Биллинговая система Nodeny

uname -a
---------
FreeBSD kapitolovka.izumnet 7.2-RELEASE-p8 FreeBSD 7.2-RELEASE-p8 #1: Mon Jun 27 09:07:36 UTC 2011     pushok@kapitolovka.izumnet:/usr/src/sys/i386/compile/PUSHOK  i386
===================================
ifconfig -a
------------
xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=9<RXCSUM,VLAN_MTU>
	ether 00:04:76:14:03:51
	inet 192.168.1.102 netmask 0xffffff00 broadcast 192.168.1.255
	media: Ethernet autoselect (100baseTX <full-duplex>)
	status: active
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=389b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC>
	ether 00:30:4f:59:6a:dd
	inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
	media: Ethernet autoselect (100baseTX <full-duplex>)
	status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> metric 0 mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4 
	inet6 ::1 prefixlen 128 
	inet 127.0.0.1 netmask 0xff000000 
pflog0: flags=0<> metric 0 mtu 33204
pfsync0: flags=0<> metric 0 mtu 1460
	syncpeer: 224.0.0.240 maxupd: 128
===============================================
ipfw show
----------
00050 3235  253335 allow tcp from any to me dst-port 22
00051 2227 1229940 allow tcp from me 22 to any
00110 4128  256318 allow ip from any to any via lo0
00120 2736  257515 skipto 1000 ip from me to any
00130    0       0 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00160 2806  203743 skipto 2000 ip from any to me
00200   27    5862 skipto 500 ip from any to any via xl0
00300    4     304 skipto 4500 ip from any to any in
00400    0       0 skipto 450 ip from any to any recv xl0
00420    0       0 divert 1 ip from any to any
00450    0       0 divert 2 ip from any to any
00490    0       0 allow ip from any to any
00500   27    5862 skipto 32500 ip from any to any in
00510    0       0 divert 1 ip from any to any
00540    0       0 allow ip from any to any
01000    0       0 allow udp from any 53,7723 to any
01010    0       0 allow tcp from any to any setup keep-state
01020   14    1485 allow udp from any to any keep-state
01100 2729  257038 allow ip from any to any
02000    0       0 check-state
02010    0       0 allow icmp from any to any
02020  228   31513 allow tcp from any to any dst-port 80,443
02050    0       0 deny ip from any to any via xl0
02060 2571  171222 allow udp from any to any dst-port 53,7723
02100    0       0 deny ip from any to any
05000    4     304 deny ip from not table(0) to any
05001    0       0 skipto 5010 ip from table(127) to table(126)
05002    0       0 skipto 5030 ip from any to not table(2)
05003    0       0 deny ip from any to not table(1)
05004    0       0 pipe tablearg ip from table(21) to any
05005    0       0 deny ip from any to any
05010    0       0 pipe tablearg ip from table(127) to any
05030    0       0 deny tcp from table(15) to any dst-port 25
05400    0       0 pipe tablearg ip from table(11) to any
32000    0       0 deny ip from any to any
32490    0       0 deny ip from any to any
33000    0       0 pipe tablearg ip from table(126) to table(127)
33001   27    5862 skipto 33010 ip from not table(2) to any
33002    0       0 pipe tablearg ip from any to table(20)
33003    0       0 deny ip from any to any
33400    0       0 pipe tablearg ip from any to table(10)
65535   27    5862 deny ip from any to any
=============================================
ipfw table 10 list
------------------
10.0.0.2/32 1004
=============================================
netstat -nr
------------
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.1.1        UGS         0        0    xl0
10.0.0.0/8         link#2             UC          0        0    re0
10.0.0.2           00:1e:68:b2:14:92  UHLW        1     5001    re0   1069
127.0.0.1          127.0.0.1          UH          0     2176    lo0
192.168.1.0/24     link#1             UC          0        0    xl0
192.168.1.1        34:08:04:80:a6:a6  UHLW        2        7    xl0   1194

Internet6:
Destination                       Gateway                       Flags      Netif Expire
::1                               ::1                           UHL         lo0
fe80::%lo0/64                     fe80::1%lo0                   U           lo0
fe80::1%lo0                       link#4                        UHL         lo0
ff01:4::/32                       fe80::1%lo0                   UC          lo0
ff02::%lo0/32                     fe80::1%lo0                   UC          lo0
================================================
ps ax|grep ipcad
-----------------
1004  ??  I<s    0:00.10 /usr/local/bin/ipcad -rds -c /usr/local/etc/ipcad.conf
================================================
ps ax|grep nodeny.pl
---------------------
1101  ??  S<     0:04.37 perl nodeny.pl (perl5.8.9)
=================================================
ping ya.ru	с сервера в мир
-----------
PING ya.ru (213.180.204.3): 56 data bytes
64 bytes from 213.180.204.3: icmp_seq=0 ttl=51 time=88.266 ms
64 bytes from 213.180.204.3: icmp_seq=1 ttl=51 time=87.565 ms
64 bytes from 213.180.204.3: icmp_seq=2 ttl=51 time=87.874 ms
64 bytes from 213.180.204.3: icmp_seq=3 ttl=51 time=87.692 ms
^C
--- ya.ru ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 87.565/87.849/88.266/0.264 ms
===================================================
ping ya.ru	с клиента в мир
-----------
ping: unknown host ya.ru
===================================================
ping 10.0.0.1	с клиента к серверу
-------------
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_req=1 ttl=64 time=0.210 ms
64 bytes from 10.0.0.1: icmp_req=2 ttl=64 time=0.155 ms
64 bytes from 10.0.0.1: icmp_req=3 ttl=64 time=0.152 ms
64 bytes from 10.0.0.1: icmp_req=4 ttl=64 time=0.161 ms
^C
--- 10.0.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 2997ms
rtt min/avg/max/mdev = 0.152/0.169/0.210/0.026 ms
====================================================
ping 10.0.0.2	с севера к клиенту
-------------
PING 10.0.0.2 (10.0.0.2): 56 data bytes
64 bytes from 10.0.0.2: icmp_seq=0 ttl=64 time=0.173 ms
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.173 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.167 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=0.196 ms
^C
--- 10.0.0.2 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.167/0.177/0.196/0.011 ms
=====================================================
ee /etc/rc.conf
---------------
gateway_enable="YES"
inetd_enable="YES"
keymap="ua.koi8-u.shift.alt"
nfs_client_enable="YES"
nfs_server_enable="YES"
rpcbind_enable="YES"
sshd_enable="YES"
ifconfig_re0="inet 10.0.0.1 netmask 255.0.0.0"
ifconfig_xl0="inet 192.168.1.102  netmask 255.255.255.0"
defaultrouter="192.168.1.1"
hostname="kapitolovka.izumnet"
firewall_enable="YES"
fsck_y_enable="YES"
background_fsck="NO"
mysql_enable="YES"
apache22_enable="YES"
ipcad_enable="YES"
=====================================================
ee /etc/rc.firewall
-------------------
!/bin/sh -
f='/sbin/ipfw'

ifOut='xl0'

${f} -f flush

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me

${f} add 200 skipto 500 ip from any to any via ${ifOut}

${f} add 300 skipto 4500 ip from any to any in

${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any


${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723

${f} add 2100 deny ip from any to any

${f} add 32490 deny ip from any to any
===================================================
ee /etc/pf.conf
---------------
set limit states 128000
set optimization aggressive
nat pass on xl0 from 10.0.0.0/8 to any -> xl0
nat pass on xl0 from 192.168.0.0/16 to any -> xl0
===================================================

...
$use_ipfw=0;
$use_iptables=0;
$verbose=1;
...