Биллинговая система Nodeny

int_if="em0"
ext_if="em1"
ua_if="bge1"

... поскипано ...

no nat on $int_if from any to 192.168.0.0/24

nat pass on $ext_if from 192.168.0.0/16 to any -> 78.154.х.х/25 source-hash
nat pass on $ext_if from 10.0.0.0/8 to any -> $ext_if

# Выдача белого ипа
no nat on $ext_if from 192.168.70.2 to any
binat on $ext_if from  192.168.70.2  to any ->  78.154.х.х

#!/bin/sh -
f='/sbin/ipfw'

ifOut='em1'

# Сети, в/из которых трафик блокируем
${f} table 120 flush
${f} table 120 add 224.0.0.0/4
${f} table 120 add 172.16.0.0/12

${f} -f flush

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any

# ${f} add 60 allow ip from any to any

${f} add 100 deny tcp from any to any 445

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 140 deny ip from any to "table(120)"
${f} add 150 deny ip from "table(120)" to any
${f} add 160 skipto 2000 ip from any to me

${f} add 200 skipto 500 ip from any to any via ${ifOut}

${f} add 300 skipto 4500 ip from any to any in

# ${f} add 300 setfib 1 ip from table(126) to any in
# ${f} add 350 skipto 4500 ip from any to any in

${f} add 400 ngtee 100 ip from any to any

${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 ngtee 100 ip from any to any
${f} add 540 allow ip from any to any


${f} add 1000 allow udp from any 53,161,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,161,7723
${f} add 2070 allow ip from 10.0.121.10 to any

${f} add 2100 deny ip from any to any

${f} add 32490 deny ip from any to any

ifOut2='bge1'

nat pass on bge1 from {192.168.0.0/16,10.0.0.0/8} to any -> $ua_if

3591 accepted prefixes

[root@gate /usr/local]# ipfw list
00050 allow tcp from any to me dst-port 22
00051 allow tcp from me 22 to any
00100 deny tcp from any to any dst-port 445
00110 allow ip from any to any via lo0
00120 skipto 1000 ip from me to any
00130 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00140 deny ip from any to table(120)
00150 deny ip from table(120) to any
00160 skipto 2000 ip from any to me
00200 skipto 500 ip from any to any via bge1
00201 skipto 500 ip from any to any via em1
00300 skipto 4500 ip from any to any in
00400 ngtee 100 ip from any to any
00490 allow ip from any to any
00500 skipto 32500 ip from any to any in
00510 ngtee 100 ip from any to any
00540 allow ip from any to any
01000 allow udp from any 53,161,7723 to any
01010 allow tcp from any to any setup keep-state
01020 allow udp from any to any keep-state
01100 allow ip from any to any
02000 check-state
02010 allow icmp from any to any
02020 allow tcp from any to any dst-port 80,443
02050 deny ip from any to any via bge1
02051 deny ip from any to any via em1
02060 allow udp from any to any dst-port 53,161,7723
02070 allow ip from 10.0.121.10 to any
02100 deny ip from any to any
05000 deny ip from not table(0) to any
05001 skipto 5010 ip from table(127) to table(126)
05002 skipto 5030 ip from any to not table(2)
05003 deny ip from any to not table(1)
05004 pipe tablearg ip from table(21) to any
05005 deny ip from any to any
05010 pipe tablearg ip from table(127) to any
05030 deny tcp from table(15) to any dst-port 25
05226 allow ip from table(127) to table(126)
05400 pipe tablearg ip from table(11) to any
32000 deny ip from any to any
32490 deny ip from any to any
33000 pipe tablearg ip from table(126) to table(127)
33001 skipto 33010 ip from not table(2) to any
33002 pipe tablearg ip from any to table(20)
33003 deny ip from any to any
33226 allow ip from table(126) to table(127)
33400 pipe tablearg ip from any to table(10)
65535 deny ip from any to any

[root@gate /usr/local]# ipfw show
00050       6779        297572 allow tcp from any to me dst-port 22
00051      12379       2392184 allow tcp from me 22 to any
00100      65453       3249092 deny tcp from any to any dst-port 445
00110      85480      10662708 allow ip from any to any via lo0
00120    4034166    2329134895 skipto 1000 ip from me to any
00130      16315        913927 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00140       6557        635922 deny ip from any to table(120)
00150       3183        230252 deny ip from table(120) to any
00160    2420357    1632925784 skipto 2000 ip from any to me
00200    1061160      80561239 skipto 500 ip from any to any via bge1
00201 1371933031 1018165281908 skipto 500 ip from any to any via em1
00300 1060154763  757295277484 skipto 4500 ip from any to any in
00400  729193576  615661664507 ngtee 100 ip from any to any
00490          0             0 allow ip from any to any
00500  698001039  618632646521 skipto 32500 ip from any to any in
00510  675520271  399760433574 ngtee 100 ip from any to any
00540          0             0 allow ip from any to any
01000     727774      54805708 allow udp from any 53,161,7723 to any
01010    2758241    1683621893 allow tcp from any to any setup keep-state
01020    1445904    2133211730 allow udp from any to any keep-state
01100     595634      37950561 allow ip from any to any
02000          0             0 check-state
02010      33605       1684028 allow icmp from any to any
02020      34632       1600806 allow tcp from any to any dst-port 80,443
02050       9125        466822 deny ip from any to any via bge1
02051       3977        476544 deny ip from any to any via em1
02060     845199      48218715 allow udp from any to any dst-port 53,161,7723
02070          0             0 allow ip from 10.0.121.10 to any
02100        434         23872 deny ip from any to any
05000    4660423    4133767368 deny ip from not table(0) to any
05001   10784638   14508835430 skipto 5010 ip from table(127) to table(126)
05002 1044708213  738652596897 skipto 5030 ip from any to not table(2)
05003        362         18499 deny ip from any to not table(1)
05004        352         15360 pipe tablearg ip from table(21) to any
05005          0             0 deny ip from any to any
05010   10784638   14508835430 pipe tablearg ip from table(127) to any
05030     679366      32624492 deny tcp from table(15) to any dst-port 25
05226          0             0 allow ip from table(127) to table(126)
05400 1044028844  738619971225 pipe tablearg ip from table(11) to any
32000          3          1180 deny ip from any to any
32490        775         43930 deny ip from any to any
33000    6183805     382276922 pipe tablearg ip from table(126) to table(127)
33001  691815650  618250150342 skipto 33010 ip from not table(2) to any
33002       1301        102746 pipe tablearg ip from any to table(20)
33003         94          5025 deny ip from any to any
33226          0             0 allow ip from table(126) to table(127)
33400  681912726  617529968071 pipe tablearg ip from any to table(10)
65535    9902997     720245500 deny ip from any to any

Направление 1	Общий трафик	 	                                                                 
Направление 2	UA-IX трафик	                    таблица ipfw: 126            	

Приоритет	      Сеть	                Порт	Направление     	Комментарий	

100	           file:/usr/local/nodeny/uaix.txt	UA-IX	       UA-IX трафик        	
1000	           0.0.0.0/0	 	                      Общий	           Дефолтный трафик

[root@gate /usr/home/]# ipfw show 505
00505       55989       22664089 count ip from any to any via bge1

#!/usr/bin/perl
$lines=`/usr/local/bin/flow-export -f2 -mdoctets,srcaddr,dstaddr,input,output,srcport,dstp
$out_int=',2,4,';
$out="";
foreach $line (split /\n/,$lines)
 {
  ($bytes,$src,$dst,$src_if,$dst_if,$src_port,$dst_port,$prot)=split /,/,$line;
  next if $prot<1;
  $h="$src\t$dst\t1\t$bytes\t$src_port\t$dst_port\t$prot\t";
  $out.=$h."2\n" if $out_int=~/,$src_if,/;
  $out.=$h."1\n" if $out_int=~/,$dst_if,/;
 }
exit unless open (F,'>/usr/local/nodeny/sql/1-1251989608_temp');
print F $out;
close(F);
rename '/usr/local/nodeny/sql/1-1251989608_temp','/usr/local/nodeny/sql/1-1251989608';
unlink "/var/db/flows/$ARGV[0]";