Перейти к содержанию

Операция «Кооперация»: IPFW, stargazer и 4 ADSL-соединения

Общага — место крайне полезное, особенно для тех, кто умеет искать халяву. Еда, выпивка, интернет… стоит лишь немного поднапрячься. В одной из таких общаг мы и будем творить свои злобные делишки — раздавать людям интернеты анлимно и покилограммно.
Под катом много конфигов и технических терминов, так что слабонервным и гуманитариям лучше не заходить

Что мы имеем?
— 4 ADSL-модема с безлимитами на каждом
— Сервер на FreeBSD 8.1
IPFW NAT
— Старгайзер в качестве биллинга

Вполне достаточно для наших целей. Перво-наперво, проверяем, чтобы в ядро было собрано с вот такими опциями:

##USER_OPTIONS
#Сам IPFW
options         IPFIREWALL
options         IPFIREWALL_FORWARD
#Включаем режим логов
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=100
#Включаем, собственно, NAT
options         IPFIREWALL_NAT
options         IPDIVERT
options         LIBALIAS
#Создаем 5 независимых таблиц маршрутизации: 4 для пользователей и одну для сервера
options         ROUTETABLES=5
options         HZ=4000

Далее просто приведу примеры своих конфигов с комментариями, ибо от howto большего и не требуется :)

Для начала — настраиваем таблицы маршрутизации. Для этого создаем файлик /usr/local/etc/rc.d/setfib1:

#!/bin/sh
# PROVIDE: SETFIB1
# REQUIRE: NETWORKING
# BEFORE: DAEMON
#
# Add the following lines to /etc/rc.conf to enable setfib -1 at startup
# setfib1 (bool): Set to "NO" by default.
#                Set it to "YES" to enable setfib1
# setfib1_defaultroute (str): Set to "" by default
#       Set it to ip address of default gateway for use in fib 1
. /etc/rc.subr
name="setfib1"
rcvar=`set_rcvar`
load_rc_config $name
[ -z "$setfib1_enable" ] && setfib1_enable="NO"
[ -z "$setfib1_defaultroute" ] && setfib1_defaultroute=""
start_cmd="${name}_start"
stop_cmd="${name}_stop"
setfib1_start()
{
if [ ${setfib1_defaultroute} ]
then
setfib 1 route add -net default ${setfib1_defaultroute}
else
echo "Can't set defaultroute for fib 1 (setfib1_defaultroute is not set)"
fi
}
setfib1_stop()
{
setfib 1 route del -net default
}

Делаем его исполняемым, и так для каждой таблицы (кроме дефолтной) — т.е. четыре штуки

В rc.conf:

gateway_enable="YES"
hostname="my_server.lan"
#Интерфейс, смотрящий во внутреннюю сеть
ifconfig_fxp0="inet 10.0.0.1 netmask 255.255.255.0"
#Интерфейс, смотрящий на модемы
ifconfig_fxp1="inet 192.169.0.5 netmask 255.255.255.0"
#Каждый модем в своем влане
cloned_interfaces="vlan1691 vlan1692 vlan1693 vlan1694 vlan1695"
ifconfig_vlan1691="inet 192.169.1.5 netmask 255.255.255.0 vlan 1691 vlandev fxp1"
ifconfig_vlan1692="inet 192.169.2.5 netmask 255.255.255.0 vlan 1692 vlandev fxp1"
ifconfig_vlan1693="inet 192.169.3.5 netmask 255.255.255.0 vlan 1693 vlandev fxp1"
ifconfig_vlan1694="inet 192.169.4.5 netmask 255.255.255.0 vlan 1694 vlandev fxp1"
#влан, смотрящий в локальную сеть провайдера
ifconfig_vlan1695="inet 192.168.100.9 netmask 255.255.255.0 vlan 1695 vlandev fxp1"
#Сам сервер ходит через модем №1
defaultrouter="192.169.1.1"
setfib1_enable="YES"
setfib1_defaultroute="192.169.1.1"
setfib2_enable="YES"
setfib2_defaultroute="192.169.2.1"
setfib3_enable="YES"
setfib3_defaultroute="192.169.3.1"
setfib4_enable="YES"
setfib4_defaultroute="192.169.4.1"
#Включаем шейпинг
dummynet_enable="YES"
#Включаем фаервол
firewall_enable="YES"
firewall_logging="YES"
#Конфиг-файл фаервола
firewall_script="/usr/home/snake/net/rc.fire.conf"

Не забываем о маршрутизации:

#Подсеть провайдера
route add 192.168.0.0/16 192.168.106.1
setfib 1 route add 192.168.0.0/16 192.168.100.1
setfib 2 route add 192.168.0.0/16 192.168.100.1
setfib 3 route add 192.168.0.0/16 192.168.100.1
setfib 4 route add 192.168.0.0/16 192.168.100.1

Ну и теперь приступаем к настройкам фаервола:
1, Запрещаем весь посторонний трафик

#!/bin/sh
#IPFW--------------------------------
fw="/sbin/ipfw -q"
fwa="/sbin/ipfw -q add"
#Ifaces-----------------------------
lan="fxp0"
lan2="fxp1"
inet="vlan1691"
inet2="vlan1692"
inet3="vlan1693"
inet4="vlan1694"
ifnet="vlan1695"
#Selfcare & service
##loopback (1000-1020)
$fwa 01000 allow ip from any to any via lo0
$fwa 01010 deny ip from any to 127.0.0.0/8
$fwa 01020 deny ip from 127.0.0.0/8 to any
##Разрешаем доступ к модемам, иначе ничего не увидим)
$fwa 01040 allow ip from 192.169.1.0/24 to me in via $inet
$fwa 01050 allow ip from me to 192.169.1.0/24 out via $inet
$fwa 01060 allow ip from 192.169.2.0/24 to me in via $inet2
$fwa 01070 allow ip from me to 192.169.2.0/24 out via $inet2
$fwa 01080 allow ip from 192.169.3.0/24 to me in via $inet3
$fwa 01090 allow ip from me to 192.169.3.0/24 out via $inet3
$fwa 01100 allow ip from 192.169.4.0/24 to me in via $inet4
$fwa 01110 allow ip from me to 192.169.4.0/24 out via $inet4
$fwa 01120 allow ip from 192.169.5.0/24 to me in via $ifnet
$fwa 01130 allow ip from me to 192.169.5.0/24 out via $ifnet
#Deny packets (2000-2999)
##Через интерфейсы, смотрящие непосредственно в интернет, не должен проходить локальный траффик
$fwa 2000 deny log ip from 10.0.0.0/8 to any in via $inet
$fwa 2010 deny log ip from any to 10.0.0.0/8 out via $inet
$fwa 2020 deny log ip from 172.16.0.0/12 to any in via $inet
$fwa 2030 deny log ip from any to 172.16.0.0/12 out via $inet
$fwa 2040 deny log ip from 192.168.0.0/16 to any in via $inet
$fwa 2050 deny log ip from any to 192.168.0.0/16 out via $inet
$fwa 2100 deny log ip from 10.0.0.0/8 to me in via $inet2
$fwa 2110 deny log ip from any to 10.0.0.0/8 out via $inet2
$fwa 2120 deny log ip from 172.16.0.0/12 to any in via $inet2
$fwa 2130 deny log ip from any to 172.16.0.0/12 out via $inet2
$fwa 2140 deny log ip from 192.168.0.0/16 to any in via $inet2
$fwa 2150 deny log ip from any to 192.168.0.0/16 out via $inet2
$fwa 2200 deny log ip from 10.0.0.0/8 to me in via $inet3
$fwa 2210 deny log ip from any to 10.0.0.0/8 out via $inet3
$fwa 2220 deny log ip from 172.16.0.0/12 to any in via $inet3
$fwa 2230 deny log ip from any to 172.16.0.0/12 out via $inet3
$fwa 2240 deny log ip from 192.168.0.0/16 to any in via $inet3
$fwa 2250 deny log ip from any to 192.168.0.0/16 out via $inet3
$fwa 2300 deny log ip from 10.0.0.0/8 to any in via $inet4
$fwa 2310 deny log ip from any to 10.0.0.0/8 out via $inet4
$fwa 2320 deny log ip from 172.16.0.0/12 to any in via $inet4
$fwa 2330 deny log ip from any to 172.16.0.0/12 out via $inet4
$fwa 2340 deny log ip from 192.168.0.0/16 to any in via $inet4
$fwa 2350 deny log ip from any to 192.168.0.0/16 out via $inet4
##Через подсеть провайдера может проходить только "свой" трафик
$fwa 2300 deny log ip from 10.0.0.0/8 to any in via $ifnet
$fwa 2310 deny log ip from any to 10.0.0.0/8 out via $ifnet
$fwa 2410 deny log ip from 172.16.0.0/12 to any in via $ifnet
$fwa 2420 deny log ip from any to 172.16.0.0/12 out via $ifnet

3. Собственно, правила для выпускания в интернет

#!/bin/sh
#IPFW--------------------------------
fw="/sbin/ipfw -q"
fwa="/sbin/ipfw -q add"
#Ifaces-----------------------------
lan="fxp0"
lan2="fxp1"
inet="vlan1691"
inet2="vlan1692"
inet3="vlan1693"
inet4="vlan1694"
ifvtk="vlan1695"
#IP groups--------------------------
#Внутренняя сеть
hostel="10.0.0.0/24"
net="192.168.0.0/16"
#Internet access
##Stargazer
###Интернет для пользователей в таблице 2
$fwa 04141 allow ip from "table(2)" to not $net in via $lan
$fwa 04144 allow ip from not $net to "table(2)" out via $lan
###Внутрисеть для пользователей из табл. 3
$fwa 04241 allow ip from "table(3)" to $net in via $lan
$fwa 04244 allow ip from $net to "table(3)" out via $lan
#Выпускаем трафик..
##Наружу
$fwa 06010 allow ip from any to not $vtk out via $inet
$fwa 06020 allow ip from any to not $vtk out via $inet2
$fwa 06030 allow ip from any to not $vtk out via $inet3
$fwa 06040 allow ip from any to not $vtk out via $inet4
$fwa 06050 allow ip from any to $vtk out via $ifvtk
##Пропускаем внутрь) В таблицах 5-9 разбитые на группы пользователи
$fwa 06210 allow ip from not $net to "table(5)" in via $inet
$fwa 06220 allow ip from not $net to "table(6)" in via $inet2
$fwa 06230 allow ip from not $net to "table(7)" in via $inet3
$fwa 06240 allow ip from not $net to "table(8)" in via $inet4
$fwa 06250 allow ip from not $net to "table(9)" in via $inet4
$fwa 06260 allow ip from $net to "table(3)" in via $ifnet
#----------------------------------
##ICMP
$fwa 60200 allow icmp from me to any
$fwa 60250 allow icmp from any to me
##Allow all outcoming
$fwa 65000 allow ip from me to any

А теперь — самое интересное :) Шейпинг:

#!/bin/sh
#IPFW--------------------------------
fw="/sbin/ipfw -q"
fwa="/sbin/ipfw -q add"
fwt="/sbin/ipfw table"
#Env---------------------------------
gw0="192.169.1.1"
gw1="192.169.1.1"
gw2="192.169.2.1"
gw3="192.169.3.1"
gw4="192.169.4.1"
gw5="192.169.5.1"
#Ifaces-----------------------------
lan="fxp0"
lan2="fxp1"
inet="vlan1691"
inet2="vlan1692"
inet3="vlan1693"
inet4="vlan1694"
ifnet="vlan1695"
#IP's-------------------------------
iplan="10.0.0.1"
ipnet="192.168.100.9"
#IP groups--------------------------
hostel="10.0.0.0/24"
net="192.168.0.0/16"
#Priority---------------------------
tcphigh=100
tcpother=40
udpall=20
ipall=20
tcp_ports="20,21,22,53,80,81,443,5190,5222,3128,8080,8081,8088,28960"
#Размер очереди прикидываем вот так:
#http://www.opennet.ru/tips/info/1411.shtml
#Queue size-------------------------
qdowni="350Kbytes"
qupi="50Kbytes"
qdownnet="550Kbytes"
qupnet="70Kbytes"
#Speed------------------------------
##Main outgoing queue
upi=500Kbit/s
##Main downloading queue
downi=3400Kbit/s
##NET outgoing queue
upnet=800Kbit/s
##net downloading queue
downnet=5000Kbit/s
#Пайпы (по одной на канал)
$fw pipe 100 config bw $downi queue $qdowni gred 0.002/10/30/0.1
$fw pipe 200 config bw $upi queue $qupi gred 0.002/10/30/0.1
$fw pipe 300 config bw $downi queue $qdowni gred 0.002/10/30/0.1
$fw pipe 400 config bw $upi queue $qupi gred 0.002/10/30/0.1
$fw pipe 500 config bw $downi queue $qdowni gred 0.002/10/30/0.1
$fw pipe 600 config bw $upi queue $qupi gred 0.002/10/30/0.1
$fw pipe 700 config bw $downi queue $qdowni gred 0.002/10/30/0.1
$fw pipe 800 config bw $upi queue $qupi gred 0.002/10/30/0.1
$fw pipe 900 config bw $downnet queue $qdownvtk gred 0.002/10/30/0.1
$fw pipe 1000 config bw $upnet queue $qupvtk gred 0.002/10/30/0.1
#-----------------------------------
#Очереди
#inet --> LAN
#Для различного типа трафика действует различный приоритет
$fw queue 101 config weight $tcphigh pipe 100 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 102 config weight $tcpother pipe 100 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 103 config weight $udpall pipe 100 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 104 config weight $ipall pipe 100 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 301 config weight $tcphigh pipe 300 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 302 config weight $tcpother pipe 300 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 303 config weight $udpall pipe 300 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 304 config weight $ipall pipe 300 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 501 config weight $tcphigh pipe 500 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 502 config weight $tcpother pipe 500 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 503 config weight $udpall pipe 500 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 504 config weight $ipall pipe 500 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 701 config weight $tcphigh pipe 700 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 702 config weight $tcpother pipe 700 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 703 config weight $udpall pipe 700 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 704 config weight $ipall pipe 700 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
#LAN --> inet
$fw queue 201 config weight $tcphigh pipe 200 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 202 config weight $tcpother pipe 200 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 203 config weight $udpall pipe 200 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 204 config weight $ipall pipe 200 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 401 config weight $tcphigh pipe 400 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 402 config weight $tcpother pipe 400 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 403 config weight $udpall pipe 400 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 404 config weight $ipall pipe 400 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 601 config weight $tcphigh pipe 600 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 602 config weight $tcpother pipe 600 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 603 config weight $udpall pipe 600 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 604 config weight $ipall pipe 600 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 801 config weight $tcphigh pipe 800 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 802 config weight $tcpother pipe 800 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 803 config weight $udpall pipe 800 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 804 config weight $ipall pipe 800 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
#WAN --> LAN
$fw queue 901 config weight $tcphigh pipe 900 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 902 config weight $tcpother pipe 900 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 903 config weight $udpall pipe 900 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
$fw queue 904 config weight $ipall pipe 900 gred 0.002/10/30/0.1 mask dst-ip 0xffffffff
#LAN --> WAN
$fw queue 1001 config weight $tcphigh pipe 1000 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 1002 config weight $tcpother pipe 1000 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 1003 config weight $udpall pipe 1000 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
$fw queue 1004 config weight $ipall pipe 1000 gred 0.002/10/30/0.1 mask src-ip 0xffffffff
#-----------------------------------
#Настройки NAT
$fw nat 100 config if $inet same_ports reset deny_in
$fw nat 200 config if $inet2 same_ports reset deny_in
$fw nat 300 config if $inet3 same_ports reset deny_in
$fw nat 400 config if $inet4 same_ports reset deny_in
$fw nat 500 config if $ifnet same_ports reset deny_in
#-----------------------------------
##Routing tables
setfib 0 route delete default
setfib 0 route add default 192.169.1.1
###Clients route tables 1200-1599
setfib 1 route delete default
setfib 1 route add default 192.169.1.1
$fwa 01210 setfib 1 ip from "table(5)" to any in recv $lan
$fwa 01220 setfib 1 ip from "table(5)" to any in recv $vlan1204
$fwa 01230 setfib 1 ip from "table(5)" to any in recv $vlan1205
setfib 2 route delete default
setfib 2 route add default 192.169.2.1
$fwa 01310 setfib 2 ip from "table(6)" to any in recv $lan
$fwa 01320 setfib 2 ip from "table(6)" to any in recv $vlan1204
$fwa 01330 setfib 2 ip from "table(6)" to any in recv $vlan1205
setfib 3 route delete default
setfib 3 route add default 192.169.3.1
$fwa 01310 setfib 3 ip from "table(7)" to any in recv $lan
$fwa 01320 setfib 3 ip from "table(7)" to any in recv $vlan1204
$fwa 01330 setfib 3 ip from "table(7)" to any in recv $vlan1205
setfib 4 route delete default
setfib 4 route add default 192.169.4.1
$fwa 01410 setfib 4 ip from "table(8)" to any in recv $lan
$fwa 01420 setfib 4 ip from "table(8)" to any in recv $vlan1204
$fwa 01430 setfib 4 ip from "table(8)" to any in recv $vlan1205
###---Table 9 for limit tariff users
$fwa 01440 setfib 4 ip from "table(9)" to any in recv $lan
$fwa 01450 setfib 4 ip from "table(9)" to any in recv $vlan1204
$fwa 01460 setfib 4 ip from "table(9)" to any in recv $vlan1205
#-----------------------------------
#NAT & queues
##Исходящие очереди
###ADSL1
$fwa 05011 queue 201 tcp from "table(5)" to any $tcp_ports out xmit $inet
$fwa 05012 queue 202 tcp from "table(5)" to not any $tcp_ports out xmit $inet
$fwa 05013 skipto 5110 tcp from "table(5)" to any out xmit $inet
$fwa 05014 queue 203 udp from "table(5)" to any out xmit $inet
$fwa 05015 skipto 5110 udp from "table(5)" to any out xmit $inet
$fwa 05016 queue 201 icmp from "table(5)" to any out xmit $inet
$fwa 05017 skipto 5110 icmp from "table(5)" to any out xmit $inet
$fwa 05018 queue 204 ip from "table(5)" to any out xmit $inet
###ADSL2
$fwa 05021 queue 401 tcp from "table(6)" to any $tcp_ports out xmit $inet2
$fwa 05022 queue 402 tcp from "table(6)" to not any $tcp_ports out xmit $inet2
$fwa 05023 skipto 5120 tcp from "table(6)" to any out xmit $inet2
$fwa 05024 queue 403 udp from "table(6)" to any out xmit $inet2
$fwa 05025 skipto 5120 udp from "table(6)" to any out xmit $inet2
$fwa 05026 queue 401 icmp from "table(6)" to any out xmit $inet2
$fwa 05027 skipto 5120 icmp from "table(6)" to any out xmit $inet2
$fwa 05028 queue 404 ip from "table(6)" to any out xmit $inet2
###ADSL3
$fwa 05031 queue 601 tcp from "table(7)" to any $tcp_ports out xmit $inet3
$fwa 05032 queue 602 tcp from "table(7)" to not any $tcp_ports out xmit $inet3
$fwa 05033 skipto 5130 tcp from "table(7)" to any out xmit $inet3
$fwa 05034 queue 603 udp from "table(7)" to any out xmit $inet3
$fwa 05035 skipto 5130 udp from "table(7)" to any out xmit $inet3
$fwa 05036 queue 601 icmp from "table(7)" to any out xmit $inet3
$fwa 05037 skipto 5130 icmp from "table(7)" to any out xmit $inet3
$fwa 05038 queue 604 ip from "table(7)" to any out xmit $inet3
###ADSL4
$fwa 05041 queue 801 tcp from "table(8)" to any $tcp_ports out xmit $inet4
$fwa 05042 queue 802 tcp from "table(8)" to not any $tcp_ports out xmit $inet4
$fwa 05043 skipto 5140 tcp from "table(8)" to any out xmit $inet4
$fwa 05044 queue 803 udp from "table(8)" to any out xmit $inet4
$fwa 05045 skipto 5140 udp from "table(8)" to any out xmit $inet4
$fwa 05046 queue 801 icmp from "table(8)" to any out xmit $inet4
$fwa 05047 skipto 5140 icmp from "table(8)" to any out xmit $inet4
$fwa 05048 queue 804 ip from "table(8)" to any out xmit $inet4
###Юзвери, сидящие на лимитированных тарифах обслуживаются в первую очередь
$fwa 05051 queue 801 ip from "table(9)" to any out xmit $inet4
###ADSL5
$fwa 05061 queue 1001 tcp from "table(3)" to $net $tcp_ports out xmit $ifnet
$fwa 05062 queue 1002 tcp from "table(3)" to not $net $tcp_ports out xmit $ifnet
$fwa 05063 skipto 5150 tcp from "table(3)" to any out xmit $ifnet
$fwa 05064 queue 1003 udp from "table(3)" to $net out xmit $ifnet
$fwa 05065 skipto 5150 udp from "table(3)" to any out xmit $ifnet
$fwa 05066 queue 1004 icmp from "table(3)" to $net out xmit $ifnet
$fwa 05067 skipto 5150 icmp from "table(3)" to any out xmit $ifnet
$fwa 05068 queue 1004 ip from "table(3)" to $net out xmit $ifnet
#-----------------------------------
##NAT
$fwa 05110 nat 100 ip from any to any via $inet
$fwa 05120 nat 200 ip from any to any via $inet2
$fwa 05130 nat 300 ip from any to any via $inet3
$fwa 05140 nat 400 ip from any to any via $inet4
$fwa 05150 nat 500 ip from any to any via $ifnet
#----------------------------------
##Incoming queues
$fwa 05311 queue 101 tcp from any $tcp_ports to "table(5)" in recv $inet
$fwa 05312 queue 102 tcp from not any $tcp_ports to "table(5)" in recv $inet
$fwa 05313 skipto 6010 tcp from any to "table(5)" in via $inet
$fwa 05314 queue 103 udp from any to "table(5)" in recv $inet
$fwa 05315 skipto 6010 udp from any to "table(5)" in via $inet
$fwa 05316 queue 101 icmp from any to "table(5)" in recv $inet
$fwa 05317 skipto 6010 icmp from any to "table(5)" in via $inet
$fwa 05318 queue 104 ip from any to "table(5)" in recv $inet
$fwa 05321 queue 301 tcp from any $tcp_ports to "table(6)" in recv $inet2
$fwa 05322 queue 302 tcp from not any $tcp_ports to "table(6)" in recv $inet2
$fwa 05323 skipto 6010 tcp from any to "table(6)" in via $inet2
$fwa 05324 queue 303 udp from any to "table(6)" in recv $inet2
$fwa 05325 skipto 6010 udp from any to "table(6)" in via $inet2
$fwa 05326 queue 301 icmp from any to "table(6)" in recv $inet2
$fwa 05327 skipto 6010 icmp from any to "table(6)" in via $inet2
$fwa 05328 queue 304 ip from any to "table(6)" in recv $inet2
$fwa 05331 queue 501 tcp from any $tcp_ports to "table(7)" in recv $inet3
$fwa 05332 queue 502 tcp from not any $tcp_ports to "table(7)" in recv $inet3
$fwa 05333 skipto 6010 tcp from any to "table(7)" in via $inet3
$fwa 05334 queue 503 udp from any to "table(7)" in recv $inet3
$fwa 05335 skipto 6010 udp from any to "table(7)" in via $inet3
$fwa 05336 queue 501 icmp from any to "table(7)" in recv $inet3
$fwa 05337 skipto 6010 icmp from any to "table(7)" in via $inet3
$fwa 05338 queue 504 ip from any to "table(7)" in recv $inet3
$fwa 05341 queue 701 tcp from any $tcp_ports to "table(8)" in recv $inet4
$fwa 05342 queue 702 tcp from not any $tcp_ports to "table(8)" in recv $inet4
$fwa 05347 skipto 6010 tcp from any to "table(8)" in via $inet4
$fwa 05343 queue 703 udp from any to "table(8)" in recv $inet4
$fwa 05347 skipto 6010 udp from any to "table(8)" in via $inet4
$fwa 05344 queue 701 icmp from any to "table(8)" in recv $inet4
$fwa 05347 skipto 6010 icmp from any to "table(8)" in via $inet4
$fwa 05345 queue 704 ip from any to "table(8)" in recv $inet4
$fwa 05351 queue 701 ip from any to "table(9)" in recv $inet4
$fwa 05352 skipto 6010 ip from any to "table(9)" in via $inet4
$fwa 05361 queue 901 tcp from $net $tcp_ports to "table(3)" in recv $ifnet
$fwa 05362 queue 902 tcp from not $net $tcp_ports to "table(3)" in recv $ifnet
$fwa 05367 skipto 6010 tcp from $net to "table(3)" in via $ifnet
$fwa 05363 queue 903 udp from $net to "table(3)" in recv $ifnet
$fwa 05367 skipto 6010 udp from $net to "table(3)" in via $ifnet
$fwa 05364 queue 901 icmp from $net to "table(3)" in recv $ifnet
$fwa 05367 skipto 6010 icmp from $net to "table(3)" in via $ifnet
$fwa 05365 queue 904 ip from $vtk to "table(3)" in recv $ifnet

Такая схема работает более или менее успешно. Пользователи распихиваются по таблицам примерно поровну, после чего за каждой группой пользователей закрепляется «свой» канал.
Все вопросы можно задавать тут)

    Добавить комментарий

    %d такие блоггеры, как: