一个高级策略路由的例子

建立一个可执行的shell文件S1.sh内容如下：

iptables -t mangle -F
iptables -A FORWARD -p tcp -s 219.216.130.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p tcp -s 219.216.131.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p tcp -s 219.216.132.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p tcp -s 219.216.133.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p tcp -s 219.216.134.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p tcp -s 219.216.135.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p tcp -s 219.216.136.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p tcp -s 219.216.137.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p tcp -s 219.216.145.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p tcp -s 219.216.146.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -A FORWARD -p tcp -s 219.216.147.0/24 --dport 80 -m state --state NEW -m connlimit --connlimit-above 20 -j DROP
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.130.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.131.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.132.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.133.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.134.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.135.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.136.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.137.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.145.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.146.0/24 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 80  -s 219.216.147.0/24 -j MARK --set-mark 1
##################################################################
ip route add table S1 default via 218.25.161.1
ip route add table S1 219.216.130.0 via 172.24.253.33
ip route add table S1 219.216.131.0 via 172.24.253.33
ip route add table S1 219.216.132.0 via 172.24.253.33
ip route add table S1 219.216.133.0 via 172.24.253.33
ip route add table S1 219.216.134.0 via 172.24.253.33
ip route add table S1 219.216.135.0 via 172.24.253.33
ip route add table S1 219.216.136.0 via 172.24.253.33
ip route add table S1 219.216.137.0 via 172.24.253.33
ip route add table S1 219.216.145.0 via 172.24.253.33
ip route add table S1 219.216.146.0 via 172.24.253.33
ip route add table S1 219.216.147.0 via 172.24.253.33

 

ip rule add fwmark 1 lookup S1
#############################################

反向路由选择local表，表项如下：

219.216.136.1 via 172.24.253.33 dev bond0
219.216.135.1 via 172.24.253.33 dev bond0
219.216.147.1 via 172.24.253.33 dev bond0
219.216.145.1 via 172.24.253.33 dev bond0
219.216.137.0/24 via 172.24.253.33 dev bond0
219.216.130.0/24 via 172.24.253.33 dev bond0
219.216.131.0/24 via 172.24.253.33 dev bond0
219.216.132.0/24 via 172.24.253.33 dev bond0
219.216.133.0/24 via 172.24.253.33 dev bond0
219.216.134.0/24 via 172.24.253.33 dev bond0
219.216.145.0/24 via 172.24.253.33 dev bond0
219.216.146.0/24 via 172.24.253.33 dev bond0
219.216.147.0/24 via 172.24.253.33 dev bond0
default via 219.216.128.1 dev eth2
其中，bond0为2块千兆网卡绑定为一个2000M的设备。

方法如下：

modprobe bonding
ifconfig bond0 172.24.253.34 netmask 255.255.255.252
ifenslave bond0 eth0
ifenslave bond0 eth1
ip link set dev bond0 txqlen 1500（设置队列长度为1500）