U nas takaya-je problema. Toje ADSL ot Telecoma, toje 3 usera.
Postavil gateway na FreeBSD 4.10 i v meru nalichia svobodnogo vremeni ya ego nastraivayu.
Tak kak opit i svobodnoe vremya ne pozvolyaet nichego bolishe, poka sdelal tak:
Napisal 3 skripta kotorie zapuskayutsea avtomatom po vremeni (cherez /etc/crontab).
firewall_day dayet dostup v internet dnem po trem ip-adressam:
192.168.0.21 -> client no. 1
192.168.0.111 -> client no. 2
192.168.0.114 -> client no. 3
Nochiu zapuskayetsya
firewall_night kotoriy razreshayet dostup po chetirem ip-adressam:
192.168.0.11 -> tot je client no. 1
192.168.0.101 -> tot je client no. 2
192.168.0.104 -> tot je client no.3
192.168.0.102 -> server kotoriy zanimayetsya downloadom toliko nochiu
Eto vse znacit cito kajdiy client imeyet 2 ip-adressa - odin nochnoy i odin dnevnoy. Server avtomatom otkrivaet/zakrivayet dostup dnevnim i nochnim ip-addressam. Polizovateli doljno menyati svoi ip-adresa sootvetstvenno. Получаем что пользователь имеет интернет ровно столько сколько захочет, т.е. никакие Windows Update и другие вирусы не вносят свой вклад в картину потребления траффика. Во вторых это позволяет вести хоть какой-то учет входящего и исходящего траффика. Делается это через другой скрипт, на Перле, который считывает показания счетчиков IPFW и сохраняет данные в текстовой файл, который расшаривается для всех через Samba. Все это извращение - ниже.
Может это все и выглядит коряво и совсем по ламерски, но для начала полагаю сойдет. Вот сдам экзамены и возьмусь за настройку IPA + MRTG или NETAMS. Сейчас пробовал, чегото не вышло.
Dalishe idut listingi scriptov:
File nomer 1: firewall_day
- Код: Выделить всё
#!/bin/sh
#----------------------------------------------------
# delete all loaded rules #
#----------------------------------------------------
ipfw -f flush
ipfw -f pipe flush
#----------------------------------------------------
# enable NAT on fxp0 #
#----------------------------------------------------
ipfw add 110 divert natd all from any to any via fxp0
#----------------------------------------------------
# let the packets pass from and to gateway's NICS #
#----------------------------------------------------
ipfw add 200 allow ip from any to 192.168.0.100
ipfw add 201 allow ip from 192.168.0.100 to any
ipfw add 202 allow ip from any to 192.168.1.100
ipfw add 203 allow ip from 192.168.1.100 to any
#----------------------------------------------------
# configure bandwidth and weights (dynamic shaping)#
#----------------------------------------------------
ipfw pipe 100 config bw 212Kbit/s queue 25Kbytes
ipfw queue 1 config pipe 100 weight 33 gred 0.002/10/30/0.1
ipfw queue 2 config pipe 100 weight 33 gred 0.002/10/30/0.1
ipfw queue 3 config pipe 100 weight 1 gred 0.002/10/30/0.1
#---------------------------------------------------------------
# assign each client its bandwidth priority (dynamic shaping) #
#---------------------------------------------------------------
ipfw add 100 queue 1 all from any to 192.168.0.114
ipfw add 102 queue 2 all from any to 192.168.0.21
ipfw add 106 queue 3 all from any to 192.168.0.111
#----------------------------------------------------
# allow SHURIK #
#----------------------------------------------------
ipfw add 204 allow all from any to 192.168.0.111
ipfw add 205 allow all from 192.168.0.111 to any
#----------------------------------------------------
# allow DOPEY #
#----------------------------------------------------
ipfw add 206 allow all from any to 192.168.0.21
ipfw add 207 allow all from 192.168.0.21 to any
#----------------------------------------------------
# allow SEREGA #
#----------------------------------------------------
ipfw add 208 allow all from any to 192.168.0.114
ipfw add 209 allow all from 192.168.0.114 to any
#----------------------------------------------------
# count users traffic #
#----------------------------------------------------
#download
ipfw add 47 count all from any to 192.168.0.21 out recv fxp0
ipfw add 49 count all from any to 192.168.0.111 out recv fxp0
ipfw add 51 count all from any to 192.168.0.114 out recv fxp0
#upload
ipfw add 48 count all from 192.168.0.21 to any out xmit fxp0
ipfw add 50 count all from 192.168.0.111 to any out xmit fxp0
ipfw add 52 count all from 192.168.0.114 to any out xmit fxp0
#----------------------------------------------------
# count traffic passed through server #
#----------------------------------------------------
ipfw add 90 count all from any to 192.168.0.100 out recv fxp0
ipfw add 91 count all from 192.168.0.100 to any out xmit fxp0
ipfw add 92 count all from any to 192.168.1.100 out recv fxp0
ipfw add 93 count all from 192.168.1.100 to any out xmit fxp0
File nomer 2: firewall_night- Код: Выделить всё
#!/bin/sh
#----------------------------------------------------
# delete all loaded rules #
#----------------------------------------------------
ipfw -f flush
ipfw -f pipe flush
#----------------------------------------------------
# enable NAT on fxp0 #
#----------------------------------------------------
ipfw add 110 divert natd all from any to any via fxp0
#----------------------------------------------------
# let the packets pass from and to gateway's NICS #
#----------------------------------------------------
ipfw add 200 allow ip from any to 192.168.0.100
ipfw add 201 allow ip from 192.168.0.100 to any
ipfw add 202 allow ip from any to 192.168.1.100
ipfw add 203 allow ip from 192.168.1.100 to any
#----------------------------------------------------
# configure bandwidth and weights (dynamic shaping)#
#----------------------------------------------------
ipfw pipe 100 config bw 212Kbit/s queue 25Kbytes
ipfw queue 1 config pipe 100 weight 33 gred 0.002/10/30/0.1
ipfw queue 2 config pipe 100 weight 33 gred 0.002/10/30/0.1
ipfw queue 3 config pipe 100 weight 33 gred 0.002/10/30/0.1
ipfw queue 4 config pipe 100 weight 1 gred 0.002/10/30/0.1
#---------------------------------------------------------------
# assign each client its bandwidth priority (dynamic shaping) #
#---------------------------------------------------------------
ipfw add 100 queue 1 all from any to 192.168.0.104
ipfw add 102 queue 2 all from any to 192.168.0.11
ipfw add 104 queue 3 all from any to 192.168.0.102
ipfw add 106 queue 4 all from any to 192.168.0.101
#----------------------------------------------------
# allow SHURIK #
#----------------------------------------------------
ipfw add 204 allow all from any to 192.168.0.101
ipfw add 205 allow all from 192.168.0.101 to any
#----------------------------------------------------
# allow DOPEY #
#----------------------------------------------------
ipfw add 206 allow all from any to 192.168.0.11
ipfw add 207 allow all from 192.168.0.11 to any
#----------------------------------------------------
# allow SEREGA #
#----------------------------------------------------
ipfw add 208 allow all from any to 192.168.0.104
ipfw add 209 allow all from 192.168.0.104 to any
#----------------------------------------------------
# allow DOWNLOADER #
#----------------------------------------------------
ipfw add 210 allow all from any to 192.168.0.102
ipfw add 211 allow all from 192.168.0.102 to any
#----------------------------------------------------
# count users traffic #
#----------------------------------------------------
#download
ipfw add 47 count all from any to 192.168.0.11 out recv fxp0
ipfw add 49 count all from any to 192.168.0.101 out recv fxp0
ipfw add 51 count all from any to 192.168.0.102 out recv fxp0
ipfw add 53 count all from any to 192.168.0.104 out recv fxp0
#upload
ipfw add 48 count all from 192.168.0.11 to any out xmit fxp0
ipfw add 50 count all from 192.168.0.101 to any out xmit fxp0
ipfw add 52 count all from 192.168.0.102 to any out xmit fxp0
ipfw add 54 count all from 192.168.0.104 to any out xmit fxp0
#----------------------------------------------------
# count traffic passed through the server #
#----------------------------------------------------
ipfw add 90 count all from any to 192.168.0.100 out recv fxp0
ipfw add 91 count all from 192.168.0.100 to any out xmit fxp0
ipfw add 92 count all from any to 192.168.1.100 out recv fxp0
ipfw add 93 count all from 192.168.1.100 to any out xmit fxp0
File nomer 3: firewall_deny_access- Код: Выделить всё
#!/bin/sh
#----------------------------------------------------
# delete all loaded rules #
#----------------------------------------------------
ipfw -f flush
ipfw -f pipe flush
#----------------------------------------------------
# let the packets pass from and to gateway's NICS #
#----------------------------------------------------
ipfw add 200 allow ip from any to 192.168.0.100
ipfw add 201 allow ip from 192.168.0.100 to any
ipfw add 202 allow ip from any to 192.168.1.100
ipfw add 203 allow ip from 192.168.1.100 to any
В /etc/crontab прописал следующее:
- Код: Выделить всё
#minute hour mday month wday who command
5 0 * * * root /etc/firewall_night
5 8 * * * root /etc/firewall_day
55 23 * * * root /etc/firewall_deny_access
54 23 * * * root /usr/billing/get_stat
55 7 * * * root /etc/firewall_deny_access
54 7 * * * root /usr/billing/get_stat
*/1 * * * * root /usr/billing/get_current.pl
Статистика собирается скриптом get_current.pl:
- Код: Выделить всё
#!/usr/bin/perl -w
$prefix_data = "/usr/billing/data/";
$prefix_stats = "/usr/billing/stats/";
@ipfw_output = `ipfw -a list`;
for ($row = 0; $row <= $#ipfw_output; $row++){
@one_row = split /\s+/, $ipfw_output[$row];
for ($column = 0; $column <= $#one_row; $column++){
$lines[$row][$column] = $one_row[$column];
}
}
$filename = $prefix_stats . "current" . "-formatted.txt";
open FILE, "> $filename" or die "Can't open $filename : $!";
for ($row = 0; $row <= $#ipfw_output; $row++){
if (($lines[$row][6] eq '192.168.0.21' || $lines[$row][6] eq '192.168.0.11') && $lines[$row][3] eq 'count'){
print FILE "-" x 20;
print FILE "\nDOPEY has sent a total of\n\t$lines[$row][1] packets\nwhich makes\n\t$lines[$row][2] bytes\nor\n\t" . $lines[$row][2]/1024/1024 . " megabytes";
print FILE "\n\nCounter data:\n\t$ipfw_output[$row]";
print FILE "=" x 20;
}
if (($lines[$row][8] eq '192.168.0.21' || $lines[$row][8] eq '192.168.0.11') && $lines[$row][3] eq 'count'){
print FILE "=" x 20;
print FILE "\nDOPEY has received a total of\n\t$lines[$row][1] packets\nwhich makes\n\t$lines[$row][2] bytes\nor\n\t" . $lines[$row][2]/1024/1024 . " megabytes";
print FILE "\n\nCounter data:\n\t$ipfw_output[$row]";
}
if (($lines[$row][6] eq '192.168.0.111' || $lines[$row][6] eq '192.168.0.101') && $lines[$row][3] eq 'count'){
print FILE "-" x 20;
print FILE "\nSHURIK has sent a total of\n\t$lines[$row][1] packets\nwhich makes\n\t$lines[$row][2] bytes\nor\n\t" . $lines[$row][2]/1024/1024 . " megabytes";
print FILE "\n\nCounter data:\n\t$ipfw_output[$row]";
print FILE "=" x 20;
}
if (($lines[$row][8] eq '192.168.0.111' || $lines[$row][8] eq '192.168.0.101') && $lines[$row][3] eq 'count'){
print FILE "=" x 20;
print FILE "\nSHURIK has received a total of\n\t$lines[$row][1] packets\nwhich makes\n\t$lines[$row][2] bytes\nor\n\t" . $lines[$row][2]/1024/1024 . " megabytes";
print FILE "\n\nCounter data:\n\t$ipfw_output[$row]";
}
if (($lines[$row][6] eq '192.168.0.114' || $lines[$row][6] eq '192.168.0.104') && $lines[$row][3] eq 'count'){
print FILE "-" x 20;
print FILE "\nSEREGA has sent a total of\n\t$lines[$row][1] packets\nwhich makes\n\t$lines[$row][2] bytes\nor\n\t" . $lines[$row][2]/1024/1024 . " megabytes";
print FILE "\n\nCounter data:\n\t$ipfw_output[$row]";
print FILE "=" x 20;
}
if (($lines[$row][8] eq '192.168.0.114' || $lines[$row][8] eq '192.168.0.104') && $lines[$row][3] eq 'count'){
print FILE "=" x 20;
print FILE "\nSEREGA has received a total of\n\t$lines[$row][1] packets\nwhich makes\n\t$lines[$row][2] bytes\nor\n\t" . $lines[$row][2]/1024/1024 . " megabytes";
print FILE "\n\nCounter data:\n\t$ipfw_output[$row]";
}
if (($lines[$row][6] eq '192.168.0.122' || $lines[$row][6] eq '192.168.0.102') && $lines[$row][3] eq 'count'){
print FILE "-" x 20;
print FILE "\nDOWNLOADER has sent a total of\n\t$lines[$row][1] packets\nwhich makes\n\t$lines[$row][2] bytes\nor\n\t" . $lines[$row][2]/1024/1024 . " megabytes";
print FILE "\n\nCounter data:\n\t$ipfw_output[$row]";
print FILE "=" x 20;
}
if (($lines[$row][8] eq '192.168.0.122' || $lines[$row][8] eq '192.168.0.102') && $lines[$row][3] eq 'count'){
print FILE "=" x 20;
print FILE "\nDOWNLOADER has received a total of\n\t$lines[$row][1] packets\nwhich makes\n\t$lines[$row][2] bytes\nor\n\t" . $lines[$row][2]/1024/1024 . " megabytes";
print FILE "\n\nCounter data:\n\t$ipfw_output[$row]";
}
}
close FILE;
`cp $filename $prefix_data`;
Я даже не пытался еще его оптимизировать или выловить все глюки. Только вчера его написал, да и то с бодуна. Очевидно его можно вполовину сократить....
))
Этот скрипт показывает статистику текущую. Из /etc/crontab очевидно что обновляет он эту статистику раз в минуту. Выглядит это таким образом:
- Код: Выделить всё
====================
DOPEY has received a total of
5101 packets
which makes
3375285 bytes
or
3.21892261505127 megabytes
Counter data:
00047 5101 3375285 count ip from any to 192.168.0.21 out recv fxp0
--------------------
DOPEY has sent a total of
4980 packets
which makes
618532 bytes
or
0.589878082275391 megabytes
Counter data:
00048 4980 618532 count ip from 192.168.0.21 to any out xmit fxp0
========================================
SHURIK has received a total of
949 packets
which makes
686263 bytes
or
0.654471397399902 megabytes
Counter data:
00049 949 686263 count ip from any to 192.168.0.111 out recv fxp0
--------------------
SHURIK has sent a total of
837 packets
which makes
92350 bytes
or
0.0880718231201172 megabytes
Counter data:
00050 837 92350 count ip from 192.168.0.111 to any out xmit fxp0
========================================
SEREGA has received a total of
7835 packets
which makes
7874950 bytes
or
7.5101375579834 megabytes
Counter data:
00051 7835 7874950 count ip from any to 192.168.0.114 out recv fxp0
--------------------
SEREGA has sent a total of
6953 packets
which makes
707761 bytes
or
0.674973487854004 megabytes
Counter data:
00052 6953 707761 count ip from 192.168.0.114 to any out xmit fxp0
====================
Это все надо бы поместить в один скрипт, да и привинтить к нему веб-интерфейс. Займусь этак недели через 3...
Кстати, кто-нибудь может подсказать насколько точно показывают счетчики в IPFW?
И вот бы кто-нибудь более опытный потыкал бы пальцем на ошибки и смешные куски кода... Хельп, короче!