>Вот такая вот проблема - все было хорошо:) Внутренняя сеть, под виндой,
>серверочек под FreeBSD для инета, к нему по VPN клиенты поключаются,и
>имеют интернет через вторую сетевуху.Работало все прекрасно,но вдруг решили завести второго
>провайдера,для страховки,а то основной часто недоступен:( И как вот сделать такое?
>И главное,как сделать,чтоб дополнительный использовался только тогда,когда основной выключен??
>Помогите,надо срочно,естественно:)
>Пытаюсь разобраться и сам,конечно,но вдруг кто решал подобное? Че велосипеды то изобретать?:)
>
У меня реализовано вот так:
#!/bin/sh
ipfw='/sbin/ipfw -q'
#internet interface 1
interface_inet1='tl0'
inet_ip1='внешний_IP1'
gate_ip1='шлюз_для_IP1'
#internet interface 2
interface_inet2='ed0'
inet_ip2='внешний_IP12'
gate_ip2='шлюз_для_IP2'
#Local interface
if_dmz='rl0'
dmz='192.168.0.10'
dmznet='192.168.0.0/24'
#Port divert
port_divert1='8672'
port_divert2='8674'
#Testing IP
test_ip1='192.5.5.241'
test_ip2='198.32.64.12'
test_ip3='193.0.14.129'
test_ip4='198.41.0.10'
test_ip5='192.36.148.17'
test_ip6='128.63.2.53'
pathlog="/var/log/"
pathfw="/usr/local/etc/rc.d/"
pathpid="/var/run/"
#Start natd
if [ "`ps ax | grep "natd -a ${inet_ip2} -p ${port_divert2}" | grep -v "grep"`x" = "x" ]; then
natd -a ${inet_ip2} -p ${port_divert2} -f /etc/natd.conf
fi
if [ "`ps ax | grep "natd -a ${inet_ip1} -p ${port_divert1}" | grep -v "grep"`x" = "x" ]; then
natd -a ${inet_ip1} -p ${port_divert1} -f /etc/natd.conf
fi
fw_rules() {
${ipfw} -f flush
#LO
${ipfw} add 1300 allow ip from any to any via lo
#Divert1
${ipfw} add 1600 divert ${port_divert1} icmp from me to ${test_ip1},${test_ip2},${test_ip3} icmptype 8
${ipfw} add 1650 divert ${port_divert2} icmp from me to ${test_ip4},${test_ip5},${test_ip6} icmptype 8
${ipfw} add 1700 fwd ${gate_ip1} icmp from ${inet_ip1} to ${test_ip1},${test_ip2},${test_ip3} icmptype 8
${ipfw} add 1750 fwd ${gate_ip2} icmp from ${inet_ip2} to ${test_ip4},${test_ip5},${test_ip6} icmptype 8
#${ipfw} add 1800 divert ${port_divert1} icmp from ${test_ip1},${test_ip2},${test_ip3} to ${inet2} in via ${interface_inet1} icmptype 0,3,11,14,16
#${ipfw} add 1850 divert ${port_divert2} icmp from ${test_ip4},${test_ip5},${test_ip6} to ${inet1} in via ${interface_inet2} icmptype 0,3,11,14,16
${ipfw} add 1900 allow icmp from ${test_ip1},${test_ip2},${test_ip3} to me in via ${interface_inet1} icmptype 0,3,11,14,16
${ipfw} add 1950 allow icmp from ${test_ip4},${test_ip5},${test_ip6} to me in via ${interface_inet2} icmptype 0,3,11,14,16
#Divert2
${ipfw} add 2000 allow tcp from ${mail} 1024-65535 to any 25 in via ${if_dmz}
${ipfw} add 2050 allow tcp from ${mail} 25 to any 1024-65535 in via ${if_dmz} established
${ipfw} add 2100 divert ${port_divert1} tcp from ${mail} 1025-65535 to any 25
${ipfw} add 2150 divert ${port_divert1} tcp from ${mail} 25 to any 1024-65535
${ipfw} add 2500 fwd ${gate_ip1} all from ${inet_ip1} to any
${ipfw} add 2700 divert ${port_divert1} tcp from any 1024-65535 to ${inet_ip1} 25 in via ${interface_inet1}
${ipfw} add 2750 divert ${port_divert1} tcp from any 25 to ${inet_ip1} 1024-65535 in via ${interface_inet1}
${ipfw} add 2800 allow tcp from any 1024-65535 to ${mail} 25 in via ${interface_inet1}
${ipfw} add 2850 allow tcp from any 25 to ${mail} 1024-65535 in via ${interface_inet1} established
${ipfw} add 2900 allow tcp from any 1024-65535 to ${mail} 25 out via ${if_dmz}
${ipfw} add 2950 allow tcp from any 25 to ${mail} 1024-65535 out via ${if_dmz} established
#Divert3
${ipfw} add 3000 divert ${port_d1} all from ${dmznet} to any
${ipfw} add 3100 fwd ${gate1} all from ${inet1} to any
${ipfw} add 3200 divert ${port_d1} all from any to ${inet1} in via ${if_inet1}
#HTTP,HTTPS
${ipfw} add 8000 allow tcp from ${dmznet} 1024-65535 to any 80,443,8080 in via ${if_dmz}
${ipfw} add 8100 allow tcp from ${inet1} 1024-65535 to any 80,443,8080 out via ${if_inet1}
${ipfw} add 8150 allow tcp from any 80,443,8080 to ${inet1} 1024-65535 in via ${if_inet1} established
${ipfw} add 8200 allow tcp from any 80,443,8080 to ${dmznet} 1024-65535 in via ${if_inet1} established
${ipfw} add 8300 allow tcp from any 80,443,8080 to ${dmznet} 1024-65535 out via ${if_dmz} established
}
ch_all() {
if_inet1=${interface_inet1}
if_inet2=${interface_inet2}
inet1=${inet_ip1}
inet2=${inet_ip2}
port_d1=${port_divert1}
port_d2=${port_divert2}
gate1=${gate_ip1}
gate2=${gate_ip2}
fw_rules
echo "0" > ${pathpid}fw.id
echo "`date '+%d-%m-%Y %H:%M:%S'` All channels active" >> ${pathlog}rc.firewall.log
}
ch_1() {
if_inet1=${interface_inet2}
if_inet2=${interface_inet2}
inet1=${inet_ip2}
inet2=${inet_ip2}
port_d1=${port_divert2}
port_d2=${port_divert2}
gate1=${gate_ip2}
gate2=${gate_ip2}
fw_rules
echo "1" > ${pathpid}fw.id
echo "`date '+%d-%m-%Y %H:%M:%S'` Not connect channel 1" >> ${pathlog}rc.firewall.log
}
ch_2() {
if_inet1=${interface_inet1}
if_inet2=${interface_inet1}
inet1=${inet_ip1}
inet2=${inet_ip1}
port_d1=${port_divert1}
port_d2=${port_divert1}
gate1=${gate_ip1}
gate2=${gate_ip1}
fw_rules
echo "2" > ${pathpid}fw.id
echo "`date '+%d-%m-%Y %H:%M:%S'` Not connect channel 2" >> ${pathlog}rc.firewall.log
}
if [ x$1 = "xstart" ]; then {
if_inet1=${interface_inet1}
if_inet2=${interface_inet2}
inet1=${inet_ip1}
inet2=${inet_ip2}
port_d1=${port_divert1}
port_d2=${port_divert2}
gate1=${gate_ip1}
gate2=${gate_ip2}
fw_rules
echo "`date '+%d-%m-%Y %H:%M:%S'` Start firewall" >> ${pathlog}rc.firewall.log
echo "0" > ${pathpid}fw.id
}
fi
if [ "`ping -o -t1 $test_ip1|awk '/loss/ {print($4)}'`" = "1" ]; then
tst_1="0"
elif [ "`ping -o -t1 $test_ip2|awk '/loss/ {print($4)}'`" = "1" ]; then
tst_1="0"
elif [ "`ping -o -t1 $test_ip3|awk '/loss/ {print($4)}'`" = "1" ]; then
tst_1="0"
else tst_1="1"
fi
#tst_1="1"
if [ "`ping -o -t1 $test_ip4|awk '/loss/ {print($4)}'`" = "1" ]; then
tst_2="0"
elif [ "`ping -o -t1 $test_ip5|awk '/loss/ {print($4)}'`" = "1" ]; then
tst_2="0"
elif [ "`ping -o -t1 $test_ip6|awk '/loss/ {print($4)}'`" = "1" ]; then
tst_2="0"
else tst_2="1"
fi
#tst_2="1"
fw_id="`cat ${pathpid}fw.id`"
tst_all=${tst_1}${tst_2}
case $tst_all in
00) if [ $fw_id = 0 ]; then
exit
else ch_all
fi ;;
10) if [ $fw_id = 1 ]; then
exit
else ch_1
fi ;;
01) if [ $fw_id = 2 ]; then
exit
else ch_2
fi ;;
11) if [ $fw_id = 3 ]; then
exit
else echo "3" > ${pathpid}fw.id
echo "`date '+%d-%m-%Y %H:%M:%S'` No active connect" >> ${pathlog}rc.firewall.log
fi ;;
esac
exit
Несколько громоздко, но работает :)
Аналогично секции #HTTP,HTTPS необходимо добавить нужные правила.
Как это будет сочетатся с VPN незнаю.
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
(??) on 05-Сен-06, 11:40 
