Интуитивно понимаю, что надо использовать ipfw table (), но недельные мучения не увенчались успехом (полный ноль).
Код: Выделить всё
#!/bin/sh
fwcmd="/sbin/ipfw -f -q "
${fwcmd} flush
${fwcmd} pipe flush
${fwcmd} table all flush
${fwcmd} table 1 add 192.168.0.1/32
${fwcmd} table 1 add 192.168.0.2/32
...
${fwcmd} table 2 add 192.168.0.16/32
...
${fwcmd} add 10 skipto 1000 ip from any to any via rl0
${fwcmd} add 10 skipto 1000 ip from any to any via rl1
${fwcmd} add 10 skipto 2000 ip from any to any via em0
${fwcmd} add 10 skipto 65534 ip from any to any
${fwcmd} add 1000 allow ip from any to me in
${fwcmd} add 1000 allow ip from me to any out
${fwcmd} pipe 1 config bw 1Mbit/s mask dst-ip 0xffffffff
${fwcmd} pipe 2 config bw 1Mbit/s mask src-ip 0xffffffff
${fwcmd} add 1001 pipe 1 ip from any to table\(1\) out
${fwcmd} add 1001 pipe 2 ip from table\(1\) to any in
${fwcmd} pipe 3 config bw 1Mbit/s mask dst-ip 0xffffffff
${fwcmd} pipe 4 config bw 1Mbit/s mask src-ip 0xffffffff
${fwcmd} add 1002 pipe 3 ip from any to table\(2\) out
${fwcmd} add 1002 pipe 4 ip from table\(2\) to any in
...
${fwcmd} add 1999 skipto 65534 ip from any to any
#-------------------------------
${fwcmd} nat 1 config ip 192.168.168.2 deny_in unreg_only log same_ports
${fwcmd} add 2000 nat 1 ip from any to any
#-------------------------------
${fwcmd} add 65534 deny log ip from any to any