[классика][shaper][tc][iptables] работает, но криво

#!/bin/bash

IPT="/sbin/iptables"
TC="/sbin/tc"
IP="/bin/ip"

DEV_IN="eth0"
RATE_IN="2850"

DEV_OUT="eth1"
RATE_OUT="600"

RATE_LOCAL="1gbit"
IP_LOCAL="192.168.0.254" # gw

stop(){
    $TC qdisc del dev $DEV_IN root >/dev/null 2>&1
    $TC qdisc del dev $DEV_OUT root >/dev/null 2>&1

    $IPT -t mangle -D POSTROUTING -o $DEV_IN -j SHAPER-IN >/dev/null 2>&1
    $IPT -t mangle -F SHAPER-IN >/dev/null 2>&1
    $IPT -t mangle -X SHAPER-IN >/dev/null 2>&1

    $IPT -t mangle -D POSTROUTING -o $DEV_OUT -j SHAPER-OUT >/dev/null 2>&1
    $IPT -t mangle -F SHAPER-OUT >/dev/null 2>&1
    $IPT -t mangle -X SHAPER-OUT >/dev/null 2>&1
}
    
start_in(){ 
    $IP link set dev $DEV_IN qlen 32
    
    $TC qdisc add dev $DEV_IN root handle 1: htb r2q 3 default 90
    
    # класс для НЕТРАНЗИТНЫХ пакетов
    # (идущих с lan'а в лок. сеть)
    $TC class add dev $DEV_IN parent 1:0 classid 1:1 htb rate $RATE_LOCAL quantum 60000 prio 99
        $TC qdisc add dev $DEV_IN parent 1:1 pfifo
        $TC filter add dev $DEV_IN parent 1:0 prio 1 protocol ip u32 match ip src $IP_LOCAL classid 1:1
    
    # класс для ТРАНЗИТНЫХ пакетов 
    # (идущих с wan'а в лок. сеть)
    $TC class add dev $DEV_IN parent 1:0 classid 1:2 htb rate ${RATE_IN}kbit ceil ${RATE_IN}kbit

        $TC class add dev $DEV_IN parent 1:2 classid 1:5  htb rate $[5*$RATE_IN/100]kbit  burst 10k ceil ${RATE_IN}kbit prio 5
        $TC class add dev $DEV_IN parent 1:2 classid 1:8  htb rate $[15*$RATE_IN/100]kbit burst 10k ceil ${RATE_IN}kbit prio 8
        $TC class add dev $DEV_IN parent 1:2 classid 1:10 htb rate $[10*$RATE_IN/100]kbit burst 10k ceil ${RATE_IN}kbit prio 10
        $TC class add dev $DEV_IN parent 1:2 classid 1:20 htb rate $[65*$RATE_IN/100]kbit burst 10k ceil ${RATE_IN}kbit prio 20
        $TC class add dev $DEV_IN parent 1:2 classid 1:30 htb rate $[4*$RATE_IN/100]kbit  burst 10k ceil ${RATE_IN}kbit prio 30
        $TC class add dev $DEV_IN parent 1:2 classid 1:90 htb rate $[1*$RATE_IN/100]kbit  burst 10k ceil ${RATE_IN}kbit prio 90

        $TC qdisc add dev $DEV_IN parent 1:5  handle 5:  sfq perturb 1
        $TC qdisc add dev $DEV_IN parent 1:8  handle 8:  sfq perturb 1
        $TC qdisc add dev $DEV_IN parent 1:10 handle 10: sfq perturb 1
        $TC qdisc add dev $DEV_IN parent 1:20 handle 20: sfq perturb 1
        $TC qdisc add dev $DEV_IN parent 1:30 handle 30: sfq perturb 1
        $TC qdisc add dev $DEV_IN parent 1:90 handle 90: sfq perturb 1

        $TC filter add dev $DEV_IN parent 1:0 prio 5  protocol ip handle 5  fw flowid 1:5
        $TC filter add dev $DEV_IN parent 1:0 prio 8  protocol ip handle 8  fw flowid 1:8
        $TC filter add dev $DEV_IN parent 1:0 prio 10 protocol ip handle 10 fw flowid 1:10
        $TC filter add dev $DEV_IN parent 1:0 prio 20 protocol ip handle 20 fw flowid 1:20
        $TC filter add dev $DEV_IN parent 1:0 prio 30 protocol ip handle 30 fw flowid 1:30
        $TC filter add dev $DEV_IN parent 1:0 prio 90 protocol ip handle 90 fw flowid 1:90

    # Добавление цепочки SHAPER-IN в mangle для последующей маркировки входящих пакетов (WAN->LAN)
    $IPT -t mangle -N SHAPER-IN
    $IPT -t mangle -I POSTROUTING -o $DEV_IN -j SHAPER-IN

    # SYN-пакеты
    $IPT -t mangle -A SHAPER-IN -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j MARK --set-mark 5
    # icmp, dns
    $IPT -t mangle -A SHAPER-IN -p icmp -j MARK --set-mark 5
    $IPT -t mangle -A SHAPER-IN -p udp --sport 53 -j MARK --set-mark 5
    # icecast
    $IPT -t mangle -A SHAPER-IN -p tcp -m multiport --sports 7000,8000 -j MARK --set-mark 8
    # ssh, rdp
    $IPT -t mangle -A SHAPER-IN -p tcp -m multiport --sports 22,11122,3389 -j MARK --set-mark 10
    # imap, imaps, pop3, pop3s
    $IPT -t mangle -A SHAPER-IN -p tcp -m multiport --sports 143,993,110,995 -j MARK --set-mark 10
    # http, https; ftp(20,21)
    $IPT -t mangle -A SHAPER-IN -p tcp -m multiport --sports 80,443,8080,20,21,81 -j MARK --set-mark 20
    # Закачки > 1MB http(80,8080), https; ftp(20,21)
    $IPT -t mangle -A SHAPER-IN -p tcp -m multiport --sports 80,8080,81,21 -m connbytes --connbytes 1048576: --connbytes-dir both --connbytes-mode bytes -j MARK --set-mark 30
    # Маркировка пакетов, непопадающих под верхние правила
    $IPT -t mangle -A SHAPER-IN -m mark --mark 0 -j MARK --set-mark 90

    echo "Inbound shaping added to $DEV_IN.   Rate: ${RATE_IN}Kbit/sec."
}

start_out(){

    $IP link set dev $DEV_OUT qlen 32

    $TC qdisc add dev $DEV_OUT root handle 1: htb r2q 4 default 90

    # класс для ТРАНЗИТНЫХ пакетов
    # (идущих с лок. сети на wan)
    $TC class add dev $DEV_OUT parent 1:0 classid 1:2 htb rate ${RATE_OUT}kbit ceil ${RATE_OUT}kbit
        $TC class add dev $DEV_OUT parent 1:2 classid 1:5  htb rate $[5*$RATE_OUT/100]kbit  ceil ${RATE_OUT}kbit prio 5
        $TC class add dev $DEV_OUT parent 1:2 classid 1:7  htb rate $[10*$RATE_OUT/100]kbit ceil ${RATE_OUT}kbit prio 7
        $TC class add dev $DEV_OUT parent 1:2 classid 1:8  htb rate $[15*$RATE_OUT/100]kbit ceil ${RATE_OUT}kbit prio 8
        $TC class add dev $DEV_OUT parent 1:2 classid 1:90 htb rate $[5*$RATE_OUT/100]kbit  ceil ${RATE_OUT}kbit prio 90

        $TC qdisc add dev $DEV_OUT parent 1:5  handle 5:  sfq perturb 1
        $TC qdisc add dev $DEV_OUT parent 1:7  handle 7:  sfq perturb 1
        $TC qdisc add dev $DEV_OUT parent 1:8  handle 8:  sfq perturb 1
        $TC qdisc add dev $DEV_OUT parent 1:90 handle 90: sfq perturb 1

        $TC filter add dev $DEV_OUT parent 1:0 prio 5  protocol ip handle 5  fw flowid 1:5
        $TC filter add dev $DEV_OUT parent 1:0 prio 7  protocol ip handle 7  fw flowid 1:7
        $TC filter add dev $DEV_OUT parent 1:0 prio 8  protocol ip handle 8  fw flowid 1:8
        $TC filter add dev $DEV_OUT parent 1:0 prio 90 protocol ip handle 90 fw flowid 1:90


    # Добавление цепочки SHAPER-OUT в mangle для последующей маркировки исходящих пакетов (LAN->WAN)
    $IPT -t mangle -N SHAPER-OUT
    $IPT -t mangle -I POSTROUTING -o $DEV_OUT -j SHAPER-OUT

    # SYN-пакеты
    $IPT -t mangle -A SHAPER-OUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j MARK --set-mark 5
    # icmp
    $IPT -t mangle -A SHAPER-OUT -p icmp -j MARK --set-mark 5
    # ssh
    $IPT -t mangle -A SHAPER-OUT -p tcp -m multiport --dports 22 -j MARK --set-mark 7
    # dns; http, https
    $IPT -t mangle -A SHAPER-OUT -p udp --dport 53 -j MARK --set-mark 8
    $IPT -t mangle -A SHAPER-OUT -p tcp -m multiport --dports 80,443 -j MARK --set-mark 8
    # Маркировка пакетов, непопадающих под верхние правила
    $IPT -t mangle -A SHAPER-OUT -m mark --mark 0 -j MARK --set-mark 90

    echo "Outbound shaping added to $DEV_OUT.  Rate: ${RATE_OUT}Kbit/sec."
}

case "$1" in
    start)
        stop
        start_in
        start_out
    ;;

    stop)
        stop
        echo "Shaping removed on $DEV_IN/$DEV_OUT"
    ;;

    *)
        echo "Usage: $0 {start|stop}"
esac