20000 21000 22000 23000 24000 25000 26000 27000 28000 29000 30000 31000 32000 33000 34000 35000 36000 37000 38000 39000 40000 41000 42000 43000 44000 45000 ; do
  $TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip dport $i 0xfc00 flowid 1:1
done


# src and dest ports - 0xfc00 = 1023 ports from the base
for i in 3074 4500 9000 19000  ; do
  $TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip sport $i 0xfc00 flowid 1:1
  $TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip dport $i 0xfc00 flowid 1:1
done


# src and dest ports - 0xffff
for i in 22 53 ; do
  $TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip sport $i 0xffff flowid 1:1
  $TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip dport $i 0xffff flowid 1:1
done

$TC filter add dev $WAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip protocol 1 0xff flowid 1:1


# LAN

$TC qdisc add dev $LAN_INTERFACE root handle 1: prio bands 2 priomap  1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
$TC qdisc add dev $LAN_INTERFACE parent 1:1 cake besteffort internet nat ingress ethernet
$TC qdisc add dev $LAN_INTERFACE parent 1:2 cake bandwidth $bandwidth besteffort internet nat ingress ethernet


# src ports only - 0xfc00 = 1023 ports from the base
for i in 20000 21000 22000 23000 24000 25000 26000 27000 28000 29000 30000 31000 32000 33000 34000 35000 36000 37000 38000 39000 40000 41000 42000 43000 44000 45000 ; do
  $TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip sport $i 0xfc00 flowid 1:1
done


# src and dest ports - 0xfc00 = 1023 ports from the base
for i in 3074 4500 9000 19000  ; do
  $TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip sport $i 0xfc00 flowid 1:1
  $TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip dport $i 0xfc00 flowid 1:1
done


# src and dest ports - 0xffff
for i in 22 53 ; do
  $TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip sport $i 0xffff flowid 1:1
  $TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip dport $i 0xffff flowid 1:1
done


$TC filter add dev $LAN_INTERFACE protocol ip parent 1: prio 1 u32 match ip protocol 1 0xff flowid 1:1

exit 0

rc.local

#!/bin/bash

# /etc/rc.local	

echo never > /sys/kernel/mm/transparent_hugepage/enabled

#for i in xt_u32 cls_u32 em_u32 act_mirred cls_u32 cls_flow cls_fw sch_cake  \
#  nfnetlink_cthelper ip_tables iptable_nat nf_nat_ftp nf_nat_irc nf_nat_sip \
#  nf_nat_tftp nf_nat_pptp nf_nat_h323 ; do
#      /usr/sbin/modprobe $i
#done

for i in nfnetlink_cthelper ip_tables iptable_nat ; do
  /usr/sbin/modprobe $i
done

/usr/bin/systemctl stop miniupnpd
/usr/sbin/iptables-restore < /etc/iptables.rules

/usr/sbin/sysctl -p

for i in eth0 eth1 ; do
  for j in rx tx sg tso ufo gso gro lro ntuple rxhash ; do
    /usr/sbin/ethtool -K $i $j off
  done
# defaults:
#RX:             9709
#TX:             170
  /usr/sbin/ethtool -G $i rx 9709 tx 170
done

/usr/bin/systemctl start miniupnpd

bash prio-cake.sh	

reset-cake.sh

#!/bin/bash

# eth0 is WAN
# eth1 is LAN

/usr/sbin/tc qdisc del dev eth0 root 2> /dev/null
/usr/sbin/tc qdisc del dev eth1 root 2> /dev/null

/usr/sbin/tc qdisc add dev eth0 root cake besteffort internet nat egress ethernet
/usr/sbin/tc qdisc add dev eth1 root cake besteffort internet nat ingress ethernet

sysctl.conf

# /etc/sysctl.conf

net.ipv4.ip_forward=1
net.netfilter.nf_conntrack_helper=1
net.ipv4.tcp_ecn=2
net.ipv4.tcp_sack=1
net.ipv4.tcp_dsack=1

net.core.wmem_max=212992
net.ipv4.tcp_wmem=4096 16384 4194304

net.core.rmem_max=212992
net.ipv4.tcp_rmem=4096 131072 4194304

net.core.dev_weight=64
net.core.netdev_max_backlog=1000