Тема: FreeBSD + PacketFilter - балансировка нагрузки
Возникла необходимость раскидать пользователей локальной сети на два канала - КТБ и Днепронет. Синтаксис FreeBSD PF немного отличается от OpenBSD PF. Получилось такое:
ext_if1="ng0"
ext_if2="ng1"
gw_1=$ext_if1:peer
gw_2=$ext_if2:peer
int_if="fxp0"
int_net="192.168.1.0/24"
cs_addr="192.168.1.16" # Сервер CounterStrike у Родиона
table <blacklist> persist
table <mailservers> {178.219.93.206, 178.219.93.18} persist
table <dnepronet> {192.168.1.2 192.168.1.12 192.168.1.11 192.168.1.13 192.168.1.15 192.168.1.16} persist
table <ktb> {192.168.1.10, 192.168.1.17, 192.168.1.18, 192.168.1.20, 192.168.1.50, 192.168.1.51, 192.168.1.52} persist
#############################################################################################
set skip on lo
# Распределение трафика на клиентов
altq on $int_if cbq bandwidth 100Mb queue {q2, q11, q12, q13, q15, q16, q17, q18, q20, q50, q51, q52}
queue q2 bandwidth 1Mb priority 1 cbq (default borrow) # FILESERVER
queue q11 bandwidth 2Mb priority 7 # Чеченина
queue q12 bandwidth 2Mb priority 3 cbq (borrow) # Мама
queue q13 bandwidth 6Mb priority 6 # Марина
queue q15 bandwidth 2Mb priority 7 # Вершинин
queue q16 bandwidth 2Mb priority 7 # Родеон
queue q17 bandwidth 8Mb priority 7 # Вова
queue q18 bandwidth 16Mb priority 7 # Серый
queue q20 bandwidth 8Mb priority 7 # AK-47
queue q50 bandwidth 4Mb priority 7 # Fenomen
queue q51 bandwidth 4Mb priority 7 # Alex-nikl
queue q52 bandwidth 4Mb priority 7 # Sergej
nat on $ext_if1 from $int_net to !$int_net -> ($ext_if1)
nat on $ext_if2 from $int_net to !$int_net -> ($ext_if2)
# Редирект радмина на FILESERVER и DARKSTAR
rdr on $ext_if1 proto tcp from any to ($ext_if1) port XXXX -> 192.168.1.2 port 4899
rdr on $ext_if1 proto tcp from any to ($ext_if1) port XXXX -> 192.168.1.12 port 4899
rdr on $ext_if1 proto udp from any to ($ext_if1) port 27005 -> $cs_addr port 27005
rdr on $ext_if1 proto udp from any to ($ext_if1) port 27016 -> $cs_addr port 27016
rdr on $ext_if1 proto tcp from any to ($ext_if1) port XXXX -> 192.168.1.100 port 80
# Падлюки всякие
block in from any to any
block drop in quick on $ext_if1 from <blacklist> to any
block drop in quick on $ext_if2 from <blacklist> to any
block in on $int_if proto udp from any to any port 25
pass in on $int_if from $int_net to <mailservers>
pass in quick on $int_if from 192.168.0.0/16 to 192.168.1.1
pass out quick on $int_if from 192.168.1.1 to 192.168.0.0/16
# Исходящий трафик от клиентов
pass in quick on $int_if route-to ($ext_if1 $gw_1) from <dnepronet> to any
pass in quick on $int_if route-to ($ext_if2 $gw_2) from <ktb> to any
# Входящий трафик к клиентам
pass out quick on $int_if from any to 192.168.1.2 queue q2
pass out quick on $int_if from any to 192.168.1.10 queue q10
pass out quick on $int_if from any to 192.168.1.11 queue q11
pass out quick on $int_if from any to 192.168.1.12 queue q12
pass out quick on $int_if from any to 192.168.1.13 queue q13
pass out quick on $int_if from any to 192.168.1.14 queue q14
pass out quick on $int_if from any to 192.168.1.15 queue q15
pass out quick on $int_if from any to 192.168.1.16 queue q16
pass out quick on $int_if from any to 192.168.1.17 queue q17
pass out quick on $int_if from any to 192.168.1.18 queue q18
pass out quick on $int_if from any to 192.168.1.19 queue q19
pass out quick on $int_if from any to 192.168.1.20 queue q20
pass out quick on $int_if from any to 192.168.1.50 queue q50
pass out quick on $int_if from any to 192.168.1.51 queue q51
pass out quick on $int_if from any to 192.168.1.52 queue q52
# Наружный трафик
# access point web interface
pass in quick on $ext_if1 proto tcp from any to 192.168.1.100 port 80
pass in quick on $int_if from 192.168.1.100 to any
pass out quick on $int_if from any to 192.168.1.100
# Редирект портов
pass in quick on $ext_if1 proto tcp from any to 192.168.1.2 port 4899
pass in quick on $ext_if1 proto tcp from any to 192.168.1.12 port 4899
pass in quick on $ext_if1 proto udp from any to $cs_addr port 27005:27016
# Dnepronet
pass in quick on $ext_if1 reply-to ($ext_if1 $gw_1) from any to ($ext_if1)
pass out quick route-to ($ext_if1 $gw_1) from ($ext_if1) to any
# Ktb
pass in quick on $ext_if2 reply-to ($ext_if2 $gw_2) from any to ($ext_if2)
pass out quick route-to ($ext_if2 $gw_2) from ($ext_if2) to any
# Чтоб пакеты с айпишником днепронета на падали в канал ктб и наоборот :)
pass out on $ext_if1 route-to ($ext_if2 $gw_2) from ($ext_if2) to any
pass out on $ext_if2 route-to ($ext_if1 $gw_1) from ($ext_if1) to anyМир, труд, май - модем, линукс, пиво
OS: FreeBSD 6.4 --> FreeBSD 7.4 --> FreeBSD 8.4
OS: FreeBSD 6.4 --> FreeBSD 7.4 --> FreeBSD 8.4