Конфиги такие (FreeBSD 8.1):
Код: Выделить всё
/etc/rc.firewall
${fwcmd} add allow ipencap from me to RemoteRealIP
${fwcmd} add allow ipencap from RemoteRealIP to me
${fwcmd} add tee 4001 ip from 192.168.0.0/16 to 192.168.0.0/16 in via gif0
${fwcmd} add tee 4002 ip from 192.168.0.0/16 to 192.168.0.0/16 out via gif0
${fwcmd} add allow all from 192.168.0.0/16 to 192.168.0.0/16 via gif0
/usr/local/etc/ng_ipacct.conf
#ng_ipacct_enable="YES"
ng_ipacct_modules_load="YES"
ng_ipacct_modules_list="netgraph ng_ether ng_cisco ng_socket ng_tee ng_ipacct"
ng_ipacct_interfaces="gif0"
# GIF 0
ng_ipacct_gif0_dlt="RAW"
ng_ipacct_gif0_start='
mkpeer ipacct dummy dummy
name .:dummy %%iface%%_ip_acct
mkpeer %%iface%%_ip_acct: ksocket %%iface%%_in inet/raw/divert
name %%iface%%_ip_acct:%%iface%%_in ks_%%iface%%_in
msg ks_%%iface%%_in: bind inet/0.0.0.0:4001
mkpeer %%iface%%_ip_acct: ksocket %%iface%%_out inet/raw/divert
name %%iface%%_ip_acct:%%iface%%_out ks_%%iface%%_out
msg ks_%%iface%%_out: bind inet/0.0.0.0:4002
rmhook .:dummy
'
ng_ipacct_gif0_stop='
shutdown %%iface%%_ip_acct:
'
ng_ipacct_gif0_checkpoint_script="/root/ng_ipacct.sh gif0"
ng_ipacct_gif0_threshold="15000" # '5000' by default
ng_ipacct_gif0_verbose="yes" # 'yes' by default
ng_ipacct_gif0_savetime="yes" # 'no' by default
/etc/sysctl.conf
sysctl net.inet.ipsec.filtertunnel=1
/etc/rc.conf
cloned_interfaces="gif0"
gif_interfaces="gif0"
ifconfig_gif0="inet MyLocalIP RemoteLocalIP netmask 255.255.255.255"
gifconfig_gif0="MyRealIP RemoteRealIP"
stat_routes="branch1"
route_branch1="-net RemoteLocalNetwork/24 -iface gif0"
