>[оверквотинг удален]
>
>насколько мне известно, система ничего не знает об устройствах и тем более
>службах на другом конце второго интерфейса
>я тоже не смог разрулить второй нат: второй нат создал, к порту
>привязал и на этом мануал по нату во фре заканчивается мне
>проще было сделать все заново
>жду рабочие примеру с неподдельным любопытством
>пол-года назад поднимал эту тему на трех форумах - никто ничего не
>смог предложить
>так что заинтригован #!/bin/sh -
# Suck in the configuration variables.
if [ -z "${source_rc_confs_defined}" ]; then
if [ -r /etc/defaults/rc.conf ]; then
. /etc/defaults/rc.conf
source_rc_confs
elif [ -r /etc/rc.conf ]; then
. /etc/rc.conf
fi
fi
setup_loopback () {
############
# Only in rare cases do you want to change these rules
#
${fwcmd} add 500 pass all from any to any via lo0
${fwcmd} add 510 deny all from any to 127.0.0.0/8
${fwcmd} add 520 deny all from 127.0.0.0/8 to any
}
############
# Set quiet mode if requested
#
case ${firewall_quiet} in
[Yy][Ee][Ss])
fwcmd="/sbin/ipfw -q"
;;
*)
fwcmd="/sbin/ipfw"
;;
esac
############
# Flush out the list before we begin.
#
${fwcmd} -f flush
moldnets_file="/data/moldnets.txt"
localnet_table="10"
vpnnet_table="11"
expiredaccounts="12"
moldnet_table="100"
internaliface="Local"
mtciface="MTC"
starnetiface="Starnet"
netgraphifaces="ng*"
moldovaviastarnet_table="50"
moldovaviamtc_table="51"
moldovaviabothlinks_table="52"
moldovaviastarnet_mtcdown_table="53"
moldovaviamtc_starnetdown_table="54"
worldviastarnet_table="60"
worldviamtc_table="61"
worldviabothlinks_table="62"
worldviastarnet_mtcdown_table="63"
worldviamtc_starnetdown_table="64"
mtcauthpage="86.106.213.42"
admintable="15"
mtcipaddr="80"
starnetipaddr="90"
routeviamtc="81"
routeviastarnet="91"
setup_loopback
####################################################################
# Add ISP ip addresses
#
${fwcmd} table ${starnetipaddr} flush
${fwcmd} table ${starnetipaddr} add 89.28.98.xxx
${fwcmd} table ${mtcipaddr} flush
${fwcmd} table ${mtcipaddr} add 89.41.67.xxx
####################################################################
# Create Routing table
#
${fwcmd} table ${routeviamtc} flush
${fwcmd} table ${routeviamtc} add 89.41.67.0/24
${fwcmd} table ${routeviamtc} add 86.106.213.42
${fwcmd} table ${routeviamtc} add 212.0.200.58
${fwcmd} table ${routeviamtc} add 212.0.219.3
${fwcmd} table ${routeviastarnet} flush
${fwcmd} table ${routeviastarnet} add 89.28.98.0/24
${fwcmd} table ${routeviastarnet} add 217.26.150.4
${fwcmd} table ${routeviastarnet} add 87.248.160.5
####################################################################
# Add admin ip's to table
#
${fwcmd} table ${admintable} flush
${fwcmd} table ${admintable} add 192.168.15.253
${fwcmd} table ${admintable} add 192.168.15.13
####################################################################
# Add local networks to table
#
${fwcmd} table ${localnet_table} flush
${fwcmd} table ${localnet_table} add 192.168.65.0/24
####################################################################
# Add vpn networks to table
#
${fwcmd} table ${vpnnet_table} flush
${fwcmd} table ${vpnnet_table} add 192.168.15.0/24
####################################################################
# Add moldavian networks to table
#
${fwcmd} table ${moldnet_table} flush
while read net; do ${fwcmd} table ${moldnet_table} add $net > /dev/null ; done < $moldnets_file
####################################################################
# Separate traffic by interfaces
#
${fwcmd} add 1000 skipto 2000 ip from any to any via ${internaliface}
${fwcmd} add 1010 skipto 3000 ip from any to any via ${netgraphifaces}
${fwcmd} add 1020 skipto 4000 ip from any to any in recv ${mtciface}
${fwcmd} add 1030 skipto 5000 ip from any to any in recv ${starnetiface}
${fwcmd} add 1040 skipto 6000 ip from me to any out xmit ${mtciface}
${fwcmd} add 1050 skipto 6000 ip from me to any out xmit ${starnetiface}
${fwcmd} add 1060 skipto 10000 ip from any to any out xmit ${mtciface}
${fwcmd} add 1070 skipto 10000 ip from any to any out xmit ${starnetiface}
${fwcmd} add 1100 deny ip from any to any
####################################################################
# Filter traffic via Internal interface
#
${fwcmd} add 2000 allow ip from "table(${localnet_table})" to "table(${localnet_table})" via ${internaliface}
${fwcmd} add 2010 deny ip from any to any via ${internaliface}
####################################################################
# Filter traffic via VPN interfaces
#
${fwcmd} add 3000 deny ip from not "table(${admintable})" to ${mtcauthpage} in recv ${netgraphifaces}
#${fwcmd} add 3010 tee 4001 ip from any to any via ${netgraphifaces} in
#${fwcmd} add 3020 tee 4002 ip from any to any via ${netgraphifaces} out
${fwcmd} add 3030 allow ip from "table(${vpnnet_table})" to any in recv ${netgraphifaces}
${fwcmd} add 3040 allow ip from any to "table(${vpnnet_table})" out xmit ${netgraphifaces}
${fwcmd} add 3050 deny ip from any to any via ${netgraphifaces}
####################################################################
# Filter incoming traffic via MTC interface
#
${fwcmd} add 4000 count ip from not "table(${moldnet_table})" to any in recv ${mtciface}
${fwcmd} add 4010 count ip from "table(${moldnet_table})" to any in recv ${mtciface}
${fwcmd} add 4020 deny ip from any to not me in recv ${mtciface}
${fwcmd} add 4040 divert 1000 ip from any to any in recv ${mtciface}
${fwcmd} add 4050 queue 1000 ip from not "table(${moldnet_table})" to any in recv ${mtciface}
${fwcmd} add 4060 queue 1010 ip from any to any in recv ${mtciface}
${fwcmd} add 4070 skipto 6000 ip from any to me in recv ${mtciface}
${fwcmd} add 4080 skipto 10000 tag 1 ip from any to any in recv ${mtciface} keep-state
####################################################################
# Filter incoming traffic via Starnet interface
#
${fwcmd} add 5000 count ip from not "table(${moldnet_table})" to any in recv ${starnetiface}
${fwcmd} add 5010 count ip from "table(${moldnet_table})" to any in recv ${starnetiface}
${fwcmd} add 5020 deny ip from any to not me in recv ${starnetiface}
${fwcmd} add 5040 divert 2000 ip from any to any in recv ${starnetiface}
${fwcmd} add 5050 queue 3000 ip from not "table(${moldnet_table})" to any in recv ${starnetiface}
${fwcmd} add 5060 queue 3010 ip from any to any in recv ${starnetiface}
${fwcmd} add 5070 skipto 6000 ip from any to me in recv ${starnetiface}
${fwcmd} add 5080 skipto 10000 tag 2 ip from any to any in recv ${starnetiface} keep-state
####################################################################
# NAT section - outgoing/incoming traffic from/to me
#
#
# NAT special networks from/to me
#
${fwcmd} add 6000 check-state
${fwcmd} add 6010 skipto 20000 tag 3 ip from "table(${starnetipaddr})" to "table(${routeviamtc})" out keep-state
${fwcmd} add 6020 skipto 25000 tag 4 ip from "table(${mtcipaddr})" to "table(${routeviastarnet})" out keep-state
${fwcmd} add 6030 skipto 20000 tag 3 ip from "table(${mtcipaddr})" to any out keep-state
${fwcmd} add 6040 skipto 25000 tag 4 ip from "table(${starnetipaddr})" to any out keep-state
${fwcmd} add 6050 skipto 20000 tag 3 tcp from "table(${moldnet_table})" to me dst-port 21,22,1723,24554,49152-65535 in recv ${mtciface} setup keep-state
${fwcmd} add 6060 skipto 25000 tag 4 tcp from "table(${moldnet_table})" to me dst-port 21,22,1723,24554,49152-65535 in recv ${starnetiface} setup keep-state
${fwcmd} add 6070 skipto 20000 tag 3 icmp from any to me in recv ${mtciface} keep-state
${fwcmd} add 6080 skipto 25000 tag 4 icmp from any to me in recv ${starnetiface} keep-state
${fwcmd} add 6130 skipto 20000 tag 3 gre from any to me in recv ${mtciface} keep-state
${fwcmd} add 6140 skipto 25000 tag 4 gre from any to me in recv ${starnetiface} keep-state
${fwcmd} add 6500 deny ip from any to me in recv ${mtciface}
${fwcmd} add 6510 deny ip from any to me in recv ${starnetiface}
####################################################################
# NAT outgoing packets
#
${fwcmd} add 10000 check-state
${fwcmd} add 10010 skipto 20000 ip from any to any tagged 1
${fwcmd} add 10020 skipto 25000 ip from any to any tagged 2
#
# NAT special networks from all other users
#
${fwcmd} add 10110 skipto 20000 ip from any to "table(${routeviamtc})" out
${fwcmd} add 10120 skipto 25000 ip from any to "table(${routeviastarnet})" out
#
# NAT outgoing requests via MTC when Starnet is down
#
${fwcmd} add 10150 skipto 20000 ip from "table(${moldovaviamtc_starnetdown_table})" to "table(${moldnet_table})"
${fwcmd} add 10160 skipto 20000 ip from "table(${worldviamtc_starnetdown_table})" to not "table(${moldnet_table})"
#
# NAT outgoing requests via Starnet when MTC is down
#
${fwcmd} add 10170 skipto 25000 ip from "table(${moldovaviastarnet_mtcdown_table})" to "table(${moldnet_table})"
${fwcmd} add 10180 skipto 25000 ip from "table(${worldviastarnet_mtcdown_table})" to not "table(${moldnet_table})"
#
# NAT outgoing request via MTC interface
#
${fwcmd} add 10190 skipto 20000 ip from "table(${moldovaviamtc_table})" to "table(${moldnet_table})"
${fwcmd} add 10200 skipto 20000 ip from "table(${worldviamtc_table})" to not "table(${moldnet_table})"
#
# NAT outgoing request via Starnet interface
#
${fwcmd} add 10210 skipto 25000 ip from "table(${moldovaviastarnet_table})" to "table(${moldnet_table})"
${fwcmd} add 10220 skipto 25000 ip from "table(${worldviastarnet_table})" to not "table(${moldnet_table})"
#
# Drop other packets
#
${fwcmd} add 10500 deny ip from any to any
####################################################################
# NAT section - outgoing via MTC interface
#
${fwcmd} add 20000 allow ip from any to any in recv ${mtciface} tagged 1
${fwcmd} add 20010 allow ip from any to any in recv ${mtciface} tagged 3
${fwcmd} add 20020 pipe 200 ip from any to not "table(${moldnet_table})"
${fwcmd} add 20030 pipe 210 ip from any to any
${fwcmd} add 20040 queue 2000 ip from any to any
${fwcmd} add 20050 divert 1000 ip from any to any
${fwcmd} add 20060 count ip from any to any not diverted
${fwcmd} add 20070 skipto 40000 ip from any to any
####################################################################
# NAT section - outgoing via Starnet interface
#
${fwcmd} add 25000 allow ip from any to any in recv ${starnetiface} tagged 2
${fwcmd} add 25010 allow ip from any to any in recv ${starnetiface} tagged 4
${fwcmd} add 25020 pipe 400 ip from any to not "table(${moldnet_table})"
${fwcmd} add 25030 pipe 410 ip from any to any
${fwcmd} add 25040 queue 4000 ip from any to any
${fwcmd} add 25050 divert 2000 ip from any to any
${fwcmd} add 25060 count ip from any to any not diverted
${fwcmd} add 25070 skipto 40000 ip from any to any
####################################################################
# Separate outgoing traffic via interfaces
#
${fwcmd} add 40000 allow ip from any to "table(${mtcipaddr})" in recv ${mtciface} tagged 3
${fwcmd} add 40010 allow ip from any to "table(${starnetipaddr})" in recv ${starnetiface} tagged 4
${fwcmd} add 40020 skipto 45000 ip from "table(${mtcipaddr})" to any
${fwcmd} add 40030 skipto 50000 ip from "table(${starnetipaddr})" to any
${fwcmd} add 40100 deny ip from any to any
####################################################################
# All Outgoing traffic via MTC Interface
#
${fwcmd} add 45000 count ip from me to not "table(${moldnet_table})" out
${fwcmd} add 45010 count ip from me to "table(${moldnet_table})" out
${fwcmd} add 45020 pipe 200 ip from me to not "table(${moldnet_table})" not diverted
${fwcmd} add 45030 pipe 210 ip from me to any not diverted
${fwcmd} add 45040 queue 2000 ip from me to any not diverted
${fwcmd} add 45050 fwd 89.41.67.1 ip from me to any
${fwcmd} add 45060 skipto 65500 ip from any to any
####################################################################
# All Outgoing traffic via Starnet Interface
#
${fwcmd} add 50000 count ip from me to not "table(${moldnet_table})" out
${fwcmd} add 50010 count ip from me to "table(${moldnet_table})" out
${fwcmd} add 50020 pipe 400 ip from me to not "table(${moldnet_table})" not diverted
${fwcmd} add 50030 pipe 410 ip from me to any not diverted
${fwcmd} add 50040 queue 4000 ip from me to any not diverted
${fwcmd} add 50050 fwd 89.28.98.1 ip from me to any
${fwcmd} add 50060 skipto 65500 ip from any to any
####################################################################
# Shaper section
#
. /usr/local/etc/rc.d/rc.firewall.shaper
к этому всему делу прикручен скриптик проверяющий жывость каналов и в случае если один из них отвалился - заворачивает весь траффик через второй.
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
(??) on 19-Ноя-08, 19:09 
