FreeBSD Dummynet не работает

Простые/общие вопросы по UNIX системам. Спросите здесь, если вы новичок

Модераторы: vadim64, terminus

Правила форума
Убедительная просьба юзать теги [code] при оформлении листингов.
Сообщения не оформленные должным образом имеют все шансы быть незамеченными.
Аватара пользователя
Sindikat88
мл. сержант
Сообщения: 131
Зарегистрирован: 2010-09-02 15:07:54
Контактная информация:

FreeBSD Dummynet не работает

Непрочитанное сообщение Sindikat88 » 2017-06-24 16:34:44

Камрады, приветствую!
Имеется шлюз на FreeBSD 10.3 с параметрами ядра:

Код: Выделить всё

#NAT
options IPFIREWALL
options IPDIVERT
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=50
options IPFIREWALL_NAT
options LIBALIAS
options ROUTETABLES=5
options DUMMYNET
options HZ="1000"                       # for DUMMYNET

# Options for a IPsec enabled kernel
options         IPSEC
options         IPSEC_FILTERTUNNEL
options         IPSEC_NAT_T
device          crypto
device          enc


IPFW работает с таким набором правил:

Код: Выделить всё

#!/bin/sh
ipfw -f flush
ipfw -f pipe flush
ipfw -f queue flush

cmd="/sbin/ipfw add"
FWCMD="/sbin/ipfw -q"

LanOut="igb1" # Внешняя сетевуха
NetOut="xxx.xxx.xxx.xxx/30" # внешняя сеть
IpOut="xxx.xxx.xxx.xxx" # Внешний IP

LanIn="igb0" # внутренняя сетевуха
NetIn="192.168.180.0/23" # Внутренняя сеть
ip_lan="192.168" # Шаблон внутреннего адреса

LanGuest="vlan10" # VLAN для гостевой WI-FI сети
NetGuest="192.168.185.0/24" #VLAN сеть для гостевой WI-FI сети

LanSmart="vlan20" # VLAN для Smart WI-FI сети
NetSmart="192.168.190.0/24" #VLAN сеть для Smart

openvpn_if="tun0"       #OpenVPN port
IpVPN="192.168.225.0"


ipfw pipe 1 config bw 1000Kbit/s mask dst-ip 0x000000ff
ipfw pipe 2 config bw 1000Kbit/s mask src-ip 0x000000ff

ipfw add 041 pipe 1 ip from any to 192.168.180.0/23 in
ipfw add 042 pipe 2 ip from 192.168.180.0/23 to any out

#NAT
ipfw nat 1 config if igb1 log same_ports


#local
$cmd 005 allow all from any to any via $LanIn
#VPN
$cmd 006 allow all from any to any via tun0
#local Guest Network
$cmd 007 allow all from any to any via $LanGuest
#GIF
$cmd 008 allow ip from any to any via gif0
#local Smart Network
$cmd 009 allow all from any to any via $LanSmart
# loopback
$cmd 010 allow all from any to any via lo0

#Incoming traffic to NAT
$cmd 030 nat 1 ip from any to any in via $LanOut

#NAT from AS to Inet
$cmd 033 nat 1 ip from $NetIn to any out via $LanOut

#NAT from Guest to Inet
$cmd 035 nat 1 ip from $NetGuest to any out via $LanOut

#NAT from Smart to Inet
$cmd 038 nat 1 ip from $NetSmart to any out via $LanOut

#Allow DYN rules
$cmd 040 check-state

# DNS resolve
$cmd 052 allow ip from any 53 to any via $LanOut
$cmd 053 allow ip from any to any 53 via $LanOut

# Outgoing server to Internet
$cmd 060 allow ip from me to any out via $LanOut setup keep-state

#IPSEC VPN Smart
$cmd 061 allow udp from xxx.xxx.xxx.xxx to me isakmp
$cmd 062 allow udp from me to xxx.xxx.xxx.xxx isakmp
$cmd 063 allow esp from xxx.xxx.xxx.xxx to me
$cmd 064 allow esp from me to xxx.xxx.xxx.xxx
$cmd 065 allow ipencap from xxx.xxx.xxx.xxx to me
$cmd 066 allow ipencap from me to xxx.xxx.xxx.xxx

# ICMP
$cmd 100 allow icmp from any to any out via $LanOut keep-state

# OpenVPN
$cmd 101 allow tcp from xxx.xxx.xxx.xxx to me 2000 in via ${LanOut}
$cmd 102 allow tcp from me 2000 to xxx.xxx.xxx.xxx out via ${LanOut}
$cmd 103 allow all from any to any in via ${openvpn_if}
$cmd 104 allow all from any to any out via ${openvpn_if}

# Time
$cmd 120 allow udp from any to any 123 out via $LanOut keep-state

#WI-FI Guest
$cmd 123 allow ip from $NetGuest to any 80,443,21 out via $LanOut setup keep-state

#SIP
$cmd 131 allow ip from 193.201.230.128/26 to '192.168.180.0{31-89}' in via ${LanOut}
$cmd 132 allow ip from '192.168.180.0{31-89}' to 193.201.230.128/26 out via ${LanOut}

#NAT
$cmd 141 allow ip from '192.168.180.0{11-29}' to any out via $LanOut setup keep-state
#TV
$cmd 143 allow ip from '192.168.180.0{95-97}' to any out via $LanOut setup keep-state

#Разрешаем определенный ICMP-трафик из мира к нам
$cmd 161 allow icmp from any to me in via $LanOut icmptype 3,8,12
#Разрешаем определенный ICMP-трафик от нас в мир
$cmd 162 allow icmp from me to any out via $LanOut icmptype 0,3,4,11,12
#Запрещаем прочий ICMP-трафик
$cmd 163 deny log icmp from any to me in via $LanOut icmptype 5,9,10,13,15,17

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 200 deny all from 192.168.0.0/16 to any in via $LanOut
$cmd 201 deny all from 172.16.0.0/12 to any in via $LanOut
$cmd 202 deny all from 10.0.0.0/8 to any in via $LanOut
$cmd 203 deny all from 127.0.0.0/8 to any in via $LanOut
$cmd 204 deny all from 0.0.0.0/8 to any in via $LanOut
$cmd 205 deny all from 169.254.0.0/16 to any in via $LanOut
$cmd 206 deny all from 192.0.2.0/24 to any in via $LanOut
$cmd 207 deny all from 204.152.64.0/23 to any in via $LanOut
$cmd 208 deny all from 224.0.0.0/3 to any in via $LanOut

# Deny ident
$cmd 209 deny tcp from any to any 113 in via $LanOut

#Netbios
$cmd 210 deny tcp from any to any 137 via $LanOut
$cmd 211 deny tcp from any to any 138 via $LanOut
$cmd 212 deny tcp from any to any 139 via $LanOut
$cmd 213 deny tcp from any to any 81 via $LanOut

# Deny fragments packets
$cmd 214 deny all from any to any frag in via $LanOut

# Deny ACK packets that did not match the dynamic rule table
$cmd 215 deny tcp from any to any established in via $LanOut

#Isolated Network
$cmd 216 allow all from 192.168.185.0/24 to 192.168.180.1
$cmd 217 allow all from 192.168.190.0/24 to 192.168.180.1
$cmd 218 deny all from 192.168.185.0/24 to 192.168.180.0/23
$cmd 219 deny all from 192.168.180.0/23 to 192.168.185.0/24
$cmd 220 deny all from 192.168.190.0/24 to 192.168.180.0/23
$cmd 221 deny all from 192.168.180.0/24 to 192.168.190.0/24

# Allow in ssh from Internet
$cmd 300 allow tcp from xxx.xxx.xxx.xxx to me 22 in via $LanOut setup limit src-addr 1

# Reject incomming traffic from Inet
$cmd 400 deny log all from any to any in via $LanOut

# Reject outgoing traffic to Inet
$cmd 410 deny log logamount 50 all from any to any out via $LanOut

$cmd 999 deny log all from any to any

Хочу настроить шейпер.
Но как только я добавляю параметр net.inet.ip.fw.one_pass=0 в /etc/sysctl.conf, так сразу перестают ходить пакеты в локальную сеть.
Подскажите, как правильно организовать шейпинг?

Аватара пользователя
Sindikat88
мл. сержант
Сообщения: 131
Зарегистрирован: 2010-09-02 15:07:54
Контактная информация:

FreeBSD Dummynet не работает

Непрочитанное сообщение Sindikat88 » 2017-07-03 9:21:17

После приведения правил IPFW к такому состоянию всё работает:

Код: Выделить всё

#!/bin/sh
ipfw -f flush
ipfw -f pipe flush
ipfw -f queue flush

cmd="/sbin/ipfw add"
FWCMD="/sbin/ipfw -q"

LanOut="igb1" # External Ethernet
IpOut="xxx.xxx.xxx.xxx" # External IP

LanIn="igb0" # Internal Ethernet
NetIn="192.168.180.0/23" # Internal Lan

LanGuest="vlan10" # VLAN guest WI-FI
NetGuest="192.168.185.0/24" #VLAN network for WI-FI guest

LanSmart="vlan20" # VLAN Smart
NetSmart="192.168.190.0/24" #VLAN network fow Smart

openvpn_if="tun0"       #OpenVPN port
IpVPN="192.168.225.0"

VIP="192.168.180.0{11-29}"
SIP="192.168.180.0/24{31-89}"
NetLocal="192.168.181.1/24{1-254}"

#Pipe 1 - SIP Phone out - 4Mbit/s
#Pipe 2 - SIP Phone in - 4Mbit/s
ipfw pipe 1 config bw 4Mbit/s
ipfw queue 1 config pipe 1 weight 50 queue 20 mask dst-ip 0x00000000
ipfw pipe 2 config bw 4Mbit/s
ipfw queue 2 config pipe 2 weight 50 queue 20 mask src-ip 0x00000000
$cmd 010 queue 1 ip from any to $SIP out
$cmd 020 queue 2 ip from $SIP to any in
$cmd 021 queue 2 ip from any to $SIP in via $LanOut
$cmd 022 queue 2 ip from 193.201.230.128/26 to me 5060,11024 in via $LanOut
$cmd 011 queue 1 ip from me 5060,11024 to any out via $LanOut
$cmd 012 queue 1 ip from me to 193.201.230.128/26 out via $LanOut

#Pipe 3 - Guest WI-FI out - 4Mbit/s
#Pipe 4 - Guest WI-FI in - 4Mbit/s
ipfw pipe 3 config bw 4Mbit/s
ipfw queue 3 config pipe 3 weight 50 queue 20 mask src-ip 0x00000000
ipfw pipe 4 config bw 4Mbit/s
ipfw queue 4 config pipe 4 weight 50 queue 20 mask src-ip 0x00000000
$cmd 030 queue 3 ip from any to $NetGuest out
$cmd 040 queue 4 ip from $NetGuest to any in

#Pipe 5 - Network Local out - 6Mbit/s
#Pipe 6 - Network Local in - 6Mbit/s
ipfw pipe 5 config bw 6Mbit/s
ipfw queue 5 config pipe 5 weight 50 queue 20 mask dst-ip 0x00000000
ipfw pipe 6 config bw 6Mbit/s
ipfw queue 6 config pipe 6 weight 50 queue 20 mask src-ip 0x00000000
$cmd 050 queue 5 ip from any to $NetLocal out
$cmd 060 queue 6 ip from $NetLocal to any in

#Pipe 7 - Network Smart out - 5Mbit/s
#Pipe 8 - Network Smart in - 5Mbit/s
ipfw pipe 7 config bw 5Mbit/s
ipfw queue 7 config pipe 7 weight 50 queue 20 mask dst-ip 0x00000000
ipfw pipe 8 config bw 5Mbit/s
ipfw queue 8 config pipe 8 weight 50 queue 20 mask src-ip 0x00000000
$cmd 070 queue 7 ip from any to $NetSmart out
$cmd 080 queue 8 ip from $NetSmart to any in

#NAT
ipfw nat 1 config if igb1 log same_ports

#local
$cmd 105 allow all from any to any via $LanIn
#VPN
$cmd 106 allow all from any to any via tun0
#local Guest Network
$cmd 107 allow all from any to any via $LanGuest
#GIF
$cmd 108 allow ip from any to any via gif0
#local Smart Network
$cmd 109 allow all from any to any via $LanSmart
# loopback
$cmd 110 allow all from any to any via lo0

#Incoming traffic to NAT
$cmd 130 nat 1 ip from any to any in via $LanOut

#NAT from ASG to Inet
$cmd 133 nat 1 ip from $NetIn to any out via $LanOut

#NAT from Guest to Inet
$cmd 135 nat 1 ip from $NetGuest to any out via $LanOut

#NAT from Smart to Inet
$cmd 138 nat 1 ip from $NetSmart to any out via $LanOut

#Allow DYN rules
$cmd 140 check-state

# DNS resolve
#$cmd 052 allow ip from any 53 to me via $LanOut
#$cmd 053 allow ip from me to any 53 via $LanOut
$cmd 172 allow ip from any 53 to any via $LanOut
$cmd 173 allow ip from any to any 53 via $LanOut

# Outgoing server to Internet
$cmd 180 allow ip from me to any out via $LanOut setup keep-state

#IPSEC VPN Smart
$cmd 191 allow udp from xxx.xxx.xxx.xxx to me isakmp
$cmd 192 allow udp from me to xxx.xxx.xxx.xxx isakmp
$cmd 193 allow esp from xxx.xxx.xxx.xxx to me
$cmd 194 allow esp from me to xxx.xxx.xxx.xxx
$cmd 195 allow ipencap from xxx.xxx.xxx.xxx to me
$cmd 196 allow ipencap from me to xxx.xxx.xxx.xxx

# ICMP
$cmd 200 allow icmp from any to any out via $LanOut keep-state

# OpenVPN
$cmd 201 allow tcp from xxx.xxx.xxx.xxx to me 2000 in via ${LanOut}
$cmd 202 allow tcp from me 2000 to xxx.xxx.xxx.xxx out via ${LanOut}
$cmd 203 allow all from any to any in via ${openvpn_if}
$cmd 204 allow all from any to any out via ${openvpn_if}

# Time
$cmd 210 allow udp from any to any 123 out via $LanOut keep-state

#WI-FI Guest
$cmd 221 allow ip from $NetGuest to any out via $LanOut setup keep-state
$cmd 222 allow ip from any to $NetGuest in via $LanOut

#SIP
$cmd 231 allow ip from any to $SIP in via $LanOut
$cmd 232 allow ip from 193.201.230.128/26 to me 5060,11024 in via $LanOut
$cmd 233 allow ip from me 5060,11024 to any out via $LanOut
$cmd 234 allow ip from me to 193.201.230.128/26 out via $LanOut


#NAT
$cmd 241 allow ip from '192.168.180.0{11-29}' to any out via $LanOut setup keep-state
$cmd 242 allow ip from any to '192.168.180.0{11-29}' in via $LanOut

#TV
$cmd 243 allow ip from '192.168.180.0{95-97}' to any out via $LanOut setup keep-state
$cmd 244 allow ip from any to '192.168.180.0{95-97}' in via $LanOut

#Smart
$cmd 251 allow ip from $NetSmart to any out via $LanOut setup keep-state
$cmd 252 allow ip from any to $NetSmart in via $LanOut

#Разрешаем определенный ICMP-трафик из мира к нам
$cmd 261 allow icmp from any to me in via $LanOut icmptype 3,8,12
#Разрешаем определенный ICMP-трафик от нас в мир
$cmd 262 allow icmp from me to any out via $LanOut icmptype 0,3,4,11,12
#Запрещаем прочий ICMP-трафик
$cmd 263 deny log icmp from any to me in via $LanOut icmptype 5,9,10,13,15,17

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 300 deny all from 192.168.0.0/16 to any in via $LanOut
$cmd 301 deny all from 172.16.0.0/12 to any in via $LanOut
$cmd 302 deny all from 10.0.0.0/8 to any in via $LanOut
$cmd 303 deny all from 127.0.0.0/8 to any in via $LanOut
$cmd 304 deny all from 0.0.0.0/8 to any in via $LanOut
$cmd 305 deny all from 169.254.0.0/16 to any in via $LanOut
$cmd 306 deny all from 192.0.2.0/24 to any in via $LanOut
$cmd 307 deny all from 204.152.64.0/23 to any in via $LanOut
$cmd 308 deny all from 224.0.0.0/3 to any in via $LanOut

# Deny ident
$cmd 309 deny tcp from any to any 113 in via $LanOut

#Netbios
$cmd 310 deny tcp from any to any 137 via $LanOut
$cmd 311 deny tcp from any to any 138 via $LanOut
$cmd 312 deny tcp from any to any 139 via $LanOut
$cmd 313 deny tcp from any to any 81 via $LanOut

# Deny fragments packets
$cmd 314 deny all from any to any frag in via $LanOut

# Deny ACK packets that did not match the dynamic rule table
$cmd 315 deny log tcp from any to any established in via $LanOut

#Изолируем подсети друг от друга
$cmd 351 allow all from 192.168.185.0/24 to 192.168.180.1/32
$cmd 352 allow all from 192.168.190.0/24 to 192.168.180.1/32
$cmd 353 deny all from 192.168.185.0/24 to 192.168.180.0/23
$cmd 354 deny all from 192.168.180.0/23 to 192.168.185.0/24
$cmd 355 deny all from 192.168.190.0/24 to 192.168.180.0/23
$cmd 356 deny all from 192.168.180.0/24 to 192.168.190.0/24

# Allow in ssh from Internet
$cmd 400 allow tcp from xxx.xxx.xxx.xxx to me 22 in via $LanOut setup limit src-addr 1

# Reject incomming traffic from Inet
$cmd 500 deny log all from any to any in via $LanOut

# Reject outgoing traffic to Inet
$cmd 510 deny log logamount 50 all from any to any out via $LanOut

$cmd 999 deny log all from any to any


Вернуться в «FreeBSD/UNIX для начинающих»

Кто сейчас на конференции

Сейчас этот форум просматривают: нет зарегистрированных пользователей и 3 гостя