спрашиваю у знающих помогите , разясните
как правильно прописать диапазон IP адресов от 90.189.192.0 до 90.189.192.255 и от 90.189.193.0 до 90.189.193.255 в iptables -A PREROUTING -t mangle -s 0.0.0.0 -j MARK --set-mark 6 может так
iptables -A PREROUTING -t mangle -s 90.189.193.0/255 -j MARK --set-mark 6
iptables -A PREROUTING -t mangle -s 90.189.192.0/255 -j MARK --set-mark 6
и куда это запихать в какую строчку
#!/bin/sh
. /etc/kconfig
LOG="logger -t init.d"
start() {
$LOG "Iptables start"
LIMIT=`flash get SERVICELIMIT_ENABLED | cut -f 2- -d =`
HIDENET=`flash get HIDENET_ENABLED | cut -f 2- -d =`
WINS_ENABLED=`flash get WINS_ENABLED | cut -f 2- -d =`
LAN_IP_ADDR=`flash get LAN_IP_ADDR | cut -f 2- -d =`
LAN_IP_ADDR2=`flash get LAN_IP_ADDR2 | cut -f 2- -d =`
LAN_SUBNET=`flash get LAN_SUBNET | cut -f 2- -d =`
LAN_SUBNET2=`flash get LAN_SUBNET2 | cut -f 2- -d =`
LAN_IP_ACC=`flash get LAN_IP_ADDR | cut -f 2- -d = | cut -f -3 -d .`.0
SHAPER_SUPPORT=`flash get SHAPER_ENABLE | cut -f 2- -d =`
IP2P_SUPPORT=`flash get SHAPER_IP2P_ENABLE | cut -f 2- -d =`
L7_SUPPORT=`flash get SHAPER_L7_ENABLE | cut -f 2- -d =`
HIGH_PRIO_PORTS=`flash get HIGH_PRIO_PORTS | cut -f 2- -d =`
LOW_PRIO_PORTS=`flash get LOW_PRIO_PORTS | cut -f 2- -d =`
SHAPER_IN_ENABLE=`flash get SHAPER_IN_ENABLE | cut -f 2- -d =`
ACCOUNT=`flash get ACCOUNT_ENABLED | cut -f 2- -d =`
IPV6=`flash get IPV6_ENABLED | cut -f 2- -d =`
WLAN_QoS=`flash get WLAN_QoS | cut -f 2- -d =`
IGMP_PROXY=`flash get IGMP_PROXY | cut -f 2- -d =`
RIP_ENABLE=`flash get RIP_ENABLE | cut -f 2- -d =`
#------------------------------------SHAPER-MARK----------------------------
#flush rules
iptables -F shaperpre -t mangle
iptables -F shaperpost -t mangle
if [ "$SHAPER_SUPPORT" = "on" ]; then
INCOMING="iptables -A shaperpre -t mangle"
OUTGOING="iptables -A shaperpost -t mangle"
###Mark input packets for QoS--------------------------------------------------
#high prio
if [ "$SHAPER_IN_ENABLE" = "on" ]; then
$INCOMING -i ppp+ -p tcp --dport 0:1024 -j MARK --set-mark 20 вставил две строчки сюда
$INCOMING -i ppp+ -p tcp --sport 0:1024 -j MARK --set-mark 20
$INCOMING -i ppp+ -p udp --dport 0:1024 -j MARK --set-mark 21
$INCOMING -i ppp+ -p udp --sport 0:1024 -j MARK --set-mark 21
$INCOMING -i ppp+ -p tcp --syn -j MARK --set-mark 20
$INCOMING -i ppp+ -p icmp -m mark --mark 0 -j MARK --set-mark 20
$INCOMING -i ppp+ -p tcp -m length --length :64 -j MARK --set-mark 20
#user excludes
$INCOMING -i ppp+ -p tcp -m multiport --dport $HIGH_PRIO_PORTS -j MARK --set-mark 20
$INCOMING -i ppp+ -p udp -m multiport --dport $HIGH_PRIO_PORTS -j MARK --set-mark 20
$INCOMING -i ppp+ -p tcp -m multiport --dport $LOW_PRIO_PORTS -j MARK --set-mark 21
$INCOMING -i ppp+ -p udp -m multiport --dport $LOW_PRIO_PORTS -j MARK --set-mark 21
#low prio
if [ "$IP2P_SUPPORT" = "on" ]; then
$INCOMING -i ppp+ -p tcp -j CONNMARK --restore-mark
$INCOMING -i ppp+ -p tcp -m ipp2p --ipp2p -j MARK --set-mark 22
$INCOMING -i ppp+ -p tcp -m mark --mark 22 -j CONNMARK --save-mark
$INCOMING -i ppp+ -p udp -m ipp2p --ipp2p -j MARK --set-mark 22
else
rmmod ipt_ipp2p > /dev/null 2>&1
fi
if [ "$L7_SUPPORT" = "on" ]; then
$INCOMING -i ppp+ -p tcp -m layer7 --l7proto h323 -j MARK --set-mark 20
$INCOMING -i ppp+ -p tcp -m layer7 --l7proto rdp -j MARK --set-mark 20
$INCOMING -i ppp+ -p tcp -m layer7 --l7proto sip -j MARK --set-mark 20
$INCOMING -i ppp+ -p udp -m layer7 --l7proto sip -j MARK --set-mark 20
$INCOMING -i ppp+ -p udp -m layer7 --l7proto skypeout -j MARK --set-mark 20
$INCOMING -i ppp+ -p udp -m layer7 --l7proto skypetoskype -j MARK --set-mark 20
$INCOMING -i ppp+ -p tcp -m layer7 --l7proto bittorrent -j MARK --set-mark 22
$INCOMING -i ppp+ -p udp -m layer7 --l7proto bittorrent -j MARK --set-mark 22
else
rmmod ipt_layer7 > /dev/null 2>&1
fi
$INCOMING -i ppp+ -p tcp -m mark --mark 0 -j MARK --set-mark 22
$INCOMING -i ppp+ -p udp -m mark --mark 0 -j MARK --set-mark 22
fi
#####Mark output packets for QoS--------------------------------------------------------
#high prio
$OUTGOING -o ppp+ -p tcp --dport 0:1024 -j MARK --set-mark 23
$OUTGOING -o ppp+ -p udp --dport 0:1024 -j MARK --set-mark 23
$OUTGOING -o ppp+ -p tcp --sport 0:1024 -j MARK --set-mark 23
$OUTGOING -o ppp+ -p udp --sport 0:1024 -j MARK --set-mark 23
$OUTGOING -o ppp+ -p icmp -m mark --mark 0 -j MARK --set-mark 23
$OUTGOING -o ppp+ -p tcp -m length --length :64 -j MARK --set-mark 23
#user excludes
$OUTGOING -o ppp+ -p tcp -m multiport --dport $HIGH_PRIO_PORTS -j MARK --set-mark 23
$OUTGOING -o ppp+ -p udp -m multiport --dport $HIGH_PRIO_PORTS -j MARK --set-mark 23
$OUTGOING -o ppp+ -p tcp -m multiport --dport $LOW_PRIO_PORTS -j MARK --set-mark 24
$OUTGOING -o ppp+ -p udp -m multiport --dport $LOW_PRIO_PORTS -j MARK --set-mark 24
if [ "$IP2P_SUPPORT" = "on" ]; then
$OUTGOING -o ppp+ -p tcp -j CONNMARK --restore-mark
$OUTGOING -o ppp+ -p tcp -m ipp2p --ipp2p -j MARK --set-mark 24
$OUTGOING -o ppp+ -p tcp -m mark --mark 22 -j CONNMARK --save-mark
$OUTGOING -o ppp+ -p udp -m ipp2p --ipp2p -j MARK --set-mark 24
fi
if [ "$L7_SUPPORT" = "on" ]; then
$OUTGOING -o ppp+ -p tcp -m layer7 --l7proto h323 -j MARK --set-mark 23
$OUTGOING -o ppp+ -p tcp -m layer7 --l7proto rdp -j MARK --set-mark 23
$OUTGOING -o ppp+ -p tcp -m layer7 --l7proto sip -j MARK --set-mark 23
$OUTGOING -o ppp+ -p udp -m layer7 --l7proto sip -j MARK --set-mark 23
$OUTGOING -o ppp+ -p udp -m layer7 --l7proto skypeout -j MARK --set-mark 23
$OUTGOING -o ppp+ -p udp -m layer7 --l7proto skypetoskype -j MARK --set-mark 23
$OUTGOING -o ppp+ -p tcp -m layer7 --l7proto bittorrent -j MARK --set-mark 24
$OUTGOING -o ppp+ -p udp -m layer7 --l7proto bittorrent -j MARK --set-mark 24
fi
#low prio
$OUTGOING -o ppp+ -p tcp -m mark --mark 0 -j MARK --set-mark 24
$OUTGOING -o ppp+ -p udp -m mark --mark 0 -j MARK --set-mark 24
#return to up chains
iptables -A shaperpre -t mangle -j RETURN
iptables -A shaperpost -t mangle -j RETURN
else
#shaper down
rmmod ipt_ipp2p > /dev/null 2>&1
rmmod ipt_layer7 > /dev/null 2>&1
fi
#rules for ipv6 support
if [ "$CONFIG_IPV6" != "" ] && [ "$IPV6" = "1" ]; then
echo "Add iptables rules fo ipv6"
iptables -I INPUT -p ipv6 -j ACCEPT
iptables -I OUTPUT -p ipv6 -j ACCEPT
iptables -I FORWARD -p ipv6 -j ACCEPT
ip6tables -F
ip6tables -A INPUT -j ACCEPT
ip6tables -A FORWARD -j ACCEPT
ip6tables -A OUTPUT -j ACCEPT
fi
#------------------------------------LIMIT----------------------------------
#flush rules
iptables -F servicelimit
if [ "$LIMIT" != "0" ]; then
$LOG "Limit services connections"
#add chain in 10518 string utility.c
iptables -F servicelimit
#telnet ssh snmp limit
iptables -A servicelimit -p tcp --dport 21:23 -m connlimit --connlimit-above 4 -j REJECT
#web limit
iptables -A servicelimit -p tcp --dport 80 -m connlimit --connlimit-above 16 -j REJECT
#samba limit
iptables -A servicelimit -p tcp --dport 139 -m connlimit --connlimit-above 10 -j REJECT
#icmp limit
iptables -A servicelimit -p icmp --icmp-type echo-request -m limit --limit 10/s -j RETURN
iptables -A servicelimit -p icmp --icmp-type echo-request -j DROP
else
$LOG "Limit connection disabled by user!"
fi
#not rejected/dropped return to up chains
iptables -A servicelimit -j RETURN
#------------------------------------HIDE-LOCALNET--------------------------
iptables -t mangle -D POSTROUTING -p tcp -o ppp+ -j TTL --ttl-set 64 > /dev/null 2>&1
iptables -t mangle -D POSTROUTING -p tcp -o vc+ -j TTL --ttl-set 64 > /dev/null 2>&1
if [ "$HIDENET" != "0" ]; then
$LOG "Set ttl=64 for all output ppp+ and vc packets"
#modify only TCP!!! No need UDP/ICMP modify
echo 64 > /proc/sys/net/ipv4/ip_default_ttl
iptables -t mangle -I POSTROUTING -p tcp -o ppp+ -j TTL --ttl-set 64
iptables -t mangle -I POSTROUTING -p tcp -o vc+ -j TTL --ttl-set 64
fi
#------------------------------------IGMP-PROXY-UDPXY-----------------------
iptables -D INPUT -s 224.0.0.0/4 -p ! tcp -j ACCEPT > /dev/null 2>&1
iptables -D INPUT -d 224.0.0.0/4 -p ! tcp -j ACCEPT > /dev/null 2>&1
if [ "$WLAN_QoS" = "1" ] || [ "$IGMP_PROXY" = "1" ] || [ "$RIP_ENABLE" = "1" ]; then
$LOG "Enable recive multicast..."
iptables -I INPUT -s 224.0.0.0/4 -p ! tcp -j ACCEPT
iptables -I INPUT -d 224.0.0.0/4 -p ! tcp -j ACCEPT
fi
#--------------------------------------accountings--------------------------
if [ "$ACCOUNT" != "0" ]; then
$LOG "Start ipt_accounting"
modprobe ipt_account > /dev/null 2>&1
iptables -D FORWARD -j ipaccount > /dev/null 2>&1
iptables -X ipaccount > /dev/null 2>&1
iptables -N ipaccount > /dev/null 2>&1
iptables -F ipaccount > /dev/null 2>&1
iptables -A ipaccount -m account --aname mynetwork --aaddr $LAN_IP_ACC/24 --ashort
iptables -I FORWARD -j ipaccount
echo "reset" > /proc/net/ipt_account/mynetwork
echo "show=src-and-dst" > /proc/net/ipt_account/mynetwork
echo "reset-on-read=no" > /proc/net/ipt_account/mynetwork
else
rmmod ipt_account > /dev/null 2>&1
fi
#------------------------------------EXTERNAL-RULES-------------------------
$LOG "Start user routes chains from /rwfs/network/routes"
/rwfs/network/routes
$LOG "Start user iptables chains from /rwfs/network/iptables"
/rwfs/network/iptables
}
stop() {
$LOG "Iptables stop"
iptables -F
iptables -t nat -F
iptables -t filter -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t filter -X
iptables -t mangle -X
iptables -t mangle -F PREROUTING
iptables -t mangle -F FORWARD
iptables -t mangle -F INPUT
iptables -t mangle -F OUTPUT
iptables -t mangle -F POSTROUTING
iptables -t nat -Z
iptables -t filter -Z
iptables -t mangle -Z
iptables -Z
}
case "$1" in
start)
start
;;
stop)
stop
;;
restart)
stop
start
;;
*)
echo $"Usage: $0 {start|stop|restart}"
exit 1
esac
А то я запихал куда придумал и внутресетевой трафик перестал ограничеватся (что и требовалось)но с этим шейпир перестал ограничевать внешний интернет по подписки .Подписка 1024Кб в шейпире ставлю 512Кб интернет безлимитный с лимитом 60 гигов в месяц сетка 5 кампов высасывает 60г за10-15 дней
Постоянно зависал, и вообще я в D-Link*е разочаровался!!!
,а по LAN нет
. инструкцию надо переводить самим от ACORP на дождешся 
