Есть FreeBSD 6.2 + ipfw + ipnat. Количество клиентов = 60-700. Задача - ограничивать полосу в зависимости от того - локальный трафик или зарубежный
Правила фаервола:
Код: Выделить всё
#!/bin/sh
#Quietly flush out rules
#/usr/local/etc/list_tmp/ua.sh
/sbin/ipfw -q -f flush
cmd="/sbin/ipfw add"
fwcmd="/sbin/ipfw"
oif="em0"
iif="em1"
skip="skipto 800"
outip="10.1.100.2"
$cmd allow ip from any to any via lo0
$cmd deny ip from any to 127.0.0.0/8
$cmd deny log ip from 127.0.0.0/8 to any
$cmd allow tcp from any to any 80 in via $oif
$cmd allow tcp from any to any 22 in via $oif setup keep-state
#FTP
$cmd allow tcp from any to any 20,21 in via $oif
$cmd pass tcp from any to me 50000-59999 setup
#NTP
$cmd allow udp from any to any 123 out via $oif
$cmd allow udp from 83.218.226.67 to any in via $oif
#DNS external
$cmd allow udp from any to any 53 in via $oif
$cmd allow udp from any to any 53 out via $oif
$cmd allow udp from any to $outip in via $oif
# $cmd allow tcp from any to any out via $oif setup keep-state
# $cmd allow udp from any to any out via $oif keep-state
###SHAPING
$fwcmd table 1 add 192.168.32.0/24
# UA-IX Bandwidth control
$fwcmd pipe 1 config bw 1024Kbit/s queue 8 mask dst-ip 0xffffffff # in
$fwcmd pipe 2 config bw 512Kbit/s queue 8 mask src-ip 0xffffffff # out
# World Bandwidth control
$fwcmd pipe 3 config bw 512Kbit/s queue 8 mask dst-ip 0xffffffff # in
$fwcmd pipe 4 config bw 128Kbit/s queue 8 mask src-ip 0xffffffff # out
## Pipes work
$cmd pipe 2 ip from table\(1\) to table\(0\) keep-state out via ${oif}
$cmd pipe 4 ip from table\(1\) to not table\(0\) keep-state out via ${oif}
# $cmd divert natd all from table\(1\) to any out via $oif
# $cmd divert natd all from table\(1\) to any in via $iif
# $cmd divert natd all from any to 10.1.100.2 in via $oif
$cmd pipe 1 ip from table\(0\) to table\(1\) in via ${oif}
$cmd pipe 3 ip from not table\(0\) to table\(1\) in via ${oif}
#####ICMP stuff
$cmd check-state
$cmd allow all from any to me in via $iif setup keep-state
$cmd allow icmp from any to any icmptypes 3
$cmd allow icmp from any to any icmptypes 4
$cmd allow icmp from any to any icmptypes 11
$cmd allow icmp from any to any icmptypes 8
$cmd allow icmp from any to any icmptypes 0
$cmd allow tcp from any to any established
$cmd allow ip from $outip to any out xmit $oif
$cmd deny log tcp from any to $outip in via $oif setup
# Тут разрешаем юзверям инет, которым он разрешен
$cmd allow tcp from table\(1\) to not table\(1\) in via $iif setup
##### This section is for exposing services to the internet from the LAN
##### It is placed AFTER the NATD Divert rule, so these services can be
##### diverted in /etc/natd.conf
$cmd allow ip from table\(1\) to table\(1\) in via em1
$cmd allow ip from table\(1\) to table\(1\) in via em1
$cmd 65000 deny log logamount 1000 all from any to any
table\(0\) --- зона UA-IX
Правила IPNAT :
cat /etc/ipnat.rules
Код: Выделить всё
map em1 0/0 -> 0/32 proxy port ftp ftp/tcp
map em0 192.168.32.0/24 -> 10.1.100.2 proxy port ftp ftp/tcp
map em0 192.168.32.0/24 -> 10.1.100.2
((Код: Выделить всё
[root@bcp-gw /etc]# ipfw show
00100 0 0 allow ip from any to any via lo0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny log logamount 5 ip from 127.0.0.0/8 to any
00400 0 0 allow tcp from any to any dst-port 80 in via em0
00500 0 0 allow tcp from any to any dst-port 22 in via em0 setup keep-state
00600 0 0 allow tcp from any to any dst-port 20,21 in via em0
00700 0 0 allow tcp from any to me dst-port 50000-59999 setup
00800 0 0 allow udp from any to any dst-port 123 out via em0
00900 0 0 allow udp from 83.218.226.67 to any in via em0
01000 0 0 allow udp from any to any dst-port 53 in via em0
01100 0 0 allow udp from any to any dst-port 53 out via em0
01200 0 0 allow udp from any to 10.1.100.2 in via em0
01300 0 0 pipe 2 ip from table(1) to table(0) out via em0 keep-state
01400 0 0 pipe 4 ip from table(1) to not table(0) out via em0 keep-state
01500 0 0 pipe 1 ip from table(0) to table(1) in via em0
01600 0 0 pipe 3 ip from not table(0) to table(1) in via em0
01700 0 0 check-state
01800 0 0 allow ip from any to me in via em1 setup keep-state
01900 0 0 allow icmp from any to any icmptypes 3
02000 0 0 allow icmp from any to any icmptypes 4
02100 0 0 allow icmp from any to any icmptypes 11
02200 0 0 allow icmp from any to any icmptypes 8
02300 0 0 allow icmp from any to any icmptypes 0
02400 104 16088 allow tcp from any to any established
02500 0 0 allow ip from 10.1.100.2 to any out xmit em0
02600 0 0 deny log logamount 5 tcp from any to 10.1.100.2 in via em0 setup
02700 0 0 allow tcp from table(1) to not table(1) in via em1 setup
02800 2 156 allow ip from table(1) to table(1) in via em1
02900 0 0 allow ip from table(1) to table(1) in via em1
65000 1 328 deny log logamount 1000 ip from any to any
65535 350 132492 allow ip from any to any
IPNAT - работает.
И еще одно, что отрабатывает раньше IPNAT или IPFW ? Думаю IPNAT .... но тогда как бы так завернуть пакеты, что бы пакеты попадали в трубу ...
