forum.lissyara.su

Код: Выделить всё

ether_nc="bge0" #local network
inter_nc="tun0"  #ADSL ppp
local_net="192.168.251.0/24"

## lan <- internet
altq on $ether_nc cbq bandwidth 100Mb queue {inet_in, default_in}
queue inet_in bandwidth 480Kb {user1_in, user2_in}
        queue user1_in bandwidth 5% cbq(red)
        queue user2_in bandwidth 95% cbq(red, borrow)
queue default_in bandwidth 99% cbq(default)

## lan -> internet
altq on $inter_nc cbq bandwidth 100Mb queue {inet_out, default_out}
queue inet_out bandwidth 220Kb {user1_out, user2_out}
        queue user1_out bandwidth 5% cbq(red)
        queue user2_out bandwidth 95% cbq(red, borrow)
queue default_out bandwidth 99% cbq(default)


pass in on $ether_nc from 192.168.251.2 to !$local_net queue user1_out no state
pass out on $ether_nc from !$local_net to 192.168.251.2 queue user1_in no state

pass in on $ether_nc from {192.168.251.0/24, !192.168.251.2} to !$local_net queue user2_out no state
pass out on $ether_nc from !$local_net to {192.168.251.0/24, !192.168.251.2} queue user2_in no state

Код: Выделить всё

                        altq on $ext_if       
          |--------------------------------------|
                                                        |
          |       |-----------------------------|----|
       | in| ---->|                                    |     |<------- in
LAN              |int_if     FreeBSD       ext_if |                  PPPoE
       |out|<----|     |                                    |--------> out
          |        |----|-----------------------------|
          |                 |
          |--------------|
          altq on $int_if

Код: Выделить всё

int_if="bge0" #local network
ext_if="tun0" #ADSL 

local_net="192.167.253.0/24"

loopb_nc="lo0"  
loopb_ip="127.0.0.1"

#ip которые не будут попадать в логи SQUID
table <vipip> { 192.167.253.0/24, !192.167.253.45, !192.167.253.48, !192.167.253.49}

#default behavior for filter rules
set block-policy drop
set skip on $loopb_ip

#packet normalization 
scrub in all 
scrub out all

#### CBQ Shaping ######################################################

## internet -> lan (100Mb, 1000Mb - channel width) (пропускная сетевой)
altq on $int_if cbq bandwidth 100Mb queue {def_in, inet_in}
queue def_in bandwidth 99% cbq(default) 
queue inet_in bandwidth 480Kb qlimit 1000 cbq(borrow) {user1_in, user2_in}
	queue user1_in bandwidth 90% cbq(red, borrow)
	queue user2_in bandwidth 10% cbq(red, borrow)


## lan -> internet
altq on $ext_if cbq bandwidth 100Mb queue {def_out, inet_out}
queue def_out bandwidth 99% cbq(default)
queue inet_out bandwidth 220Kb qlimit 1000 cbq(borrow) {user1_out, user2_out}
	queue user1_out bandwidth 90% cbq(red, borrow)
	queue user2_out bandwidth 10% cbq(red, borrow)

#99% cbq(default)  - все что не попадает в остальные очереди, попадает сюда
#altq on $int_if cbq bandwidth 100Mb queue {def_in, inet_in} - потому что при работе с самбой
#пакеты от других ip будут проходить тоже через шейпер через очередь default со скоростью почти 100Mb
#######################################################################


#### HFSC Shaping #####################################################

## internet -> lan (100Mb, 1000Mb - channel width) 480
#altq on $int_if bandwidth 100Mb hfsc queue {def_in, inet_in}
#queue def_in bandwidth 99% priority 0 hfsc(default)
#queue inet_in bandwidth 480Kb priority 7 hfsc{user1_in, user2_in}
#        queue user1_in bandwidth 80Kb priority 5 hfsc(realtime 80Kb upperlimit 480Kb)
#        queue user2_in bandwidth 400Kb priority 5 hfsc(realtime 400Kb upperlimit 480Kb)


## lan -> internet 220
#altq on $ext_if bandwidth 100Mb hfsc queue {def_out, inet_out}
#queue def_out bandwidth 99% priority 0 hfsc(default)
#queue inet_out bandwidth 220Kb priority 7 hfsc{user1_out, user2_out}
#        queue user1_out bandwidth 20Kb priority 5 hfsc(realtime 20Kb upperlimit 220Kb)
#        queue user2_out bandwidth 200Kb priority 5 hfsc(realtime 200Kb upperlimit 220Kb)


#######################################################################



#nat && rdr
nat on $ext_if from !$ext_if to any -> {$ext_if}

#trnasparent squid
rdr on $int_if proto tcp from <vipip> to any port www -> $loopb_ip  port $proxy_port

antispoof quick for $ext_if


#block on {$int_if} all
#pass in  on $int_if proto tcp from 192.168.251.0/24 to $int_if port 22
#pass out on $int_if proto tcp from $int_if port 22 to 192.168.251.0/24

# lan -> internet
pass in  on $int_if from 192.167.253.22   to !$local_net queue user1_out no state
pass in  on $int_if from 192.167.253.222 to !$local_net queue user2_out no state

# internet -> lan
pass out on $int_if from !$local_net to 192.167.253.22   queue user1_in no state
pass out on $int_if from !$local_net to 192.167.253.222 queue user2_in no state

#пакеты не попадающие под эти правила пойдут через очередь default (если не задан block on {$int_if} all)