ФІО = FreeBSD PF 2 канала

 Запитання:http://habrahabr.ru/post/66851/

====================================


 ANSWER ====================================

http://www.ussr.kiev.ua/ru/PF_Squid


 END of ANSWER ====================================



 ANSWER ====================================

http://habrahabr.ru/post/124447/


 END of ANSWER ====================================



 ANSWER ====================================

https://forums.freebsd.org/threads/ipfw-one-isp-two-xdsl-internet-channels-load-balancing.36205/


 END of ANSWER ====================================



 ANSWER ====================================

http://wiki.mesouug.com/index.php/FreeBSD_/_One_ISP_/_Two_and_more_xDSL/internet_channels_/_Load_balancing


 END of ANSWER ====================================



 ANSWER ====================================

#!/bin/sh

DELAY=`/usr/bin/jot -r 1 0 9`

# Delay
echo "${DELAY} seconds delay..."
sleep ${DELAY} 

PIDS=`pgrep -f "/bin/sh /etc/firewall" | wc -l`

#Check if copy of process is already running:
if [ ${PIDS} -gt 1 ]; then
  echo "Another copy is already running."
  exit 1
fi

#Flush out list before we begin.
ipfw -q -f flush
ipfw -q -f nat flush
ipfw -q pipe flush
ipfw -q queue flush

################################################################################

#Set rules command prefix
cmd="ipfw -q"

pif0="adsl1"
pif0ip=`ifconfig $pif0 inet | grep inet | awk '{print $2}'`
pif0gw=`ifconfig $pif0 inet | grep inet | awk '{print $4}'`

pif1="adsl2"
pif1ip=`ifconfig $pif1 inet | grep inet | awk '{print $2}'`
pif1gw=`ifconfig $pif1 inet | grep inet | awk '{print $4}'`

pif2="vlan200"
pif2ip="10.61.168.231"
pif2gw="10.61.168.1"


if [ ! -z "$pif0ip" ]; then
  pif0status="UP"
  else
    pif0status="DOWN"
fi

if [ ! -z "$pif1ip" ]; then
  pif1status="UP"
  else
    pif1status="DOWN"
fi

if [ -f /vlan200.status ]; then
  pif2status=`cat /vlan200.status`
else
  pif2status="DOWN"
fi

# Override
#pif0status="DOWN"
#pif1status="DOWN"
#pif2status="DOWN"

################################################################################

$cmd add 100 allow ip from any to any via lo0
$cmd add     deny ip from any to 127.0.0.0/8
$cmd add     deny ip from 127.0.0.0/8 to any

$cmd add 1100 skipto 2040 ip from any to any out xmit $lif tagged 101 keep-state
$cmd add      skipto 2080 ip from any to any out xmit $lif tagged 102 keep-state
$cmd add      skipto 2100 ip from any to any out xmit $lif tagged 120 keep-state

$cmd add 1500 deny gre from 192.168.1.XXX to any // This rule will drop first GRE packet from PPTP SERVER when VPN initiates 

# Next few IF's will keep firewall rules consistent in cases if ISP connections will go down

if [ $pif0status == "UP" ] && [ $pif1status == "UP" ]; then 
  $cmd add 2000 skipto 2040 ip from table\(101\) to any in recv $lif // Smart Load balancing using arpalert 
  $cmd add      skipto 2080 ip from table\(102\) to any in recv $lif // Smart Load balancing using arpalert 
fi

if [ $pif2status == "UP" ]; then
  $cmd add      skipto 2100 ip from table\(120\) to any in recv $lif // Smart Load balancing using arpalert 
fi

if [ $pif0status == "UP" ]; then
  $cmd add 2040 setfib 0 ip from any to any via $lif keep-state
  $cmd add 2050 allow tag 101 ip from any to any via $lif
fi

if [ $pif1status == "UP" ]; then
  $cmd add 2080 setfib 1 ip from any to any via $lif keep-state
  $cmd add 2090 allow tag 102 ip from any to any via $lif
fi

if [ $pif2status == "UP" ]; then
  $cmd add 2100 setfib 2 ip from any to any via $lif keep-state
  $cmd add 2110 allow tag 120 ip from any to any via $lif
fi

################################################################################

$cmd add 3050 deny ip from any to 192.168.0.0/16 in recv $pifs
$cmd add      deny ip from 192.168.0.0/16 to any in recv $pifs
$cmd add      deny ip from any to 172.16.0.0/12 in recv $pifs
$cmd add      deny ip from 172.16.0.0/12 to any in recv $pifs
$cmd add      deny ip from any to 10.0.0.0/8 in recv $pifs
$cmd add      deny ip from 10.0.0.0/8 to any in recv $pifs
$cmd add      deny ip from any to 169.254.0.0/16 in recv $pifs
$cmd add      deny ip from 169.254.0.0/16 to any in recv $pifs

################################################################################

if [ $pif1status == "UP" ]; then
  $cmd add 11000 fwd $pif1gw all from $pif1ip to any via $pif0 // Send reply to necessary interface
fi

if [ $pif2status == "UP" ]; then
  $cmd add 11100 fwd $pif2gw all from $pif2ip to any via $pif0 // Send reply to necessary interface
fi

################################################################################

$cmd add 13000 skipto 31000 log ip from any to $pif0ip 22 in recv $pif0 // sshd
$cmd add       skipto 31000 log ip from any to $pif1ip 22 in recv $pif1 // sshd
$cmd add       skipto 31000 log ip from any to $pif2ip 22 in recv $pif2 // sshd
$cmd add       skipto 31000 log ip from any to $pif0ip 1723 in recv $pif0 // PPTP server
$cmd add       skipto 31000 log ip from any to $pif1ip 1723 in recv $pif1 // PPTP server
$cmd add       skipto 31000 log ip from any to $pif2ip 1723 in recv $pif2 // PPTP server
$cmd add       skipto 31000 gre from any to $pif0ip in recv $pif0 // PPTP server
$cmd add       skipto 31000 gre from any to $pif1ip in recv $pif1 // PPTP server
$cmd add       skipto 31000 gre from any to $pif2ip in recv $pif2 // PPTP server

################################################################################

if [ $pif0status == "UP" ]; then
  $cmd add 20000 deny log ip from any to any in via $pif0 setup // Reject and Log all setup of incoming connections from the outside 
  $cmd add       deny log ip from any to any in via $pif1 setup // Reject and Log all setup of incoming connections from the outside 
  $cmd add       deny log ip from any to any in via $pif2 setup // Reject and Log all setup of incoming connections from the outside 
fi

################################################################################

if [ $pif0status == "UP" ]; then
  $cmd nat 101 config if $pif0 same_ports reset \
			redirect_port tcp 192.168.1.XXX:1723 $pif0ip:1723 \
                        redirect_proto gre 192.168.1.XXX $pif0ip
fi

if [ $pif1status == "UP" ]; then
  $cmd nat 102 config if $pif1 same_ports reset \
			redirect_port tcp 192.168.1.XXX:1723 $pif1ip:1723 \
                        redirect_proto gre 192.168.1.XXX $pif1ip
fi

if [ $pif2status == "UP" ]; then
  $cmd nat 120 config if $pif2 same_ports reset \
			redirect_port tcp 192.168.1.XXX:1723 $pif2ip:1723 \
                        redirect_proto gre 192.168.1.XXX $pif2ip
fi

################################################################################

# NAT
if [ $pif0status == "UP" ]; then

  $cmd add 31000 nat 101 ip from any to any via $pif0 // $pif0 nat
  $cmd add       skipto 35000 tag 101 ip from any to any in recv $pif0
fi

if [ $pif1status == "UP" ]; then
  $cmd add 31500 nat 102 ip from any to any via $pif1 // $pif1 nat
  $cmd add       skipto 35000 tag 102 ip from any to any in recv $pif1
fi

if [ $pif2status == "UP" ]; then
  $cmd add 32500 nat 120 ip from any to any via $pif2 // $pif2 nat 
  $cmd add       skipto 35000 tag 120 ip from any to any in recv $pif2
fi


################################################################################

$cmd add 35000 allow tcp from any to any established // Allow TCP through if setup succeeded

$cmd add 50000 allow all from any to any
$cmd add 65534 deny all from any to any

################################################################################

exit 0


 END of ANSWER ====================================



 ANSWER ====================================

http://skeletor.org.ua/?p=1279


 END of ANSWER ====================================



 ANSWER ====================================

http://birdofluck.livejournal.com/8778.html


 END of ANSWER ====================================



 ANSWER ====================================

Well, let's suppose that your ISP interfaces have respectively $ispN_ip and 
$ispN_router as interface IP and ISP router IP. And that $natN is the divert 
port corresponding to the NAT for the given ISP. Then you get something like 

# This treats incoming trafic 
ipfw add 1310 divert $nat1 ip from any to any in via $if1 
ipfw add 1320 divert $nat2 ip from any to any in via $if2 
... 
ipfw add 13N0 divert $natN ip from any to any in via $ifN 

# Check states 
ipfw add 3000 check-state 

# Load balance outgoing trafic 
# Note: change 1/N, 1/(N-1), etc by actual values for your N 
ipfw add 10100 prob 1/N skipto 20100 ip from $internal to any keep-state 
ipfw add 10200 prob 1/(N-1) skipto 20200 ip from $internal to any keep-state 
... 
ipfw add 10N00 skipto 20N00 ip from $internal to any keep-state 

# Do outgoing NAT 
ipfw add 20100 divert $nat1 from $internal to any out 
ipfw add 20110 fwd $isp1_router ip from $isp1_ip 
ipfw add 20200 divert $nat2 from $internal to any out 
ipfw add 20210 fwd $isp2_router ip from $isp2_ip 
... 
ipfw add 20N00 divert $natN from $internal to any out 
ipfw add 20N10 fwd $ispN_router ip from $ispN_ip 


And here is what the natd.conf would look like 

### ISP 1 ### 
port 8868 
dynamic yes 
interface re1 

### ISP 2 ### 
instance dsl2 
port 8869 
dynamic yes 
interface re2 

### ISP N ### 
instance dsl3 
port 8870 
dynamic yes 
interface re 


 END of ANSWER ====================================



 ANSWER ====================================

http://www.linux.org.ru/forum/admin/10011112


 END of ANSWER ====================================



 ANSWER ====================================

#!/bin/sh -
fwcmd="/sbin/ipfw -q"

ips1="em0"
ips2="em1"

${fwcmd} -f flush

# allow ssh on all interface
${fwcmd} add allow tcp from any to me 2211 in via ${ips1}
${fwcmd} add allow tcp from any to me 2211 in via ${ips2}

# network address translation
${fwcmd} add fwd 195.111.111.111 ip from 195.151.111.112 to any
${fwcmd} add fwd 62.117.222.222 ip from 62.117.222.223 to any

${fwcmd} nat 1 config if ${ips1} reset deny_in same_ports unreg_only redirect_port tcp 192.168.ххх.ххх:2900 2900

${fwcmd} nat 2 config if ${ips2} reset deny_in same_ports unreg_only redirect_port tcp 192.168.ххх.ххх:2900 2900

${fwcmd} add nat 1 all from any to any
${fwcmd} add nat 2 all from any to any

# Deny all
${fwcmd} add deny all from any to any


 END of ANSWER ====================================



 ANSWER ====================================

http://www.lissyara.su/articles/freebsd/tuning/ipfw_nat/


 END of ANSWER ====================================



 ANSWER ====================================

${FwCMD} add nat 100 all from ${User1} to any out via ${LanOut1}
${FwCMD} add nat 100 all from any to ${IpOut} in via ${LanOut1}
${FwCMD} add nat 200 all from ${User2} to any out via ${LanOut2}
${FwCMD} add nat 200 all from any to ${IpOut} in via ${LanOut2}


 END of ANSWER ====================================



 ANSWER ====================================

http://www.hilik.org.ua/freebsd-организовываем-резервный-канал/


 END of ANSWER ====================================



 ANSWER ====================================

http://technotrance.su/index.php/moi-zametki/24-autoswitching-internet


 END of ANSWER ====================================



 ANSWER ====================================

http://habrahabr.ru/post/66851/


 END of ANSWER ====================================



 ANSWER ====================================

Проблему перенаправлением порта 3389 решил.
в etc/natd.conf написано - 
port 8668
redirect_port tcp 192.168.10.1:3389 212.119.109.58:3389
redirect_port tcp 192.168.10.5:110 212.119.109.58:110

firewall.conf -

fwcmd="/sbin/ipfw -q"
lanout="fxp0"
lanin="fxp1"
ipout="212.212.212.121"
ipin="192.168.10.254"
netmask="24"
netin="192.168.10.0"
${fwcmd} -f flush
${fwcmd} add check-state
${fwcmd} add allow ip from any to any via lo0
${fwcmd} add divert 8668 tcp from any to 212.212.212.121 3389 via fxp0
${fwcmd} add divert 8668 tcp from 192.168.10.1 3389 to any via fxp0
${fwcmd} add allow tcp from any to 192.168.10.1 3389 via any
${fwcmd} add divert 8668 tcp from any to 212.212.212.121 110 via fxp0
${fwcmd} add divert 8668 tcp from 192.168.10.5 110 to any via fxp0
${fwcmd} add allow tcp from any to 192.168.10.5 110 via any
${fwcmd} add divert natd ip from ${netin}/${netmask} to any out via ${lanout}
${fwcmd} add divert natd ip from any to ${ipout} in via ${lanout}
${fwcmd} add allow tcp from any to any established
${fwcmd} add allow ip from ${ipout} to any out xmit ${lanout}
${fwcmd} add allow udp from any 53 to any via ${lanout}
${fwcmd} add allow tcp from any to ${ipout} 49152-65535 via ${lanout}
${fwcmd} add allow icmp from any to any icmptypes 0,8,11
${fwcmd} add allow tcp from any to ${ipout} 25 via ${lanout}
${fwcmd} add allow tcp from any to ${ipout} 110 via ${lanout}
${fwcmd} add allow tcp from any to any via ${lanin}
${fwcmd} add allow udp from any to any via ${lanin}
${fwcmd} add allow icmp from any to any via ${lanin}
${fwcmd} add deny log tcp from any to any

В таком виде редирект порта 3389 работает, а вот почта так и не перенаправляется на 192.168.10.5


 END of ANSWER ====================================



 ANSWER ====================================

http://forum.lissyara.su/viewtopic.php?f=8&t=19448


 END of ANSWER ====================================



 ANSWER ====================================

http://www.opennet.ru/base/net/2link_balance2.txt.html


 END of ANSWER ====================================



 ANSWER ====================================

http://sysadmins.ru/topic320039.html


 END of ANSWER ====================================