The OpenNET Project / Index page

[ новости /+++ | форум | теги | ]

форумы
правила/FAQ
поиск
регистрация
вход
слежка
RSS


Индекс форумов
Составление сообщения

Исходное сообщение
"FreeBSD Dummynet не работает"
Отправлено Sindikat88, 26-Июн-17 17:41 
Камрады, приветствую!
Имеется шлюз на FreeBSD 10.3 с параметрами ядра:
#NAT
options IPFIREWALL
options IPDIVERT
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=50
options IPFIREWALL_NAT
options LIBALIAS
options ROUTETABLES=5
options DUMMYNET
options HZ="1000"                       # for DUMMYNET

# Options for a IPsec enabled kernel
options         IPSEC
options         IPSEC_FILTERTUNNEL
options         IPSEC_NAT_T
device          crypto
device          enc

IPFW работает с таким набором правил:
#!/bin/sh
ipfw -f flush
ipfw -f pipe flush
ipfw -f queue flush

cmd="/sbin/ipfw add"
FWCMD="/sbin/ipfw -q"

LanOut="igb1" # Внешняя сетевуха
NetOut="xxx.xxx.xxx.xxx/30" # внешняя сеть
IpOut="xxx.xxx.xxx.xxx" # Внешний IP

LanIn="igb0" # внутренняя сетевуха
NetIn="192.168.180.0/23" # Внутренняя сеть
ip_lan="192.168" # Шаблон внутреннего адреса

LanGuest="vlan10" # VLAN для гостевой WI-FI сети
NetGuest="192.168.185.0/24" #VLAN сеть для гостевой WI-FI сети

LanSmart="vlan20" # VLAN для Smart WI-FI сети
NetSmart="192.168.190.0/24" #VLAN сеть для Smart

openvpn_if="tun0"       #OpenVPN port
IpVPN="192.168.225.0"


ipfw pipe 1 config bw 1000Kbit/s mask dst-ip 0x000000ff
ipfw pipe 2 config bw 1000Kbit/s mask src-ip 0x000000ff

ipfw add 041 pipe 1 ip from any to 192.168.180.0/23 in
ipfw add 042 pipe 2 ip from 192.168.180.0/23 to any out

#NAT
ipfw nat 1 config if igb1 log same_ports


#local
$cmd 005 allow all from any to any via $LanIn
#VPN
$cmd 006 allow all from any to any via tun0
#local Guest Network
$cmd 007 allow all from any to any via $LanGuest
#GIF
$cmd 008 allow ip from any to any via gif0
#local Smart Network
$cmd 009 allow all from any to any via $LanSmart
# loopback
$cmd 010 allow all from any to any via lo0

#Incoming traffic to NAT
$cmd 030 nat 1 ip from any to any in via $LanOut

#NAT from AS to Inet
$cmd 033 nat 1 ip from $NetIn to any out via $LanOut

#NAT from Guest to Inet
$cmd 035 nat 1 ip from $NetGuest to any out via $LanOut

#NAT from Smart to Inet
$cmd 038 nat 1 ip from $NetSmart to any out via $LanOut

#Allow DYN rules
$cmd 040 check-state

# DNS resolve
$cmd 052 allow ip from any 53 to any via $LanOut
$cmd 053 allow ip from any to any 53 via $LanOut

# Outgoing server to Internet
$cmd 060 allow ip from me to any out via $LanOut setup keep-state

#IPSEC VPN Smart
$cmd 061 allow udp from xxx.xxx.xxx.xxx to me isakmp
$cmd 062 allow udp from me to xxx.xxx.xxx.xxx isakmp
$cmd 063 allow esp from xxx.xxx.xxx.xxx to me
$cmd 064 allow esp from me to xxx.xxx.xxx.xxx
$cmd 065 allow ipencap from xxx.xxx.xxx.xxx to me
$cmd 066 allow ipencap from me to xxx.xxx.xxx.xxx

# ICMP
$cmd 100 allow icmp from any to any out via $LanOut keep-state

# OpenVPN
$cmd 101 allow tcp from xxx.xxx.xxx.xxx to me 2000 in via ${LanOut}
$cmd 102 allow tcp from me 2000 to xxx.xxx.xxx.xxx out via ${LanOut}
$cmd 103 allow all from any to any in via ${openvpn_if}
$cmd 104 allow all from any to any out via ${openvpn_if}

# Time
$cmd 120 allow udp from any to any 123 out via $LanOut keep-state

#WI-FI Guest
$cmd 123 allow ip from $NetGuest to any 80,443,21 out via $LanOut setup keep-state

#SIP
$cmd 131 allow ip from 193.201.230.128/26 to '192.168.180.0{31-89}' in via ${LanOut}
$cmd 132 allow ip from '192.168.180.0{31-89}' to 193.201.230.128/26 out via ${LanOut}

#NAT
$cmd 141 allow ip from '192.168.180.0{11-29}' to any out via $LanOut setup keep-state
#TV
$cmd 143 allow ip from '192.168.180.0{95-97}' to any out via $LanOut setup keep-state

#Разрешаем определенный ICMP-трафик из мира к нам
$cmd 161 allow icmp from any to me in via $LanOut icmptype 3,8,12
#Разрешаем определенный ICMP-трафик от нас в мир
$cmd 162 allow icmp from me to any out via $LanOut icmptype 0,3,4,11,12
#Запрещаем прочий ICMP-трафик
$cmd 163 deny log icmp from any to me in via $LanOut icmptype 5,9,10,13,15,17

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 200 deny all from 192.168.0.0/16 to any in via $LanOut
$cmd 201 deny all from 172.16.0.0/12 to any in via $LanOut
$cmd 202 deny all from 10.0.0.0/8 to any in via $LanOut
$cmd 203 deny all from 127.0.0.0/8 to any in via $LanOut
$cmd 204 deny all from 0.0.0.0/8 to any in via $LanOut
$cmd 205 deny all from 169.254.0.0/16 to any in via $LanOut
$cmd 206 deny all from 192.0.2.0/24 to any in via $LanOut
$cmd 207 deny all from 204.152.64.0/23 to any in via $LanOut
$cmd 208 deny all from 224.0.0.0/3 to any in via $LanOut

# Deny ident
$cmd 209 deny tcp from any to any 113 in via $LanOut

#Netbios
$cmd 210 deny tcp from any to any 137 via $LanOut
$cmd 211 deny tcp from any to any 138 via $LanOut
$cmd 212 deny tcp from any to any 139 via $LanOut
$cmd 213 deny tcp from any to any 81 via $LanOut

# Deny fragments packets
$cmd 214 deny all from any to any frag in via $LanOut

# Deny ACK packets that did not match the dynamic rule table
$cmd 215 deny tcp from any to any established in via $LanOut

#Isolated Network
$cmd 216 allow all from 192.168.185.0/24 to 192.168.180.1
$cmd 217 allow all from 192.168.190.0/24 to 192.168.180.1
$cmd 218 deny all from 192.168.185.0/24 to 192.168.180.0/23
$cmd 219 deny all from 192.168.180.0/23 to 192.168.185.0/24
$cmd 220 deny all from 192.168.190.0/24 to 192.168.180.0/23
$cmd 221 deny all from 192.168.180.0/24 to 192.168.190.0/24

# Allow in ssh from Internet
$cmd 300 allow tcp from xxx.xxx.xxx.xxx to me 22 in via $LanOut setup limit src-addr 1

# Reject incomming traffic from Inet
$cmd 400 deny log all from any to any in via $LanOut

# Reject outgoing traffic to Inet
$cmd 410 deny log logamount 50 all from any to any out via $LanOut

$cmd 999 deny log all from any to any#!/bin/sh
ipfw -f flush
ipfw -f pipe flush
ipfw -f queue flush

cmd="/sbin/ipfw add"
FWCMD="/sbin/ipfw -q"

LanOut="igb1" # Внешняя сетевуха
NetOut="xxx.xxx.xxx.xxx/30" # внешняя сеть
IpOut="xxx.xxx.xxx.xxx" # Внешний IP

LanIn="igb0" # внутренняя сетевуха
NetIn="192.168.180.0/23" # Внутренняя сеть
ip_lan="192.168" # Шаблон внутреннего адреса

LanGuest="vlan10" # VLAN для гостевой WI-FI сети
NetGuest="192.168.185.0/24" #VLAN сеть для гостевой WI-FI сети

LanSmart="vlan20" # VLAN для Smart WI-FI сети
NetSmart="192.168.190.0/24" #VLAN сеть для Smart

openvpn_if="tun0"       #OpenVPN port
IpVPN="192.168.225.0"


ipfw pipe 1 config bw 1000Kbit/s mask dst-ip 0x000000ff
ipfw pipe 2 config bw 1000Kbit/s mask src-ip 0x000000ff

ipfw add 041 pipe 1 ip from any to 192.168.180.0/23 in
ipfw add 042 pipe 2 ip from 192.168.180.0/23 to any out

#NAT
ipfw nat 1 config if igb1 log same_ports


#local
$cmd 005 allow all from any to any via $LanIn
#VPN
$cmd 006 allow all from any to any via tun0
#local Guest Network
$cmd 007 allow all from any to any via $LanGuest
#GIF
$cmd 008 allow ip from any to any via gif0
#local Smart Network
$cmd 009 allow all from any to any via $LanSmart
# loopback
$cmd 010 allow all from any to any via lo0

#Incoming traffic to NAT
$cmd 030 nat 1 ip from any to any in via $LanOut

#NAT from AS to Inet
$cmd 033 nat 1 ip from $NetIn to any out via $LanOut

#NAT from Guest to Inet
$cmd 035 nat 1 ip from $NetGuest to any out via $LanOut

#NAT from Smart to Inet
$cmd 038 nat 1 ip from $NetSmart to any out via $LanOut

#Allow DYN rules
$cmd 040 check-state

# DNS resolve
$cmd 052 allow ip from any 53 to any via $LanOut
$cmd 053 allow ip from any to any 53 via $LanOut

# Outgoing server to Internet
$cmd 060 allow ip from me to any out via $LanOut setup keep-state

#IPSEC VPN Smart
$cmd 061 allow udp from xxx.xxx.xxx.xxx to me isakmp
$cmd 062 allow udp from me to xxx.xxx.xxx.xxx isakmp
$cmd 063 allow esp from xxx.xxx.xxx.xxx to me
$cmd 064 allow esp from me to xxx.xxx.xxx.xxx
$cmd 065 allow ipencap from xxx.xxx.xxx.xxx to me
$cmd 066 allow ipencap from me to xxx.xxx.xxx.xxx

# ICMP
$cmd 100 allow icmp from any to any out via $LanOut keep-state

# OpenVPN
$cmd 101 allow tcp from xxx.xxx.xxx.xxx to me 2000 in via ${LanOut}
$cmd 102 allow tcp from me 2000 to xxx.xxx.xxx.xxx out via ${LanOut}
$cmd 103 allow all from any to any in via ${openvpn_if}
$cmd 104 allow all from any to any out via ${openvpn_if}

# Time
$cmd 120 allow udp from any to any 123 out via $LanOut keep-state

#WI-FI Guest
$cmd 123 allow ip from $NetGuest to any 80,443,21 out via $LanOut setup keep-state

#SIP
$cmd 131 allow ip from 193.201.230.128/26 to '192.168.180.0{31-89}' in via ${LanOut}
$cmd 132 allow ip from '192.168.180.0{31-89}' to 193.201.230.128/26 out via ${LanOut}

#NAT
$cmd 141 allow ip from '192.168.180.0{11-29}' to any out via $LanOut setup keep-state
#TV
$cmd 143 allow ip from '192.168.180.0{95-97}' to any out via $LanOut setup keep-state

#Разрешаем определенный ICMP-трафик из мира к нам
$cmd 161 allow icmp from any to me in via $LanOut icmptype 3,8,12
#Разрешаем определенный ICMP-трафик от нас в мир
$cmd 162 allow icmp from me to any out via $LanOut icmptype 0,3,4,11,12
#Запрещаем прочий ICMP-трафик
$cmd 163 deny log icmp from any to me in via $LanOut icmptype 5,9,10,13,15,17

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 200 deny all from 192.168.0.0/16 to any in via $LanOut
$cmd 201 deny all from 172.16.0.0/12 to any in via $LanOut
$cmd 202 deny all from 10.0.0.0/8 to any in via $LanOut
$cmd 203 deny all from 127.0.0.0/8 to any in via $LanOut
$cmd 204 deny all from 0.0.0.0/8 to any in via $LanOut
$cmd 205 deny all from 169.254.0.0/16 to any in via $LanOut
$cmd 206 deny all from 192.0.2.0/24 to any in via $LanOut
$cmd 207 deny all from 204.152.64.0/23 to any in via $LanOut
$cmd 208 deny all from 224.0.0.0/3 to any in via $LanOut

# Deny ident
$cmd 209 deny tcp from any to any 113 in via $LanOut

#Netbios
$cmd 210 deny tcp from any to any 137 via $LanOut
$cmd 211 deny tcp from any to any 138 via $LanOut
$cmd 212 deny tcp from any to any 139 via $LanOut
$cmd 213 deny tcp from any to any 81 via $LanOut

# Deny fragments packets
$cmd 214 deny all from any to any frag in via $LanOut

# Deny ACK packets that did not match the dynamic rule table
$cmd 215 deny tcp from any to any established in via $LanOut

#Isolated Network
$cmd 216 allow all from 192.168.185.0/24 to 192.168.180.1
$cmd 217 allow all from 192.168.190.0/24 to 192.168.180.1
$cmd 218 deny all from 192.168.185.0/24 to 192.168.180.0/23
$cmd 219 deny all from 192.168.180.0/23 to 192.168.185.0/24
$cmd 220 deny all from 192.168.190.0/24 to 192.168.180.0/23
$cmd 221 deny all from 192.168.180.0/24 to 192.168.190.0/24

# Allow in ssh from Internet
$cmd 300 allow tcp from xxx.xxx.xxx.xxx to me 22 in via $LanOut setup limit src-addr 1

# Reject incomming traffic from Inet
$cmd 400 deny log all from any to any in via $LanOut

# Reject outgoing traffic to Inet
$cmd 410 deny log logamount 50 all from any to any out via $LanOut

$cmd 999 deny log all from any to any

Хочу настроить шейпер.
Но как только я добавляю параметр net.inet.ip.fw.one_pass=0 в /etc/sysctl.conf, так сразу перестают ходить пакеты в локальную сеть.
Подскажите, как правильно организовать шейпинг?

 

Ваше сообщение
Имя*:
EMail:
Для отправки новых сообщений в текущей нити на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email).
Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:
 
При общении не допускается: неуважительное отношение к собеседнику, хамство, унизительное обращение, ненормативная лексика, переход на личности, агрессивное поведение, обесценивание собеседника, провоцирование флейма голословными и заведомо ложными заявлениями. Не отвечайте на сообщения, явно нарушающие правила - удаляются не только сами нарушения, но и все ответы на них. Лог модерирования.



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей 		Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру