2 канала через setfibопции ядра:
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100
options IPFIREWALL_FORWARD
options DUMMYNET
options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPFIREWALL_NAT
options LIBALIAS
options ROUTETABLES=2
options HZ="1000"
/etc/sysctl.conf
net.inet.ip.fw.one_pass=0
/etc/rc.conf
defaultrouter="1.2.3.4"
setfib1_enable="YES"
setfib1_defaultroute="5.6.7.8"
ifconfig_bge0="up"
ifconfig_vlan110="inet 1.2.3.5 netmask 255.255.255.252 vlan 110 vlandev bge0"
ifconfig_vlan556="inet 5.6.7.9 netmask 255.255.255.252 vlan 556 vlandev bge0"
ifconfig_vlan557="inet 5.6.8.1 netmask 255.255.255.224 vlan 557 vlandev bge0"
ifconfig_vlan99="inet 1.2.4.1 netmask 255.255.255.224 vlan 99 vlandev bge0"
ifconfig_vlan111="inet 192.168.0.1 netmask 255.255.252.0 vlan 111 vlandev bge0"
ifconfig_vlan98="inet 10.0.3.252 netmask 255.255.252.0 vlan 98 vlandev bge0"
ifconfig_vlan23="inet 192.168.5.3 netmask 255.255.255.0 vlan 23 vlandev bge0"
ifconfig_vlan88="inet 172.16.0.1 netmask 255.255.255.240 vlan 88 vlandev bge0"
cloned_interfaces="vlan110 vlan556 vlan99 vlan111 vlan98 vlan23 vlan88"
# tunels
gif_interfaces="gif0 gif1 gif2"
gifconfig_gif0="1.2.3.5 x.x.x.x"
ifconfig_gif0="inet 192.168.0.1 192.168.20.1 netmask 255.255.255.255"
gifconfig_gif1="1.2.3.5 y.y.y.y"
ifconfig_gif1="inet 192.168.100.2 192.168.100.1 netmask 255.255.255.252"
gifconfig_gif2="1.2.3.5 z.z.z.z"
ifconfig_gif2="inet 192.168.101.2 192.168.101.1 netmask 255.255.255.252"
# routes
static_routes="one two vpn okt dmzR dmzI"
route_one="192.168.25.0/24 192.168.100.1"
route_two="192.168.26.0/24 192.168.101.1"
route_vpn="172.16.0.16/29 172.16.0.17"
route_okt="-net 192.168.20.0/24 192.168.20.1"
route_dmzR="1.2.4.0/27 1.2.4.1"
route_dmzI="5.6.7.0/29 5.6.8.1"
/etc/rc.ipfw.rule
#!/bin/sh
fwcmd="/sbin/ipfw -q"
int1_if="vlan111"
int2_if="vlan23"
int3_if="vlan88"
dmz_if="vlan99"
dmz2_if="vlan557"
inet_if="vlan110"
inet2_if="vlan556"
inet_ip="1.2.3.5"
inet2_ip="5.6.7.9"
load_table="/usr/local/sbin/load_table.sh"
load_dmz="/etc/rc.ipfw.dmz"
${fwcmd} -f flush
${fwcmd} -f pipe flush
${fwcmd} -f queue flush
$load_table
${fwcmd} add pass all from any to any via lo0
${fwcmd} add deny all from any to 127.0.0.0/8
${fwcmd} add deny ip from 127.0.0.0/8 to any
${fwcmd} add allow tcp from any to me 53, 8011
${fwcmd} add allow udp from any to me 53, 8011
${fwcmd} add allow all from table\(5\) to table\(5\)
${fwcmd} add allow all from table\(6\) to table\(6\)
${fwcmd} add deny all from table\(5\) to table\(6\)
${fwcmd} add deny all from table\(6\) to table\(5\)
${fwcmd} add skipto 2500 ip from table\(1\) to table\(7\)
${fwcmd} add skipto 2500 ip from table\(7\) to table\(1\)
${fwcmd} add deny ip from 192.168.1.0/24,192.168.2.0/24,192.168.3.0/24 to table\(7\)
${fwcmd} add 2500 allow gre from table\(3\) to ${inet_ip} in recv ${inet_if}
${fwcmd} add allow gre from ${inet_ip} to table\(3\) out xmit ${inet_if}
${fwcmd} add allow ip from any to any via ng[012]
${fwcmd} add allow ip from any to any via gif[012]
# REAL IP = DMZ 1
${fwcmd} add skipto 3500 ip from table\(2\) to 1.2.4.1
${fwcmd} add skipto 3500 ip from table\(3\) to 1.2.4.1
${fwcmd} add 3400 deny all from any to 1.2.4.1
$load_dmz
# скрипт подгрузки доступа локальных белых IP в интернет с нарезанием труб
${fwcmd} add allow ip from table\(2\) to any out xmit ${inet_if} out recv ${dmz_if}
${fwcmd} add allow ip from any to table\(2\) in recv ${inet_if}
# allow INTERNET ip
${fwcmd} add allow ip from table\(3\) to ${inet_ip} in recv ${inet_if}
${fwcmd} add allow ip from ${inet_ip} to table\(3\) out xmit ${inet_if}
${fwcmd} add allow ip from table\(3\) to ${inet2_ip} in recv ${inet2_if}
${fwcmd} add allow ip from ${inet2_ip} to table\(3\) out xmit ${inet2_if}
${fwcmd} add 9010 skipto 9060 ip from 192.168.1.0/24,192.168.2.0/24,192.168.3.0/24 to any in recv ${int1_if}
${fwcmd} add 9040 setfib 0 ip from 172.16.0.0/28,192.168.0.0/24 to any keep-state
${fwcmd} add 9050 allow ip from any to any via ${int3_if}
${fwcmd} add 9055 allow ip from any to any via ${int1_if}
${fwcmd} add 9060 setfib 1 ip from 192.168.1.0/24,192.168.2.0/24,192.168.3.0/24 to any in recv ${int1_if} keep-state
${fwcmd} add 9070 allow ip from any to any via ${int1_if}
${fwcmd} pipe 1 config bw 20Mbit/s queue 60 gred 0.002/10/30/0.1
${fwcmd} queue 1 config pipe 1 queue 60 mask src-ip 0xffffffff gred 0.002/10/30/0.1
${fwcmd} pipe 2 config bw 20Mbit/s queue 60 gred 0.002/10/30/0.1
${fwcmd} queue 2 config pipe 2 queue 60 mask dst-ip 0xffffffff gred 0.002/10/30/0.1
${fwcmd} nat 1 config log if ${inet_if} deny_in same_ports unreg_only
${fwcmd} nat 2 config log if ${inet2_if} deny_in same_ports unreg_only
${fwcmd} add 10005 nat 1 all from me to any out xmit ${inet_if}
# дает инет самой фре... без этого нету инету на фре
${fwcmd} add 10010 nat 1 all from 172.16.0.0/28 to any out recv ${int3_if} xmit ${inet_if}
${fwcmd} add 10020 nat 1 all from 172.16.0.16/29 to any out recv ng[012] xmit ${inet_if}
${fwcmd} add 10030 nat 1 all from 192.168.0.0/24 to any out recv ${int1_if} xmit ${inet_if}
${fwcmd} add 10040 nat 2 all from 192.168.1.0/24,192.168.2.0/24,192.168.3.0/24 to any out recv ${int1_if} xmit ${inet2_if}
${fwcmd} add 10005 nat 2 all from me to any out xmit ${inet2_if}
# с этим правилом и без него фря получает доступ в интернет только при убранном deny_in со 2го нат-а
${fwcmd} add 10050 nat 1 all from any to ${inet_ip} in recv ${inet_if}
${fwcmd} add 10060 queue 1 ip from any to any out xmit ${inet2_if}
${fwcmd} add 10070 nat 2 all from any to ${inet2_ip} in recv ${inet2_if}
${fwcmd} add 10080 queue 2 ip from any to any in recv ${inet2_if}
${fwcmd} add allow all from any to any
${fwcmd} add deny all from any to any
ограничиваю скорость только вход/выход на 2й нат
setfib -F 1 ping www.ru
не работает!
setfib -F 0 ping www.ru
всё ок!
из "вне" 5.6.7.9 не пингуется. как сделать доступ на 2й ip ?
${fwcmd} nat 2 config log if ${inet2_if} deny_in same_ports unreg_only
= deny_in убираю и получаю:
setfib -F 1 ping www.ru
всё ок!
setfib -F 0 ping www.ru
всё ок!
из "вне" 5.6.7.9 не пингуется. как сделать доступ на 2й ip ?
П.С. перерыл тонну документаций/статей готовых, не могу разобраться.
П.П.С. 1й раз настраиваю 2 канала (в планах сделать авто переключение при потере сигналов... скриптом по пингу), если есть метод лучше ткните.
