Правила IPFW
Код: Выделить всё
#!/bin/sh
NatIP="NAT_IP"
oif="em1"
iif="em0"
NFlow_coll="COLL_IP"
/sbin/ipfw -q -f flush
/sbin/ipfw -f pipe flush
/etc/ipfw/tableflush
cmd="/sbin/ipfw add"
fwcmd="/sbin/ipfw"
/usr/sbin/ngctl mkpeer ipfw: nat 60 out
/usr/sbin/ngctl mkpeer ipfw: nat 80 out
/usr/sbin/ngctl mkpeer ipfw: nat 100 out
/usr/sbin/ngctl name ipfw:60 nat
/usr/sbin/ngctl name ipfw:80 natA
/usr/sbin/ngctl name ipfw:100 natB
/usr/sbin/ngctl connect ipfw: nat: 61 in
/usr/sbin/ngctl connect ipfw: natA: 81 in
/usr/sbin/ngctl connect ipfw: natB: 101 in
/usr/sbin/ngctl msg nat: setaliasaddr $NatIP
/usr/sbin/ngctl msg natA: setaliasaddr $NatIP
/usr/sbin/ngctl msg natB: setaliasaddr $NatIP
$cmd allow ip from any to any via lo0
$cmd deny ip from any to 127.0.0.0/8
$cmd deny log ip from 127.0.0.0/8 to any
$cmd allow tcp from any to any 88 in via $iif
$cmd allow tcp from any to any 2222
#Deny rules
### table 101 deny in world side nets
### table 102 deny nets
#$fwcmd table 101 add 192.168.0.0/16
$fwcmd table 101 add 10.0.0.0/8
$fwcmd table 101 add 172.16.0.0/16
$fwcmd table 101 add 0.0.0.0/8
$fwcmd table 101 add 127.0.0.0/8
$fwcmd table 101 add 169.254.0.0/16
$fwcmd table 101 add 204.152.64.0/23
$fwcmd table 101 add 224.0.0.0/3
$cmd deny all from table\(101\) to any in via $oif
$cmd deny ip from any to any 137 in
$cmd deny ip from any to any 138 in
$cmd deny ip from any to any 139 in
$cmd deny ip from any to any 81 in
$fwcmd table 102 add 72.0.0.0/16
$fwcmd table 102 add 202.97.238.0/16
$fwcmd table 102 add 192.38.38.0/24
$cmd deny all from any to table\(102\)
$cmd deny all from table\(102\) to any
###SHAPING
###
$fwcmd table 100 add 192.168.0.0/16
$fwcmd table 100 add 10.0.0.0/8
$fwcmd table 100 add 172.16.0.0/16
$fwcmd table 110 add 192.168.0.0/16
$fwcmd table 110 add 10.0.0.0/8
$fwcmd table 110 add 172.16.0.0/16
$fwcmd table 111 add External_Subnet
### 1024/1024 any tarif
$fwcmd pipe 1024 config bw 1024Kbit/s mask src-ip 0xffffffff # in
$fwcmd pipe 2024 config bw 512Kbit/s mask dst-ip 0xffffffff # out
### 512/256 world tarif
$fwcmd pipe 512 config bw 512Kbit/s mask src-ip 0xffffffff # in
$fwcmd pipe 612 config bw 256Kbit/s mask dst-ip 0xffffffff # out from client
### 512/256 world tarif for "only UA-IX unlim speed clients"
$fwcmd pipe 712 config bw 512Kbit/s mask src-ip 0xffffffff # in
$fwcmd pipe 812 config bw 256Kbit/s mask dst-ip 0xffffffff # out
$cmd pipe tablearg ip from table\(1\) to not table\(100\) out #Traffic to any from 1024/512 clients OUT
$cmd pipe tablearg ip from table\(11\) to not table\(100\) out #Traffic to any from 1024/512 clients OUT (external IP)
$cmd pipe tablearg ip from table\(4\) to not table\(0\) out #Traffic to world from 512/256 world speed clients OUT
$cmd pipe tablearg ip from table\(41\) to not table\(0\) out #Traffic to world from 512/256 world speed clients OUT (external IP)
$cmd netgraph 60 ipv4 from table\(1\) to not table\(100\) out via $oif
$cmd netgraph 80 ipv4 from table\(3\) to not table\(100\) out via $oif
$cmd netgraph 100 ipv4 from table\(6\) to not table\(100\) out via $oif
$cmd netgraph 61 ipv4 from not table\(100\) to $NatIP in via $oif
$cmd netgraph 81 ipv4 from not table\(100\) to $NatIP in via $oif
$cmd netgraph 101 ipv4 from not table\(100\) to $NatIP in via $oif
$cmd netgraph 71 ip from any to any in
$cmd pipe tablearg ip from not table\(100\) to table\(2\) in #Traffic to 1024/512 clients from any (IN)
$cmd pipe tablearg ip from not table\(100\) to table\(21\) in #Traffic to 1024/512 clients from any (IN) (external IP)
$cmd pipe tablearg ip from not table\(0\) to table\(5\) in #Traffic from World to 512/256 clients (IN)
$cmd pipe tablearg ip from not table\(0\) to table\(51\) in #Traffic from World to 512/256 clients (IN) (external IP)
# ipfw
$cmd allow ip from any to table\(1\) limit src-addr 60
$cmd allow ip from any to table\(2\) limit src-addr 60
$cmd allow ip from table\(1\) to any limit src-addr 60
$cmd allow ip from table\(2\) to any limit src-addr 60
$cmd allow ip from any to table\(3\) limit src-addr 60
$cmd allow ip from table\(3\) to any limit src-addr 60
$cmd allow ip from any to table\(4\) limit src-addr 60
$cmd allow ip from any to table\(5\) limit src-addr 60
$cmd allow ip from table\(4\) to any limit src-addr 60
$cmd allow ip from table\(5\) to any limit src-addr 60
$cmd allow ip from any to table\(6\) limit src-addr 60
$cmd allow ip from table\(6\) to any limit src-addr 60
$cmd allow all from $NatIP to any out via $oif
$cmd allow all from me to any
$cmd allow all from any to me
$cmd fwd LOCHOST_IP,88 log logamount 10000 tcp from table\(110\) to any 80
$cmd allow ip from any to table\(110\) src-port 80
$cmd allow ip from any to table\(11\) limit src-addr 60
$cmd allow ip from any to table\(21\) limit src-addr 60
$cmd allow ip from table\(11\) to any limit src-addr 60
$cmd allow ip from table\(21\) to any limit src-addr 60
$cmd allow ip from any to table\(31\) limit src-addr 60
$cmd allow ip from table\(31\) to any limit src-addr 60
$cmd allow ip from any to table\(41\) limit src-addr 60
$cmd allow ip from any to table\(51\) limit src-addr 60
$cmd allow ip from table\(41\) to any limit src-addr 60
$cmd allow ip from table\(51\) to any limit src-addr 60
$cmd allow ip from any to table\(61\) limit src-addr 60
$cmd allow ip from table\(61\) to any limit src-addr 60
$cmd fwd LOCHOST_IP,88 log logamount 10000 tcp from table\(111\) to any 80
$cmd allow ip from any to table\(111\) src-port 80
$cmd 65534 deny log logamount 100000 ip from any to any
/sbin/sysctl net.inet.ip.fw.one_pass=0
/usr/sbin/ngctl mkpeer ipfw: netflow 71 iface0
/usr/sbin/ngctl name ipfw:71 netflow
/usr/sbin/ngctl connect ipfw: netflow: 70 out0
/usr/sbin/ngctl mkpeer netflow: ksocket export inet/dgram/udp
/usr/sbin/ngctl msg netflow:export connect inet/COLL_IP:9996
/usr/sbin/ngctl msg netflow: setdlt { iface=0 dlt=12 }
/usr/sbin/ngctl msg netflow: setifindex { iface=0 index=5 }
Таблица 0 - содержит региональную зону (UA-IX)
Таблицы 1,2,3,4,5,6 содержат серые адреса (по сути локалка) тех кому открыт доступ - подлежат НАТ.
Таблицы 11,21,31,41,51,61, содержат реальные ИП адреса клиентов, которым разрешен доступ.
Для них на локальном интерфейсе организован алиас с реальным адресом, который выступает для них шлюзом.
Ситуация интересна тем, что реальный адрес, которого нет ни в одной таблице может пропинговать МИР, либо достучаться на любой порт в мир, кроме 80 - го порта. Запросы на 80 порт форвардяться на страничку, где написано что доступ закрыт. (правило fwd)