Беседуя с умными людьми допер до следующего:
что есть.
1. Список префиксов сетей, находящихся в пиринге сервер получает от вышестоящего прова и держит их в табличке table 2.
2. На сервере используется биллинг nodeny.
Нужно в rc.firewall до дивертов прописать правило, заворачивающее все пакеты в диапазон table 2.
Учитывая то, что с синтаксисом freebsd я знаком плохо, прошу форумчан помочь написать мне это правило...
Вот rc.firewall
#!/bin/sh -
ipfw='/sbin/ipfw'
ournet='192.168.0.0/16'
fibernet='10.49.128.0/24'
gladkoenet='10.49.131.192/26'
wirelessnet='10.49.131.160/27'
ifout='fxp1'
ifuser='fxp0'
#System
${ipfw} -q -f flush
${ipfw} add 100 check-state
${ipfw} add 150 allow ip from any to any via lo0
${ipfw} add 151 deny all from any to 127.0.0.1/8
${ipfw} add 152 deny all from 127.0.0.1/8 to any
${ipfw} add 200 allow ip from me to any keep-state
${ipfw} add 201 deny ip from any to any 139
${ipfw} add 202 deny tcp from any to any 445
${ipfw} add 203 allow ip from any to me 10000
#Sec - vse chto ne nasha set blok
#${ipfw} add 220 deny ip from not ${ournet} to any via ${ifuser} in
#Sec - vse chto ne dlya nas ot prova blok
#${ipfw} add 240 deny ip from any to not me via ${ifout} in
#NAT
${ipfw} add 250 divert natd ip from any to any via ${ifout}
${ipfw} add 260 allow ip from any to any via ${ifout} out
#${ipfw} add 261 divert natd ip from any to 10.0.0.0/8 via ${ifuser}
#${ipfw} add 262 divert natd all from any to 10.0.0.0/8 out via ${ifout}
#${ipfw} add 263 divert natd all from any to 10.49.128.2 in via ${ifout}
#Allow SSH
${ipfw} add 300 allow tcp from any to me ssh
${ipfw} add 310 allow tcp from any to me 80
#Allow FTP
${ipfw} add 320 allow ftp from any to me via ${ifuser}
#Allow ICMP
${ipfw} add 330 allow icmp from any to me
#Zapret icmp-atak
${ipfw} add 334 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
#Allow DNS
${ipfw} add 340 allow udp from any 53 to any
${ipfw} add 341 allow udp from any to any 53
#Allow auth
${ipfw} add 350 allow udp from any to me 7723 via ${ifuser}
#Allow InsideSite
${ipfw} add 355 allow all from any to me 60834 via ${ifuser}
#Allow IRC
${ipfw} add 360 allow all from any to me 6667 via ${ifuser}
#Allow SQL
${ipfw} add 370 allow all from any to me 3306 via ${ifuser}
#Allow MAIL
#${ipfw} add 372 allow all from any to me 25
#${ipfw} add 374 allow all from any to me 110
#${ipfw} add 376 allow all from any to me 143
#${ipfw} add 378 allow all from any to me 2525
#Allow shttps
${ipfw} add 380 allow all from any to me 81
#Razreshaem new lan
${ipfw} add 390 allow all from 10.49.128.0/22 to me via ${ifuser}
${ipfw} add 391 allow all from me to 10.49.128.0/22 via ${ifuser}
#Zaprechaem vse k serveru
${ipfw} add 400 deny ip from any to me
#razreshaem vhod traf
${ipfw} add 450 allow ip from any to any via ${ifout}
#Obyazatelno
${ipfw} add 65400 deny ip from any to any
#Tarify unlim
#1.Zachetniy(For Stuff)
${ipfw} pipe 1 config bw 200Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 2 config bw 400Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 3 config bw 200Kbit/s mask src-ip 0XFFFFFFFF
#2.Admins(For Admins)
${ipfw} pipe 4 config bw 400Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 5 config bw 800Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 6 config bw 400Kbit/s mask src-ip 0XFFFFFFFF
#3.Second(for aliases)
${ipfw} pipe 7 config bw 56Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 8 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 9 config bw 56Kbit/s mask src-ip 0XFFFFFFFF
#4.
${ipfw} pipe 10 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 11 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 12 config bw 0Kbit/s mask src-ip 0XFFFFFFFF
#5.
${ipfw} pipe 13 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 14 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 15 config bw 0Kbit/s mask src-ip 0XFFFFFFFF
#6.
${ipfw} pipe 16 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 17 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 18 config bw 0Kbit/s mask src-ip 0XFFFFFFFF
#7.
${ipfw} pipe 19 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 20 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 21 config bw 0Kbit/s mask src-ip 0XFFFFFFFF
#8.
${ipfw} pipe 22 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 23 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 24 config bw 0Kbit/s mask src-ip 0XFFFFFFFF
#9.
${ipfw} pipe 25 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 26 config bw 0Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 27 config bw 0Kbit/s mask src-ip 0XFFFFFFFF
#10.Gladkoe(128)
${ipfw} pipe 28 config bw 140Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 29 config bw 281Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 30 config bw 140Kbit/s mask src-ip 0XFFFFFFFF
#11.Gladkoe(256)
${ipfw} pipe 31 config bw 281Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 32 config bw 563Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 33 config bw 281Kbit/s mask src-ip 0XFFFFFFFF
#12.Gladkoe(512)
${ipfw} pipe 34 config bw 563Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 35 config bw 1126Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 36 config bw 563Kbit/s mask src-ip 0XFFFFFFFF
#13.Gladkoe(1024)
${ipfw} pipe 37 config bw 1126Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 38 config bw 2232Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 39 config bw 1126Kbit/s mask src-ip 0XFFFFFFFF
#14.Unlim(200)
${ipfw} pipe 40 config bw 220Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 41 config bw 440Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 42 config bw 120Kbit/s mask src-ip 0XFFFFFFFF
#15.Unlim(300)
${ipfw} pipe 43 config bw 320Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 44 config bw 640Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 45 config bw 170Kbit/s mask src-ip 0XFFFFFFFF
#16.Unlim(600)
${ipfw} pipe 46 config bw 620Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 47 config bw 1240Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 48 config bw 320Kbit/s mask src-ip 0XFFFFFFFF
#17.Unlim(1200)
${ipfw} pipe 49 config bw 1240Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 50 config bw 2480Kbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 51 config bw 1240Kbit/s mask src-ip 0XFFFFFFFF
#18.Vesna
${ipfw} pipe 52 config bw 100Mbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 53 config bw 100Mbit/s mask dst-ip 0XFFFFFFFF
${ipfw} pipe 54 config bw 100Mbit/s mask src-ip 0XFFFFFFFF
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
on 18-Фев-09, 18:07 
