# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
set -e

# Wait while network will be up
sleep 15

# Modules
insmod sch_htb > /dev/null 2>&1||true
insmod sch_sfq > /dev/null 2>&1||true
insmod cls_fw > /dev/null 2>&1||true
insmod cls_flow > /dev/null 2>&1||true

# Delete old qdiscs
tc qdisc del dev br-lan root > /dev/null 2>&1 ||true

# This one for internal traffic
tc qdisc add dev br-lan root handle 1: htb
tc class add dev br-lan parent 1: classid 1:1 htb rate 100mbit

# UA-IX
tc class add dev br-lan parent 1:1 classid 1:10 htb rate 50mbit ceil 100mbit

# World
tc class add dev br-lan parent 1:1 classid 1:20 htb rate 50mbit

# Bunker UA-IX
tc class add dev br-lan parent 1:10 classid 1:100 htb rate 10mbit ceil 100mbit
# Bunker World
tc class add dev br-lan parent 1:20 classid 1:200 htb rate 10mbit ceil 50mbit

# Other UA-IX
tc class add dev br-lan parent 1:10 classid 1:110 htb rate 40mbit ceil 100mbit
# Other World
tc class add dev br-lan parent 1:20 classid 1:210 htb rate 40mbit ceil 50mbit

# SFQ
tc qdisc add dev br-lan parent 1:100 handle 100: sfq perturb 10
tc qdisc add dev br-lan parent 1:200 handle 200: sfq perturb 10
tc qdisc add dev br-lan parent 1:110 handle 110: sfq perturb 10
tc qdisc add dev br-lan parent 1:210 handle 210: sfq perturb 10

#===========================================================================

# This one for outgoing traffic
# Delete old qdiscs
tc qdisc del dev eth1 root > /dev/null 2>&1 ||true

tc qdisc add dev eth1 root handle 4: htb
tc class add dev eth1 parent 4: classid 4:1 htb rate 100mbit

# UA-IX
tc class add dev eth1 parent 4:1 classid 4:10 htb rate 50mbit ceil 100mbit

# World
tc class add dev eth1 parent 4:1 classid 4:20 htb rate 50mbit

# Bunker
tc class add dev eth1 parent 4:10 classid 4:100 htb rate 10mbit ceil 100mbit
tc class add dev eth1 parent 4:20 classid 4:200 htb rate 10mbit ceil 50mbit

# Other
tc class add dev eth1 parent 4:10 classid 4:110 htb rate 40mbit ceil 100mbit
tc class add dev eth1 parent 4:20 classid 4:210 htb rate 40mbit ceil 50mbit

# SFQ
tc qdisc add dev eth1 parent 4:100 handle 100: sfq perturb 10
tc qdisc add dev eth1 parent 4:200 handle 200: sfq perturb 10
tc qdisc add dev eth1 parent 4:110 handle 110: sfq perturb 10
tc qdisc add dev eth1 parent 4:210 handle 210: sfq perturb 10

tc filter add dev eth1 parent 100: protocol ip handle 100 flow hash keys nfct-src divisor 1024
tc filter add dev eth1 parent 110: protocol ip handle 110 flow hash keys nfct-src divisor 1024
tc filter add dev eth1 parent 200: protocol ip handle 200 flow hash keys nfct-src divisor 1024
tc filter add dev eth1 parent 210: protocol ip handle 210 flow hash keys nfct-src divisor 1024

tc filter add dev br-lan parent 100: protocol ip handle 100 flow hash keys dst divisor 1024
tc filter add dev br-lan parent 110: protocol ip handle 110 flow hash keys dst divisor 1024
tc filter add dev br-lan parent 200: protocol ip handle 200 flow hash keys dst divisor 1024
tc filter add dev br-lan parent 210: protocol ip handle 210 flow hash keys dst divisor 1024

#===========================================================================


echo "Creating ip hash"
ipset -N ua_ix nethash > /dev/null 2>&1 ||true

# Need to remove the link from FORWARD to the CLASSIFICATION chain before
# we'll be able to delete the chain
LINE_NUM=$(iptables -t mangle -nL FORWARD |sed -n '3,$p' |grep CLASSIFICATION -n |awk -F':' '{print $1}' |head -1)
while [ -n "$LINE_NUM" ]; do
  iptables -t mangle -D FORWARD "$LINE_NUM"
  LINE_NUM=$(iptables -t mangle -nL FORWARD |sed -n '3,$p' |grep CLASSIFICATION -n |awk -F':' '{print $1}' |head -1)
done

iptables -t mangle -F CLASSIFICATION ||true
iptables -t mangle -X CLASSIFICATION ||true
iptables -t mangle -N CLASSIFICATION ||true
iptables -t mangle -A FORWARD -j CLASSIFICATION

#
# Marking
#
# Bunker
# Outgoing
iptables -o eth1 -t mangle -A CLASSIFICATION -m set --src 192.168.1.10 --set ua_ix dst -j CLASSIFY --set-class 4:100
iptables -o eth1 -t mangle -A CLASSIFICATION -m set --src 192.168.1.10 ! --set ua_ix dst -j CLASSIFY --set-class 4:200

# Incoming
iptables -o br-lan -t mangle -A CLASSIFICATION -m set --dst 192.168.1.10 --set ua_ix src -j CLASSIFY --set-class 1:100
iptables -o br-lan -t mangle -A CLASSIFICATION -m set --dst 192.168.1.10 ! --set ua_ix src -j CLASSIFY --set-class 1:200

# Other
# Outgoing
iptables -o eth1 -t mangle -A CLASSIFICATION -m set ! --src 192.168.1.10 --set ua_ix dst -j CLASSIFY --set-class 4:110
iptables -o eth1 -t mangle -A CLASSIFICATION -m set ! --src 192.168.1.10 ! --set ua_ix dst -j CLASSIFY --set-class 4:210

# Incoming
iptables -o br-lan -t mangle -A CLASSIFICATION -m set ! --dst 192.168.1.10 --set ua_ix src -j CLASSIFY --set-class 1:110
iptables -o br-lan -t mangle -A CLASSIFICATION -m set ! --dst 192.168.1.10 ! --set ua_ix src -j CLASSIFY --set-class 1:210

# Fill the set
((/root/create_ua_ix_ipset)&)&

echo "Done"