Модератор: terminus
придут а инета НЕТ )Код: Выделить всё
ipfw pipe 1 ip from any to $mac out
Код: Выделить всё
Also note that each packet is always checked against the complete rule-
set, irrespective of the place where the check occurs, or the source of
the packet. If a rule contains some match patterns or actions which are
not valid for the place of invocation (e.g. trying to match a MAC header
within ip_input or ip6_input ), the match pattern will not match, but a
not operator in front of such patterns will cause the pattern to always
match on those packets. It is thus the responsibility of the programmer,
if necessary, to write a suitable ruleset to differentiate among the pos-
sible places. skipto rules can be useful here, as an example:
# packets from ether_demux or bdg_forward
ipfw add 10 skipto 1000 all from any to any layer2 in
# packets from ip_input
ipfw add 10 skipto 2000 all from any to any not layer2 in
# packets from ip_output
ipfw add 10 skipto 3000 all from any to any not layer2 out
# packets from ether_output_frame
ipfw add 10 skipto 4000 all from any to any layer2 out
Код: Выделить всё
{ MAC | mac } dst-mac src-mac
Match packets with a given dst-mac and src-mac addresses, speci-
fied as the any keyword (matching any MAC address), or six groups
of hex digits separated by colons, and optionally followed by a
mask indicating the significant bits.
а я жажду экономии траффикаКод: Выделить всё
ipfw add allow mac (Мак адресс) from any to anyКод: Выделить всё
allow ip from any to any MAC (Мак 1) (Мак 2)
))Код: Выделить всё
ipfw add allow all from 192.168.9.0/24 to any mac any aa:aa:aa:aa:aa:aaКод: Выделить всё
ipfw add allow all from 192.168.9.0/24 to any mac ff:ff:ff:ff:ff:ff aa:aa:aa:aa:aa:aa
)))))))))))))))