forum.lissyara.su

Код: Выделить всё

#!/bin/sh
 fwcmd="/sbin/ipfw"
 ${fwcmd} -f flush
 ${fwcmd} -f pipe flush
 ${fwcmd} -f queue flush

 ${fwcmd} add 1040 allow ip from any to any via ste0
# ${fwcmd} add 111 pass udp from any to any 53
# ${fwcmd} add 112 pass udp from any 53 to any

 ${fwcmd} add 1020 allow tcp from any to any ssh
 ${fwcmd} add 1030 allow tcp from any ssh to any
 ${fwcmd} add 1050 deny ip from any to 192.168.0.0/16 in recv nfe0
 ${fwcmd} add 1060 deny ip from 192.168.0.0/16 to any in recv nfe0
 ${fwcmd} add 1070 deny ip from any to 172.16.0.0/12 in recv nfe0
 ${fwcmd} add 1080 deny ip from 172.16.0.0/12 to any in recv nfe0
 ${fwcmd} add 1090 deny ip from any to 10.0.0.0/8 in recv nfe0

# cat /etc/rc.ipfw1
#!/bin/sh
 fwcmd="/sbin/ipfw"
 ${fwcmd} -f flush
 ${fwcmd} -f pipe flush
 ${fwcmd} -f queue flush

 ${fwcmd} add 1040 allow ip from any to any via ste0
# ${fwcmd} add 111 pass udp from any to any 53
# ${fwcmd} add 112 pass udp from any 53 to any

 ${fwcmd} add 1020 allow tcp from any to any ssh
 ${fwcmd} add 1030 allow tcp from any ssh to any
 ${fwcmd} add 1050 deny ip from any to 192.168.0.0/16 in recv nfe0
 ${fwcmd} add 1060 deny ip from 192.168.0.0/16 to any in recv nfe0
 ${fwcmd} add 1070 deny ip from any to 172.16.0.0/12 in recv nfe0
 ${fwcmd} add 1080 deny ip from 172.16.0.0/12 to any in recv nfe0
 ${fwcmd} add 1090 deny ip from any to 10.0.0.0/8 in recv nfe0
 ${fwcmd} add 10100 deny ip from 10.0.0.0/8 to any in recv nfe0
 ${fwcmd} add 10110 deny ip from any to 169.254.0.0/16 in recv nfe0
 ${fwcmd} add 10120 deny ip from 169.254.0.0/16 to any in recv nfe0

 ${fwcmd} pipe 1 config bw 10Mbit/s queue 60 gred 0.002/10/30/0.1
 ${fwcmd} queue 1 config pipe 1 mask src-ip 0xffffffff queue 60 gred 0.002/10/30/0.1

 ${fwcmd} pipe 2 config bw 1Mbit/s queue 60 gred 0.002/10/30/0.1
 ${fwcmd} queue 2 config pipe 2 mask dst-ip 0xffffffff queue 60 gred 0.002/10/30/0.1

# ${fwcmd} pipe 3 config bw 512Kbit/s queue 60 gred 0.002/10/30/0.1
# ${fwcmd} queue 3 config pipe 3 mask src-ip 0xffffffff queue 60 gred 0.002/10/30/0.1

# ${fwcmd} pipe 4 config bw 1Mbit/s queue 60 gred 0.002/10/30/0.1
# ${fwcmd} queue 4 config pipe 4 mask dst-ip 0xffffffff queue 60 gred 0.002/10/30/0.1

# ${fwcmd} pipe 5 config bw 2Mbit/s queue 60 gred 0.002/10/30/0.1
# ${fwcmd} queue 5 config pipe 5 mask src-ip 0xffffffff queue 60 gred 0.002/10/30/0.1

# ${fwcmd} pipe 6 config bw 1Mbit/s queue 60 gred 0.002/10/30/0.1
# ${fwcmd} queue 6 config pipe 6 mask dst-ip 0xffffffff queue 60 gred 0.002/10/30/0.1

  

#nat 2 config log same_ports redirect_addr 192.168.1.36 1.2.3.5

 ${fwcmd} add 10130 skipto 10160 ip from 192.168.1.221 to any
 ${fwcmd} add 10140 skipto 10160 ip from any to 192.168.1.221
 ${fwcmd} add 10131 skipto 10160 ip from 192.168.1.222 to any
 ${fwcmd} add 10141 skipto 10160 ip from any to 192.168.1.222

# ${fwcmd} add 10132 skipto 10250 ip from 192.168.1.225 to any

# ${fwcmd} add 10133 skipto 10350 ip from 192.168.1.223 to any
# ${fwcmd} add 10134 skipto 10350 ip from 192.168.1.224 to any
# ${fwcmd} add 10135 skipto 10350 ip from 192.168.1.226 to any
# ${fwcmd} add 10136 skipto 10350 ip from 192.168.1.227 to any
# ${fwcmd} add 10137 skipto 10350 ip from 192.168.1.228 to any
# ${fwcmd} add 10138 skipto 10350 ip from 192.168.1.229 to any
# ${fwcmd} add 10139 skipto 10350 ip from 192.168.1.230 to any

 ${fwcmd} add 10150 queue 1 ip from any to any out xmit nfe0
 ${fwcmd} add 10160 nat 1 ip from any to any via nfe0
 ${fwcmd} add 10161 allow ip from 192.168.1.221 to any
 ${fwcmd} add 10162 allow ip from any to 192.168.1.221
 ${fwcmd} add 10163 allow ip from 192.168.1.222 to any
 ${fwcmd} add 10164 allow ip from any to 192.168.1.222
 ${fwcmd} add 10170 queue 2 ip from any to any in recv nfe0

 ${fwcmd} add 10180 allow all from any to any

# ${fwcmd} add 10250 queue 3 ip from any to any out xmit nfe0
# ${fwcmd} add 10260 nat 1 ip from any to any via nfe0
# ${fwcmd} add 10270 queue 4 ip from any to any in recv nfe0

# ${fwcmd} add 10280 allow all from any to any

# ${fwcmd} add 10350 queue 5 ip from any to any out xmit nfe0
# ${fwcmd} add 10360 nat 1 ip from any to any via nfe0
# ${fwcmd} add 10370 queue 6 ip from any to any in recv nfe0

# ${fwcmd} add 10380 allow all from any to any

# ${fwcmd} add 10190 queue 1 ip from any to any out xmit nfe0
#add 10200 nat 2 ip from 192.168.1.36 to any out xmit nfe0
#add 10210 nat 2 ip from any to 1.2.3.5 in recv nfe0
# ${fwcmd} add 10220 queue 2 ip from any to any in recv nfe0

 ${fwcmd} add 10230 allow all from any to any

 ${fwcmd} add 65534 deny all from any to any