DEVICE=eth1,10Mbit,1Mbit
RATE=256
WEIGHT=64Kbit
PRIO=5
RULE=172.167.0.9
BOUNDED=yes
ISOLATED=no

DEVICE=eth0,10Mbit,1Mbit
RATE=256
WEIGHT=64Kbit
PRIO=5
RULE=172.167.0.9,
BOUNDED=yes
ISOLATED=no

DEVICE=eth0,10Mbit,1Mbit
RATE=256
WEIGHT=64Kbit
PRIO=5
RULE=172.167.0.9,
MARK=16709
BOUNDED=yes
ISOLATED=no

# Parâmetros do controle de acesso
MACLIST=/etc/macxip
echo " Configurações necessárias.....................[ OK ]"

# Limpando Regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t nat
iptables -X -t nat
iptables -F -t mangle
iptables -X -t mangle
echo " Limpando Regras ..............................[ OK ]"

# Definindo Política Padrão
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
echo " Alterando política padrão.....................[ OK ]"

# Aceita os Pacotes que realmente devem entrar
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# # Controle de ACESSO # #
# Diretivas do BD IP, MAC e Port
for i in `cat $MACLIST`; do
IPSOURCE=`echo $i | cut -d ';' -f 1`
MACSOURCE=`echo $i | cut -d ';' -f 2`
CBQMARK=`echo $i | cut -d ';' -f 3`

# Controle de Acesso IPxMAC
iptables -t filter -A FORWARD -d 0/0 -s $IPSOURCE -m mac --mac-source $MACSOURCE -j ACCEPT
iptables -t filter -A INPUT -s $IPSOURCE -d 0/0 -m mac --mac-source $MACSOURCE -j ACCEPT

#Pacote Marcado - importante lembrar que todo tráfego de saída deve ser controlado na interface oposta do cliente.
# no meu caso= eth0
iptables -A PREROUTING -t mangle -i eth0 -s $IPSOURCE -j MARK --set-mark $CBQMARK


done

# Redireciona o tráfego http(80) para o squid (3128)
iptables -t nat -A PREROUTING -i eth1 -p TCP ! -d 200.201.0.0/16 --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i eth1 -p UDP ! -d 200.201.0.0/16 --dport 80 -j REDIRECT --to-port 3128

# Compartilha Conexão
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
echo "1" > /proc/sys/net/ipv4/ip_forward

# Aceita todo o tráfego vindo do loopback e indo para o loopback
iptables -t filter -A INPUT -i lo -j ACCEPT