（悬赏50元RMB币）期待真正流量非对称问题！

adslcool

如上图，内网流量是控制了，可是外网进来的下行数据依然在接口排队，仍然会卡，期待解决！


现在开放一个Router OS 系统，欢迎诸位拍砖！
域名：testspeed.3322.org
用户名：demo
密 码：没有

搞了几天依然没效果，相信重赏之下必有勇夫！
好了我在淘宝直接给你冲QQ币，或者手机充值卡，怎样都行！

QQ:165306921
:)
限速脚本
# oct/18/2009 19:15:25 by routeros 2.9.6
# software id = S5KG-G0N
#
/ queue type
add name="Upload" kind=pcq pcq-rate=1000000 pcq-limit=50 \
    pcq-classifier=src-address pcq-total-limit=2000
add name="Download" kind=pcq pcq-rate=1000000 pcq-limit=50 \
    pcq-classifier=dst-address pcq-total-limit=2000
/ queue simple
add name="CQ" dst-address=192.168.0.0/24 interface=all parent=none priority=8 \
    queue=Download/Upload limit-at=0/0 max-limit=0/0 total-queue=default \
    disabled=no





防火墙脚本

# 防火墙
/ ip firewall connection tracking
set enabled=yes tcp-syn-sent-timeout=5s tcp-syn-received-timeout=5s \
    tcp-established-timeout=1d tcp-fin-wait-timeout=10s \
    tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s \
    tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s \
    udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m

/ ip firewall filter
add chain=input action=add-src-to-address-list protocol=tcp psd=21,3s,3,1 \
    address-list="port scanners" address-list-timeout=1d comment="ort \
    scanners to list " disabled=no
add chain=input action=add-src-to-address-list \
    tcp-flags=fin,!syn,!rst,!psh,!ack,!urg protocol=tcp address-list="port \
    scanners" address-list-timeout=1d comment="NMAP FIN Stealth scan" \
    disabled=no
add chain=input action=add-src-to-address-list tcp-flags=fin,syn protocol=tcp \
    address-list="port scanners" address-list-timeout=1d comment="SYN/FIN \
    scan" disabled=no
add chain=input action=add-src-to-address-list tcp-flags=syn,rst protocol=tcp \
    address-list="port scanners" address-list-timeout=1d comment="SYN/RST \
    scan" disabled=no
add chain=input action=add-src-to-address-list \
    tcp-flags=fin,psh,urg,!syn,!rst,!ack protocol=tcp address-list="port \
    scanners" address-list-timeout=1d comment="FIN/PSH/URG scan" disabled=no
add chain=input action=add-src-to-address-list \
    tcp-flags=fin,syn,rst,psh,ack,urg protocol=tcp address-list="port \
    scanners" address-list-timeout=1d comment="ALL/ALL scan" disabled=no
add chain=input action=add-src-to-address-list \
    tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg protocol=tcp address-list="port \
    scanners" address-list-timeout=1d comment="NMAP NULL scan" disabled=no
add chain=input action=drop src-address-list="port scanners" comment="  port \
    scanners " disabled=no
add chain=input action=drop src-address-list=black_list comment=" Black list " \
    disabled=no
add chain=input action=drop connection-state=invalid comment="drop invalid \
    packets" disabled=no
add chain=input action=accept connection-state=related comment="accept related \
    packets" disabled=no
add chain=input action=accept connection-state=established comment="accept \
    established packets" disabled=no
add chain=input action=drop protocol=tcp psd=21,3s,3,1 comment="detect and \
    drop port scan connections" disabled=no
add chain=input action=tarpit protocol=tcp connection-limit=3,32 \
    src-address-list=black_list comment="suppress DoS attack" disabled=no
add chain=input action=add-src-to-address-list protocol=tcp \
    connection-limit=10,32 address-list=black_list address-list-timeout=1d \
    comment="detect DoS attack" disabled=no
add chain=input action=drop dst-address-type=!local comment="drop all that is \
    not to local" disabled=no
add chain=input action=jump jump-target=ICMP protocol=icmp comment="jump to \
    chain ICMP" disabled=no
add chain=input action=jump jump-target=services comment="Jump to service" \
    disabled=no
add chain=input action=jump jump-target=virus comment="jump to Virus" \
    disabled=no
add chain=ICMP action=accept protocol=icmp icmp-options=0:0-255 limit=5,5 \
    comment="0:0 and limit for 5pac/s" disabled=no
add chain=ICMP action=accept protocol=icmp icmp-options=3:3 limit=5,5 \
    comment="3:3 and limit for 5pac/s" disabled=no
add chain=ICMP action=accept protocol=icmp icmp-options=3:4 limit=5,5 \
    comment="3:4 and limit for 5pac/s" disabled=no
add chain=ICMP action=accept protocol=icmp icmp-options=8:0-255 limit=5,5 \
    comment="8:0 and limit for 5pac/s" disabled=no
add chain=ICMP action=accept protocol=icmp icmp-options=11:0-255 limit=5,5 \
    comment="11:0 and limit for 5pac/s" disabled=no
add chain=services action=accept dst-port=8291 protocol=tcp comment="Allow \
    winbox" disabled=no
add chain=services action=accept dst-port=20-21 protocol=tcp comment="allow \
    ftp" disabled=no
add chain=services action=accept dst-port=8080 protocol=tcp comment="allow Web \
    Proxy" disabled=no
add chain=services action=accept src-address=127.0.0.1 dst-address=127.0.0.1 \
    comment="accept localhost" disabled=no
add chain=services action=accept dst-port=22 protocol=tcp comment="allow sftp, \
    ssh" disabled=no
add chain=services action=accept dst-port=23 protocol=tcp comment="allow \
    telnet" disabled=no
add chain=services action=accept dst-port=81 protocol=tcp comment="allow http, \
    webbox" disabled=no
add chain=services action=accept dst-port=20561 protocol=udp comment="allow \
    MACwinbox " disabled=no
add chain=services action=accept dst-port=5678 protocol=udp comment=" MT \
    Discovery Protocol" disabled=no
add chain=services action=accept dst-port=53 protocol=tcp comment="allow DNS \
    request" disabled=no
add chain=services action=accept dst-port=53 protocol=udp comment="Allow DNS \
    request" disabled=no
add chain=services action=accept dst-port=1701 protocol=udp comment="allow \
    L2TP" disabled=no
add chain=services action=accept dst-port=1723 protocol=tcp comment="allow \
    PPTP" disabled=no
add chain=services action=accept protocol=gre comment="allow PPTP and EoIP" \
    disabled=no
add chain=services action=accept protocol=ipencap comment="allow IPIP" \
    disabled=no
add chain=services action=accept dst-port=1900 protocol=udp comment="UPnP" \
    disabled=no
add chain=services action=accept dst-port=2828 protocol=tcp comment="UPnP" \
    disabled=no
add chain=services action=accept dst-port=67-68 protocol=udp comment="allow \
    DHCP" disabled=no
add chain=services action=accept dst-port=123 protocol=tcp comment="allow NTP" \
    disabled=no
add chain=services action=accept dst-port=161 protocol=tcp comment="allow \
    SNMP" disabled=no
add chain=services action=accept dst-port=443 protocol=tcp comment="allow \
    https for Hotspot" disabled=no
add chain=services action=accept dst-port=1080 protocol=tcp comment="allow \
    Socks for Hotspot" disabled=no
add chain=services action=accept dst-port=500 protocol=udp comment="allow \
    IPSec connections" disabled=no
add chain=services action=accept protocol=ipsec-esp comment="allow IPSec" \
    disabled=no
add chain=services action=accept protocol=ipsec-ah comment="allow IPSec" \
    disabled=no
add chain=services action=accept dst-port=179 protocol=tcp comment="Allow BGP" \
    disabled=no
add chain=services action=accept dst-port=520-521 protocol=udp comment="allow \
    RIP" disabled=no
add chain=services action=accept protocol=ospf comment="allow OSPF" \
    disabled=no
add chain=services action=accept dst-port=5000-5100 protocol=udp \
    comment="allow BGP" disabled=no
add chain=services action=accept dst-port=1720 protocol=tcp comment="allow \
    Telephony" disabled=no
add chain=services action=accept dst-port=1719 protocol=udp comment="allow \
    Telephony" disabled=no
add chain=services action=accept protocol=vrrp comment="allow VRRP " \
    disabled=no
add chain=forward action=drop connection-state=invalid comment="drop invalid \
    packets" disabled=no
add chain=output action=drop connection-state=invalid comment="drop invalid \
    packets" disabled=no
add chain=input action=drop comment="Drop All input" disabled=no

tmd

双线没有负载好呀

adslcool

现在是单线，我遇到很多时候不管单双线都会出现外网流量比内网流量大，如果达到ISP限制的情况，就开始排队，开始卡了！

adslcool

你看见没，上行2.5M没问题在Wan口也是，说明限速起作用了，就是下行，在接口处排队去了，正常数据不能及时通过！

WGHBOY

那是你的网络

adslcool

那是你的网络
WGHBOY 发表于 2009-11-10 15:07

                               
登录/注册后可看大图

难道我们这边网络都是这样吗？

我用的是pcq限速，你的呢？

WGHBOY

我的相差不大

adslcool

我的相差不大
WGHBOY 发表于 2009-11-11 01:01

                               
登录/注册后可看大图

你用的什么限速，这兄弟半夜1点还在网上真是勤奋

专卖精品

楼主可以先确定下载的数据不是内网的请求造成的，如果确定了，就找电信帮你做个防火墙过滤掉，其他没有办法

adslcool

input dorp 了除正常连接ros以外的所有连接，依然是客户机下载超过规定速度后，流量不对称，得论坛朋友指点，限速网卡指定为Wan(interface=ether2)，问题依旧，
原来是 interface=all

adslcool

附上限速脚本


# oct/18/2009 19:15:25 by RouterOS 2.9.6
# software id = S5KG-G0N
#
/ queue type
add name="Upload" kind=pcq pcq-rate=1000000 pcq-limit=50 \
    pcq-classifier=src-address pcq-total-limit=2000
add name="Download" kind=pcq pcq-rate=1000000 pcq-limit=50 \
    pcq-classifier=dst-address pcq-total-limit=2000
/ queue simple
add name="PCQ" dst-address=192.168.0.0/24 interface=all parent=none priority=8 \
    queue=Download/Upload limit-at=0/0 max-limit=0/0 total-queue=default \
    disabled=no

adslcool

input dorp 了除正常连接ros以外的所有连接，依然是客户机下载超过规定速度后，流量不对称，得论坛朋友 ...
adslcool 发表于 2009-11-12 19:06

                               
登录/注册后可看大图

interface=all
应该包含了interface=（网卡名称）

seignior

我一直觉得是理所当然的事情，而且随着流量的增加，差额会成正比.......感觉和显示有关系....

bow

内网p2p应用就是这样的效果

9939781

这是无法也不可能避免的