Биллинговая система Nodeny

root@base:/usr/home/sergey # cat /etc/rc.firewall
#!/bin/sh -
f='/sbin/ipfw'

ifOut='ng0'
#ifOut='re0 ng0 ng1'

ifVia=''
ifRecv=''
tmp_or=''
for i in $ifOut
  do
    ifVia="${ifVia}${tmp_or}via $i"
    ifRecv="${ifRecv}${tmp_or}recv $i"
    tmp_or=' or '
  done

${f} -f flush

# dns, www .liqpay.com, liqpay.com
#${f} table 100 add 0.0.0.0/0
${f} table 100 add 8.8.8.8
${f} table 100 add 50.16.196.80
${f} table 100 add 107.21.122.223

# mysql slave server cs.csmoney.net
${f} table 101 add 50.17.182.68

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me

${f} add 200 skipto 500 ip from any to any { $ifVia }

${f} add 300 skipto 4500 ip from any to any in

${f} add 400 skipto 450 ip from any to any { $ifRecv }
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any


${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 22,80,443,5006
${f} add 2030 allow tcp from "table(101)" to any 3306
${f} add 2050 deny ip from any to any { $ifVia }
${f} add 2060 allow udp from any to any 53,7723

${f} add 2100 deny ip from any to any

${f} add 4500 allow ip from any to "table(100)"
${f} add 32490 deny ip from any to any

${f} add 32500 allow ip from "table(100)" to any

Трассировка маршрута к odnoklassniki.ru [217.20.147.94]
с максимальным числом прыжков 30:

  1    <1 мс    <1 мс    <1 мс  172.16.10.1
  2     1 ms     2 ms     2 ms  bb-core2.slav.dn.ua [193.228.2.191]
  3     3 ms     3 ms     2 ms  172.26.16.9
  4     4 ms     4 ms     4 ms  dipt-sns-gw.donbass.net [195.184.219.237]
  5    14 ms    14 ms    16 ms  dtel-ix.mail.ru [193.25.180.106]
  6    56 ms    32 ms    30 ms  ae6.dl10.m9.net.mail.ru [94.100.183.94]
  7    31 ms    32 ms    32 ms  188.93.58.177
  8     *        *        *     Превышен интервал ожидания для запроса.
  9    33 ms    33 ms    32 ms  ip94.147.odnoklassniki.ru [217.20.147.94]

Трассировка завершена.

Трассировка маршрута к youtube.com [173.194.32.163]
с максимальным числом прыжков 30:

  1     1 ms     1 ms    <1 мс  172.16.10.1
  2     2 ms     1 ms     2 ms  bb-core2.slav.dn.ua [193.228.2.191]
  3     2 ms     4 ms     3 ms  172.26.16.9
  4     4 ms     4 ms     3 ms  dipt-sns-gw.donbass.net [195.184.219.237]
  5    15 ms    13 ms    15 ms  kyiv1-xe-11-1-0-981.ett.ua [80.93.125.105]
  6    25 ms    19 ms    19 ms  80.93.113.78.ett.ua [80.93.113.78]
  7    46 ms    45 ms    46 ms  209.85.252.123
  8    42 ms    43 ms    43 ms  209.85.250.225
  9    43 ms    43 ms    43 ms  72.14.235.227
 10    42 ms    43 ms    76 ms  72.14.235.231
 11    65 ms    43 ms    43 ms  173.194.32.163

Трассировка завершена.

nslookup odnoklassniki.ru

tcpdump -i em1 host odnoklassniki.ru

root@base:/usr/home/sergey # nslookup odnoklassniki.ru
Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
Name:   odnoklassniki.ru
Address: 217.20.147.94

root@base:/usr/home/sergey # tcpdump -i rl0 host odnoklassniki.ru
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on rl0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:32:53.418611 IP 172.16.10.22.51546 > ip94.147.odnoklassniki.ru.http: Flags [P.], seq 3863565741:3863566409, ack 2833167771, win 16397, length 668
12:32:53.474532 IP ip94.147.odnoklassniki.ru.http > 172.16.10.22.51546: Flags [P.], seq 1:652, ack 668, win 17, length 651
12:32:53.863478 IP 172.16.10.22.51546 > ip94.147.odnoklassniki.ru.http: Flags [.], ack 652, win 16234, length 0
12:32:53.891129 IP 172.16.10.22.51546 > ip94.147.odnoklassniki.ru.http: Flags [P.], seq 668:1471, ack 652, win 16234, length 803
12:32:53.974529 IP ip94.147.odnoklassniki.ru.http > 172.16.10.22.51546: Flags [.], ack 1471, win 20, length 0
12:32:53.979529 IP ip94.147.odnoklassniki.ru.http > 172.16.10.22.51546: Flags [P.], seq 652:1279, ack 1471, win 20, length 627
12:32:54.179450 IP 172.16.10.22.51546 > ip94.147.odnoklassniki.ru.http: Flags [.], ack 1279, win 16560, length 0

mtu=1500;site=youtube.com;while ! ping -D -c 1 -t 1 -s $((mtu--)) $site &>/dev/null; do :; done;echo "Valid MTU for $site is $mtu"

scrub in all fragment reassemble
scrub out all random-id max-mss 1480

root@base:/usr/home/sergey # cat /etc/pf.conf
ext_if = "ng0"

set limit states 128000
set optimization aggressive

scrub in all fragment reassemble
scrub out all random-id max-mss 1480

nat pass on $ext_if from 172.16.10.0/24 to any -> ($ext_if)

root@base:/usr/home/sergey # cat /usr/local/etc/mpd5/mpd.conf
startup:
        set user vpupkin 123456 admin
        set console self 127.0.0.1 5005

default:
        load pppoe_client

pppoe_client:
        create bundle static B1
        set iface route default
        set ipcp ranges 0.0.0.0/0 0.0.0.0/0
        set ipcp enable req-pri-dns
        set ipcp enable req-sec-dns
        create link static L1 pppoe
        set link action bundle B1
        set auth authname user491
        set auth password 6937583
        set link max-redial 0
        set link mtu 1480
        set link keep-alive 10 60
        set pppoe iface em0
        set pppoe service ""
        open

root@base:/usr/home/sergey # mtu=1500;site=youtube.com;while ! ping -D -c 1 -t 1 -s $((mtu--)) $site &>/dev/null; do :; done;echo "Valid MTU for $site is $mtu"
Illegal variable name.