> Причём
>> 'allow ip from me to any out via igb1'
> 1 раз для 33, 35 и 38, а за "nat 1 ip
> from any to any in via igb1", наверное тогда не "allow
> ip from any to any in via igb1", конечно, а три
> правила:
> allow ip from any to 192.168.180.0/23 in via igb1
> allow ip from any to 192.168.185.0/24 in via igb1
> allow ip from any to 192.168.190.0/24 in via igb1 Спасибо за правильные мысли.
Оказывается весь косяк был во входящих правилах. Если стояло keep-state, то пакеты не ходили.
Сейчас привел IPFW к такому виду, и все прекрасно работает.
#!/bin/sh
ipfw -f flush
ipfw -f pipe flush
ipfw -f queue flush
cmd="/sbin/ipfw add"
FWCMD="/sbin/ipfw -q"
LanOut="igb1" # External Ethernet
IpOut="xxx.xxx.xxx.xxx" # External IP
LanIn="igb0" # Internal Ethernet
NetIn="192.168.180.0/23" # Internal Lan
LanGuest="vlan10" # VLAN guest WI-FI
NetGuest="192.168.185.0/24" #VLAN network for WI-FI guest
LanSmart="vlan20" # VLAN Smart
NetSmart="192.168.190.0/24" #VLAN network fow Smart
openvpn_if="tun0" #OpenVPN port
IpVPN="192.168.225.0"
VIP="192.168.180.0{11-29}"
SIP="192.168.180.0/24{31-89}"
NetLocal="192.168.181.1/24{1-254}"
#Pipe 1 - SIP Phone out - 4Mbit/s
#Pipe 2 - SIP Phone in - 4Mbit/s
ipfw pipe 1 config bw 4Mbit/s
ipfw queue 1 config pipe 1 weight 50 queue 20 mask dst-ip 0x00000000
ipfw pipe 2 config bw 4Mbit/s
ipfw queue 2 config pipe 2 weight 50 queue 20 mask src-ip 0x00000000
$cmd 010 queue 1 ip from any to $SIP out
$cmd 020 queue 2 ip from $SIP to any in
$cmd 021 queue 2 ip from any to $SIP in via $LanOut
$cmd 022 queue 2 ip from 193.201.230.128/26 to me 5060,11024 in via $LanOut
$cmd 011 queue 1 ip from me 5060,11024 to any out via $LanOut
$cmd 012 queue 1 ip from me to 193.201.230.128/26 out via $LanOut
#Pipe 3 - Guest WI-FI out - 4Mbit/s
#Pipe 4 - Guest WI-FI in - 4Mbit/s
ipfw pipe 3 config bw 4Mbit/s
ipfw queue 3 config pipe 3 weight 50 queue 20 mask src-ip 0x00000000
ipfw pipe 4 config bw 4Mbit/s
ipfw queue 4 config pipe 4 weight 50 queue 20 mask src-ip 0x00000000
$cmd 030 queue 3 ip from any to $NetGuest out
$cmd 040 queue 4 ip from $NetGuest to any in
#Pipe 5 - Network Local out - 6Mbit/s
#Pipe 6 - Network Local in - 6Mbit/s
ipfw pipe 5 config bw 6Mbit/s
ipfw queue 5 config pipe 5 weight 50 queue 20 mask dst-ip 0x00000000
ipfw pipe 6 config bw 6Mbit/s
ipfw queue 6 config pipe 6 weight 50 queue 20 mask src-ip 0x00000000
$cmd 050 queue 5 ip from any to $NetLocal out
$cmd 060 queue 6 ip from $NetLocal to any in
#Pipe 7 - Network Smart out - 5Mbit/s
#Pipe 8 - Network Smart in - 5Mbit/s
ipfw pipe 7 config bw 5Mbit/s
ipfw queue 7 config pipe 7 weight 50 queue 20 mask dst-ip 0x00000000
ipfw pipe 8 config bw 5Mbit/s
ipfw queue 8 config pipe 8 weight 50 queue 20 mask src-ip 0x00000000
$cmd 070 queue 7 ip from any to $NetSmart out
$cmd 080 queue 8 ip from $NetSmart to any in
#NAT
ipfw nat 1 config if igb1 log same_ports
#local
$cmd 105 allow all from any to any via $LanIn
#VPN
$cmd 106 allow all from any to any via tun0
#local Guest Network
$cmd 107 allow all from any to any via $LanGuest
#GIF
$cmd 108 allow ip from any to any via gif0
#local Smart Network
$cmd 109 allow all from any to any via $LanSmart
# loopback
$cmd 110 allow all from any to any via lo0
#Incoming traffic to NAT
$cmd 130 nat 1 ip from any to any in via $LanOut
#NAT from ASG to Inet
$cmd 133 nat 1 ip from $NetIn to any out via $LanOut
#NAT from Guest to Inet
$cmd 135 nat 1 ip from $NetGuest to any out via $LanOut
#NAT from Smart to Inet
$cmd 138 nat 1 ip from $NetSmart to any out via $LanOut
#Allow DYN rules
$cmd 140 check-state
# DNS resolve
#$cmd 052 allow ip from any 53 to me via $LanOut
#$cmd 053 allow ip from me to any 53 via $LanOut
$cmd 172 allow ip from any 53 to any via $LanOut
$cmd 173 allow ip from any to any 53 via $LanOut
# Outgoing server to Internet
$cmd 180 allow ip from me to any out via $LanOut setup keep-state
#IPSEC VPN Smart
$cmd 191 allow udp from xxx.xxx.xxx.xxx to me isakmp
$cmd 192 allow udp from me to xxx.xxx.xxx.xxx isakmp
$cmd 193 allow esp from xxx.xxx.xxx.xxx to me
$cmd 194 allow esp from me to xxx.xxx.xxx.xxx
$cmd 195 allow ipencap from xxx.xxx.xxx.xxx to me
$cmd 196 allow ipencap from me to xxx.xxx.xxx.xxx
# ICMP
$cmd 200 allow icmp from any to any out via $LanOut keep-state
# OpenVPN
$cmd 201 allow tcp from xxx.xxx.xxx.xxx to me 2000 in via ${LanOut}
$cmd 202 allow tcp from me 2000 to xxx.xxx.xxx.xxx out via ${LanOut}
$cmd 203 allow all from any to any in via ${openvpn_if}
$cmd 204 allow all from any to any out via ${openvpn_if}
# Time
$cmd 210 allow udp from any to any 123 out via $LanOut keep-state
#WI-FI Guest
$cmd 221 allow ip from $NetGuest to any out via $LanOut setup keep-state
$cmd 222 allow ip from any to $NetGuest in via $LanOut
#SIP
$cmd 231 allow ip from any to $SIP in via $LanOut
$cmd 232 allow ip from 193.201.230.128/26 to me 5060,11024 in via $LanOut
$cmd 233 allow ip from me 5060,11024 to any out via $LanOut
$cmd 234 allow ip from me to 193.201.230.128/26 out via $LanOut
#NAT
$cmd 241 allow ip from '192.168.180.0{11-29}' to any out via $LanOut setup keep-state
$cmd 242 allow ip from any to '192.168.180.0{11-29}' in via $LanOut
#TV
$cmd 243 allow ip from '192.168.180.0{95-97}' to any out via $LanOut setup keep-state
$cmd 244 allow ip from any to '192.168.180.0{95-97}' in via $LanOut
#Smart
$cmd 251 allow ip from $NetSmart to any out via $LanOut setup keep-state
$cmd 252 allow ip from any to $NetSmart in via $LanOut
#Разрешаем определенный ICMP-трафик из мира к нам
$cmd 261 allow icmp from any to me in via $LanOut icmptype 3,8,12
#Разрешаем определенный ICMP-трафик от нас в мир
$cmd 262 allow icmp from me to any out via $LanOut icmptype 0,3,4,11,12
#Запрещаем прочий ICMP-трафик
$cmd 263 deny log icmp from any to me in via $LanOut icmptype 5,9,10,13,15,17
# Deny all inbound traffic from non-routable reserved address spaces
$cmd 300 deny all from 192.168.0.0/16 to any in via $LanOut
$cmd 301 deny all from 172.16.0.0/12 to any in via $LanOut
$cmd 302 deny all from 10.0.0.0/8 to any in via $LanOut
$cmd 303 deny all from 127.0.0.0/8 to any in via $LanOut
$cmd 304 deny all from 0.0.0.0/8 to any in via $LanOut
$cmd 305 deny all from 169.254.0.0/16 to any in via $LanOut
$cmd 306 deny all from 192.0.2.0/24 to any in via $LanOut
$cmd 307 deny all from 204.152.64.0/23 to any in via $LanOut
$cmd 308 deny all from 224.0.0.0/3 to any in via $LanOut
# Deny ident
$cmd 309 deny tcp from any to any 113 in via $LanOut
#Netbios
$cmd 310 deny tcp from any to any 137 via $LanOut
$cmd 311 deny tcp from any to any 138 via $LanOut
$cmd 312 deny tcp from any to any 139 via $LanOut
$cmd 313 deny tcp from any to any 81 via $LanOut
# Deny fragments packets
$cmd 314 deny all from any to any frag in via $LanOut
# Deny ACK packets that did not match the dynamic rule table
$cmd 315 deny log tcp from any to any established in via $LanOut
#Изолируем подсети друг от друга
$cmd 351 allow all from 192.168.185.0/24 to 192.168.180.1/32
$cmd 352 allow all from 192.168.190.0/24 to 192.168.180.1/32
$cmd 353 deny all from 192.168.185.0/24 to 192.168.180.0/23
$cmd 354 deny all from 192.168.180.0/23 to 192.168.185.0/24
$cmd 355 deny all from 192.168.190.0/24 to 192.168.180.0/23
$cmd 356 deny all from 192.168.180.0/24 to 192.168.190.0/24
# Allow in ssh from Internet
$cmd 400 allow tcp from xxx.xxx.xxx.xxx to me 22 in via $LanOut setup limit src-addr 1
# Reject incomming traffic from Inet
$cmd 500 deny log all from any to any in via $LanOut
# Reject outgoing traffic to Inet
$cmd 510 deny log logamount 50 all from any to any out via $LanOut
$cmd 999 deny log all from any to any
Единственный вопрос, можно ли назначать в каждой трубе очередь начиная с первой, т.е. ipfw queue 1 config pipe 3, или же очередь в трубе должна начинаться со следующего номера, ipfw queue 3 config pipe 3?
