forum.lissyara.su

Код: Выделить всё

# uname -a
FreeBSD bsd8.***.ru 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sun Dec 20 18:20:09 MSK 2009     ***@bsd8.***.ru:/usr/obj/usr/src/sys/SMP-***-KERNEL  i386

Код: Выделить всё

# cat /etc/pf.conf

# ISP-1
ext_if_a        = "ng0"
ext_gw_a        = "1.1.1.1"
ext_ip_a        = "1.1.1.2"

# ISP-2
ext_if_b        = "ng1"
ext_gw_b        = "2.2.2.1"
ext_ip_b        = "2.2.2.2"

# ISP-2 local
ext_if_c        = "fxp1"
ext_gw_c        = "10.0.0.1"

# LAN
int_if_a        = "em0"
net             = "192.168.0.0/24"
int_ip_a        = "192.168.0.1"
win2003         = "192.168.0.11"
radio           = "192.168.0.12"

tcp_svc_a       = "21 80 2020 411 8000 8003 27015 31337"
tcp_svc_b       = "80 2020 411 31337"
udp_svc_a       = "27015"
udp_svc_b       = ""

icmp_types      = "echoreq"

set block-policy return
set skip on lo0
set skip on xl0
set skip on re0
set loginterface $ext_if_a
scrub in

nat on $ext_if_a inet from !(self) -> ($ext_if_a:0)
nat on $ext_if_b inet from !(self) -> ($ext_if_b:0)

rdr pass on $ext_if_a inet proto tcp to $ext_if_a:0 port { 25, 110, 82, 83, 2525, 4901, 8080 } tag EXT_IF_A -> $win2003
rdr on $ext_if_b inet proto tcp to $ext_if_b:0 port { 25, 110, 82, 83, 2525, 4901, 8080 } tag EXT_IF_B -> $win2003

rdr pass inet proto tcp from any to any port { 4900 8112 9112 } -> $radio
rdr pass inet proto udp from any to any port { 8212 9212 } -> $radio

rdr pass inet proto tcp from any to any port { 30001 } -> $win2003
rdr pass inet proto udp from any to any port { 30002 } -> $win2003

rdr-anchor "ftp-proxy/*"
rdr on $int_if_a proto tcp from any to !(self) port ftp -> 127.0.0.1 port 8021
anchor "ftp-proxy/*"

block log (all) all

pass on $int_if_a
pass out

pass in quick inet proto udp from { 192.168.0.11, 192.168.0.10 } to any port 27015

pass in quick reply-to ($ext_if_a $ext_gw_a) tagged EXT_IF_A keep state
pass in quick reply-to ($ext_if_b $ext_gw_b) tagged EXT_IF_B keep state

# ICMP
# ISP-1
pass in on $ext_if_a reply-to ($ext_if_a $ext_gw_a) inet proto icmp to ($ext_if_a) tag EXT_IF_A icmp-type echoreq code 0
# ISP-2
pass in on $ext_if_b reply-to ($ext_if_b $ext_gw_b) inet proto icmp to ($ext_if_b) tag EXT_IF_B icmp-type echoreq code 0

pass in quick on $int_if_a route-to ($ext_if_a $ext_gw_a) inet proto tcp from { 192.168.0.11 } to !(self) port { 25, 110 }
pass in quick on $int_if_a route-to ($ext_if_a $ext_gw_a) from { 192.168.0.12, 192.168.0.10, 192.168.0.3 } to !(self)
pass in quick on $int_if_a route-to ($ext_if_b $ext_gw_b) from { 192.168.0.11 } to !(self)

# ISP-1
pass in on $ext_if_a reply-to ($ext_if_a $ext_gw_a) inet proto tcp to ($ext_if_a) port { $tcp_svc_a }
pass in on $ext_if_a reply-to ($ext_if_a $ext_gw_a) inet proto udp to ($ext_if_a) port 27015
# ISP-2
pass in on $ext_if_b reply-to ($ext_if_b $ext_gw_b) inet proto tcp to ($ext_if_b) port { $tcp_svc_b }
#pass in on $ext_if_b reply-to ($ext_if_b $ext_gw_b) inet proto udp to ($ext_if_b) port { $udp_svc_b }


# routig policy for outbound packets into chanel
pass out quick route-to ($ext_if_a $ext_gw_a) from ($ext_if_a) to !(self:network)
pass out quick route-to ($ext_if_b $ext_gw_b) from ($ext_if_b) to !(self:network)

Код: Выделить всё

ifaces="ng0 ng1 fxp1 em0"
i=11 # номер правила, с которого начинаются считалки трафика
for iface in $ifaces do
    ${fwcmd} add $i count all from any to me in via $iface
    ${fwcmd} add $i+1 count all from me to any out via via $iface
    i=`expr $i + 2`
done
${fwcmd} add 65500 pass all