Limit bandwidth for specific IP addresses in OpenWrt
1. Script for limiting bandwidth
Use a custom script to limit the bandwidth for specific IP addresses or address ranges for connected devices.
# !/bin/sh
# Define incoming and outgoing interfaces (IDEV for internal network interface, ODEV for external network interface)
IDEV=”tunAcc”
ODEV=”br-wan”
# Define total upstream and downstream bandwidth
UP=”100mbit”
DOWN=”100mbit”
# Define the bandwidth for each restricted IP
# rate initial bandwidth (default limit, single IP limit bandwidth)
UPLOAD=”5.2mbit”
DOWNLOAD=”5.2mbit”
# cei1 maximum bandwidth (the maximum bandwidth that can be borrowed when bandwidth is surplus, this is also the total bandwidth for all restricted IPs)
MUPLOAD=”5.2mbit”
MDOWNLOAD=”5mbit”
# Internal network segment I
INET=”172.17.2.”
# Restricted range, starting IP, ending IP.
IPS=”190″
TPE=”190″
# Clear original queue rules of the network card
tc gdisc del dev $ODEV root 2>/dev/null
tc gdisc del dev $IDEV root 2>/dev/null
# Define the top-level (root) queue rules, category number and specify
tc gdisc add dev $ODEV root handle 10: htb default 256
tc gdisc add dev $IDEV root handle 10: htb default 256
# Define the first layer category 10:1 (upstream/downstream total bandwidth)
tc class add dev $ODEV parent 10: classid 10:1 htb rate $UP ceil $UP
tc class add dev $IDEV parent 10: classid 10:1 htb rate $DOWN ceil $DOWN
# Start iptables marking and setting specific rules
i=$IPS
while [ $i -le $TPE ] ; do
tc class add dev $ODEV parent 10:1 classid 10:2$i htb rate $UPLOAD ceil $MUPLOAD prio 1
tc qdisc add dev $ODEV parent 10:2$i handle 1$i pfifo
tc filter add dev $ODEV parent 10: protocol ip prio 100 handle 2$i fw classid 10:2$i
tc class add dev $IDEV parent 10:1 classid 10:2$i htb rate $DOWNLOAD ceil $MDOWNLOAD prio 1
tc qdisc add dev $IDEV parent 10:2$i handle $i pfifo
tc filter add dev $IDEV parent 10: protocol ip prio 100 handle 2$i fw classid 10:2$i
iptables -t mangle -A PREROUTING -s $INET$i -j MARK –set-mark 2$i
iptables -t mangle -A PREROUTING -s $INET$ -j RETURN
iptables -t mangle -A PREROUTING -d $INET$i -j MARK –set-mark 2$i
iptables -t mangle -A PREROUTING -s $INET$ -j RETURN
i=$(($i+1))
done