У меня проблема следующая.
На роутере стоит FreeBSD 7.0 две сетевушки dc0 - смотрит в интернет и em0 - смотрит в локальную сеть. На em0 поднято 5 vlan-ов для подсетей
Код: Выделить всё
172.16.22.0/24
172.16.23.0/24
172.16.24.0/24
172.16.25.0/24
172.16.26.0/24Вся проблема заключается в том что между подсетями очень низкая скорость 25-40Кб/с. Останавливал nat и чистил все правила фаервола, всеравно скорость была очень низкой. Помогите разобраться, а то предположений уже нет в чем может быть проблема.
Конфиг фаервола
--------rc.firewall-----------
Код: Выделить всё
#!/bin/sh
ipfw='/sbin/ipfw -q'
net22='172.16.22.0/24' # наша локальная сеть
net23='172.16.23.0/24'
net24='172.16.24.0/24'
net25='172.16.25.0/24'
net26='172.16.26.0/24'
ifout='dc0' # интерфейс смотрящий в инт
iflocal23='vlan23' # интерфейс смотрящий в ЛС
iflocal26='vlan26'
iflocal22='vlan22'
iflocal24='vlan11'
iflocal25='vlan25'
${ipfw} -f flush
#${ipfw} -f pipe flush
${ipfw} add 10 allow ip from ${net22}, ${net23}, ${net24}, ${net25}, ${net26} to ${net22}, ${net23}, ${net24}, ${net25}, ${net26}
${ipfw} add 11 deny ip from any to me 80 via dc0
${ipfw} add 12 allow ip from any to me 6666,6667,6668,6669,6670
${ipfw} add 5 deny all from any to any 8167
${ipfw} add 100 check-state #+
${ipfw} add 150 allow ip from any to any via lo0 #+
${ipfw} add 200 allow ip from me to any keep-state #+
${ipfw} add 220 deny ip from not ${net22} to any via ${iflocal22} in #+
${ipfw} add 220 deny ip from not ${net23} to any via ${iflocal23} in #+
${ipfw} add 220 deny ip from not ${net24} to any via ${iflocal24} in #+
${ipfw} add 220 deny ip from not ${net25} to any via ${iflocal25} in #+
${ipfw} add 220 deny ip from not ${net26} to any via ${iflocal26} in #+
${ipfw} add 240 deny ip from any to not me via ${ifout} in #+
${ipfw} add allow tcp from any to me ssh
# NAT
${ipfw} add 260 divert natd all from any to not ${net22}, ${net23}, ${net24}, ${net25}, ${net26} via ${ifout} #+
${ipfw} add 270 allow ip from any to not ${net22}, ${net23}, ${net24}, ${net25}, ${net26} via ${ifout} out #+
${ipfw} add 310 allow tcp from any to me 80
${ipfw} add 310 allow tcp from any to me 443
#${ipfw} add 320 allow tcp from any to me 25,110
${ipfw} add 330 allow icmp from any to me
${ipfw} add 340 allow udp from any to me 53 via ${iflocal23}
${ipfw} add 340 allow tcp from any to me 53 via ${iflocal23}
${ipfw} add 340 allow udp from any to me 53 via ${iflocal22}
${ipfw} add 340 allow tcp from any to me 53 via ${iflocal22}
${ipfw} add 340 allow udp from any to me 53 via ${iflocal24}
${ipfw} add 340 allow tcp from any to me 53 via ${iflocal24}
${ipfw} add 340 allow udp from any to me 53 via ${iflocal25}
${ipfw} add 340 allow tcp from any to me 53 via ${iflocal25}
${ipfw} add 340 allow udp from any to me 53 via ${iflocal26}
${ipfw} add 340 allow tcp from any to me 53 via ${iflocal26}
${ipfw} add 350 allow udp from any to me 7723 via ${iflocal22}
${ipfw} add 350 allow udp from any to me 7723 via ${iflocal23}
${ipfw} add 350 allow udp from any to me 7723 via ${iflocal24}
${ipfw} add 350 allow udp from any to me 7723 via ${iflocal25}
${ipfw} add 350 allow udp from any to me 7723 via ${iflocal26}
${ipfw} add 400 deny ip from any to me
${ipfw} add 450 allow ip from any to any via ${ifout}
${ipfw} add 65400 allow all from any to any
Код: Выделить всё
defaultrouter="xx.xx.xx.xx"
gateway_enable="YES"
hostname="router.domain.ua"
ifconfig_dc0="inet xx.xx.xx.xx netmask 255.255.255.240"
ifconfig_dc0_alias0="inet хх.хх.хх.хх netmask 255.255.255.240"
#ifconfig_re0="inet 172.16.21.124 netmask 255.255.255.0"
ifconfig_em0="inet 172.16.21.124 netmask 255.255.255.0"
cloned_interfaces="vlan11 vlan22 vlan23 vlan25 vlan26"
#ifconfig_re0="-vlanhwtag up"
ifconfig_vlan11="inet 172.16.24.124 netmask 255.255.255.0 vlan 11 vlandev em0"
ifconfig_vlan22="inet 172.16.22.124 netmask 255.255.255.0 vlan 22 vlandev em0"
ifconfig_vlan23="inet 172.16.23.124 netmask 255.255.255.0 vlan 23 vlandev em0"
ifconfig_vlan25="inet 172.16.25.124 netmask 255.255.255.0 vlan 25 vlandev em0"
ifconfig_vlan26="inet 172.16.26.124 netmask 255.255.255.0 vlan 26 vlandev em0"
linux_enable="YES"
named_enable="YES"
sshd_enable="YES"
firewall_enable="YES"
firewall_script="/etc/rc.firewall"
mysql_enable="YES"
apache22_enable="YES"
natd_enable="YES"
natd_interface="dc0"
natd_flags="-f /etc/natd.conf"
ipcad_enable="YES"Код: Выделить всё
options IPFIREWALL
options IPDIVERT
options IPFIREWALL_FORWARD
options DUMMYNET
options DEVICE_POLLING
Код: Выделить всё
262/893/1155 mbufs in use (current/cache/total)
257/523/780/25600 mbuf clusters in use (current/cache/total/max)
257/511 mbuf+clusters out of packet secondary zone in use (current/cache)
0/54/54/12800 4k (page size) jumbo clusters in use (current/cache/total/max)
0/0/0/6400 9k jumbo clusters in use (current/cache/total/max)
0/0/0/3200 16k jumbo clusters in use (current/cache/total/max)
579K/1485K/2064K bytes allocated to network (current/cache/total)
0/0/0 requests for mbufs denied (mbufs/clusters/mbuf+clusters)
0/0/0 requests for jumbo clusters denied (4k/9k/16k)
0/38/6656 sfbufs in use (current/peak/max)
0 requests for sfbufs denied
0 requests for sfbufs delayed
742 requests for I/O initiated by sendfile
0 calls to protocol drain routinesКод: Выделить всё
FreeBSD router.domain.ua 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Tue May 27 18:18:43 EEST 2008 admin@router.domain.ua:/usr/src/sys/i386/compile/GATE i386
