此举是防止服务器被入侵，进行违法行为。自行限制，保护服务器。
sudo nano /usr/local/bin/bandwidth-limit.sh
#!/bin/bash # 限制 eth0 上下行带宽为 15mbit set -e IFACE="eth0" RATE="15mbit" # 加载 ifb 模块 modprobe ifb ip link set dev ifb0 up # 清理旧规则（避免重复） tc qdisc del dev "$IFACE" root 2>/dev/null || true tc qdisc del dev "$IFACE" ingress 2>/dev/null || true tc qdisc del dev ifb0 root 2>/dev/null || true # 限制上传（出口） tc qdisc add dev "$IFACE" root handle 1: htb default 10 tc class add dev "$IFACE" parent 1: classid 1:1 htb rate "$RATE" tc class add dev "$IFACE" parent 1:1 classid 1:10 htb rate "$RATE" # 限制下载（入口）——通过 ifb0 tc qdisc add dev "$IFACE" ingress tc filter add dev "$IFACE" parent ffff: protocol all u32 match u32 0 0 \ action mirred egress redirect dev ifb0 tc qdisc add dev ifb0 root handle 1: htb default 10 tc class add dev ifb0 parent 1: classid 1:1 htb rate "$RATE" tc class add dev ifb0 parent 1:1 classid 1:10 htb rate "$RATE" logger -t bandwidth-limit "Bandwidth limited to $RATE on $IFACE (up/down)"
sudo chmod +x /usr/local/bin/bandwidth-limit.sh
创建 systemd 服务
sudo nano /etc/systemd/system/bandwidth-limit.service
--------脚本开始-------------
[Unit] Description=Limit network bandwidth to 15Mbps on eth0 After=network.target Before=docker.service [Service] Type=oneshot ExecStart=/usr/local/bin/bandwidth-limit.sh RemainAfterExit=yes StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target
-----脚 本结束----
# 重载 systemd 配置
sudo systemctl daemon-reload
# 启用开机自启
sudo systemctl enable bandwidth-limit.service
# 立即启动（无需重启）
sudo systemctl start bandwidth-limit.service
验证是成否成功
systemctl status bandwidth-limit.service
查看日志文件
journalctl -u bandwidth-limit.service -b
重启服务器验证是否自动开始
sudo reboot
重启后运行
tc qdisc show dev eth0 tc qdisc show dev ifb0
临时关闭（不清除规则）
sudo systemctl stop bandwidth-limit.service
永久禁用（开机不再启动）
sudo systemctl disable bandwidth-limit.service sudo systemctl stop bandwidth-limit.service
永久删除关闭脚 本
sudo systemctl disable --now bandwidth-limit.service
sudo rm /etc/systemd/system/bandwidth-limit.service
sudo rm /usr/local/bin/bandwidth-limit.sh
sudo systemctl daemon-reload
