Биллинговая система Nodeny

#!/bin/sh -
f='/sbin/ipfw'

ifIn='em0'
ifOut='em1'

${f} -f flush

${f} add 2 allow tcp from any to me 8282
${f} add 2 allow tcp from me 8282 to any

${f} add 3 allow ip from 10.13.0.0/21 to 10.13.0.1 via ${ifIn}
${f} add 3 allow ip from 10.13.0.1 to 10.13.0.0/21 via ${ifIn}
${f} add 3 allow ip from 10.13.0.0/21 to 10.13.0.3 via ${ifIn}
${f} add 3 allow ip from 10.13.0.3 to 10.13.0.0/21 via ${ifIn}

${f} add 4 allow tcp from any to me 901,5006,8000,1723,11000, 23,562,1081,1080,89,3128,2777,1029,8888,22,21,31,28,1028                     
${f} add 4 allow tcp from me 901,5006,8000,1723,11000,23,562,1081,1080,89,3128,2777,1029,8888,22,21,31,28,1028 to any

${f} add 5 allow gre from any to any

${f} add 6 allow udp from any to me 161
${f} add 6 allow udp from me 161 to any


${f} add 10 allow tcp from any to 92.242.103.138 80
${f} add 10 allow tcp from 92.242.103.138 80 to any

# nomessege
${f} add 270 deny tcp from not "table(0)" to 90.183.101.0/24
${f} add 280 fwd 127.0.0.1,8081 tcp from "table(35)" to not me dst-port 80 in via ${ifIn}
${f} add 290 fwd 127.0.0.1,8082 tcp from not "table(0)" to not me dst-port 80 in via ${ifIn}

${f} add 810 allow ip from any to any via lo0
${f} add 820 skipto 1000 ip from me to any
${f} add 830 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 860 skipto 2000 ip from any to me

${f} add 870 skipto 901 ip from any to any via ${ifOut}

${f} add 880 skipto 4500 ip from any to any in

${f} add 891 skipto 893 ip from any to any recv ${ifOut}
${f} add 892 tee 1 ip from any to any
${f} add 893 tee 2 ip from any to any
${f} add 894 allow ip from any to any

${f} add 901 skipto 32500 ip from any to any in
${f} add 902 tee 1 ip from any to any
${f} add 903 allow ip from any to any

${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723,161

${f} add 2100 deny ip from any to any

${f} add 32490 deny ip from any to any

set iface enable proxy-arp

startup:
    set user admin passwd_mpd
    set console self 127.0.0.1 5005
    set console open
    set web self 0.0.0.0 5006
    set web open


default:
    load pptp_server
    load pppoe_server

pptp_server:
    create bundle template C
    set iface enable proxy-arp
    set iface idle 1800
    set iface enable tcpmssfix
    set ipcp yes vjcomp
    set ipcp ranges 92.242.103.172/32 127.0.0.2/32
    set ipcp dns 10.13.0.1 195.184.192.12
    set bundle enable compression
    set ccp yes mppc
    set mppc yes e40
    set mppc yes e128
    set mppc yes stateless
    create link template C1 pptp
    set link action bundle C
    set link enable multilink
    set link yes acfcomp protocomp
    set link no pap chap
    set link enable chap pap
    load radius
    set link keep-alive 10 60
    set link mtu 1460
    set link enable incoming

pppoe_server:
    create bundle template B
    set ipcp ranges 92.242.103.172/32 127.0.0.2/32
    set ipcp dns 10.13.0.1 195.184.192.12
    set iface idle 0
    set iface enable proxy-arp
    set iface enable tcpmssfix
    set ccp yes mppc
    set mppc yes e40
    set mppc yes e56
    set mppc yes e128
    set mppc yes stateless
    set mppc yes compress
    set ecp disable dese-bis dese-old
    log *
    create link template common pppoe
    set link enable multilink
    set link action bundle B
    set link disable chap pap eap
    set link enable pap
    set link mtu 1460
    set link mru 1460
    load radius
    set pppoe service "*"
    create link template em0 common
    set link max-children 1000
    set pppoe iface em0
    set auth max-logins 1
    set auth timeout 60
    set link enable peer-as-calling
    set link enable incoming


radius:
    set radius server localhost passwd_radius 1812 1813
    set radius retries 1
    set radius timeout 3
    set radius me 127.0.0.1
    set auth acct-update 45
    set auth enable radius-auth
    set auth enable radius-acct
    set radius enable message-authentic

set limit states 128000
set optimization aggressive
nat pass on em1 from 10.0.0.0/8 to any -> em1

#!/bin/sh -
f='/sbin/ipfw'
ifIn='em0'
ifOut='em1'

${f} -f flush

${f} add 100 allow ip from any to any