Биллинговая система Nodeny

h2# ipfw show
00050 69 6764 allow tcp from any to me dst-port 22
00051 62 8916 allow tcp from me 22 to any
00110 24 1200 allow ip from any to any via lo0
00120 12  772 skipto 1000 ip from me to any
00130  3  240 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00160 12 1504 skipto 2000 ip from any to me
00200 76 7011 skipto 500 ip from any to any via fxp0
00300 63 4706 skipto 4500 ip from any to any in
00400 13 2305 skipto 450 ip from any to any recv fxp0
00490 13 2305 allow ip from any to any
00500 62 6077 skipto 32500 ip from any to any in
00540 14  934 allow ip from any to any
01000  0    0 allow udp from any 53,7723 to any
01010  0    0 allow tcp from any to any setup keep-state
01020 24 2276 allow udp from any to any keep-state
01100  0    0 allow ip from any to any
02000  0    0 check-state
02010  0    0 allow icmp from any to any
02020  0    0 allow tcp from any to any dst-port 80,443
02050  0    0 deny ip from any to any via fxp0
02060  0    0 allow udp from any to any dst-port 53,7723
02100  0    0 deny ip from any to any
05000 21 1588 deny ip from not table(0) to any
05001 38 2806 skipto 5030 ip from any to not table(2)
05002  0    0 deny ip from any to not table(1)
05003  0    0 pipe tablearg ip from table(21) to any
05004  0    0 deny ip from any to any
05030  0    0 deny tcp from table(15) to any dst-port 25
05226 38 2806 skipto 5227 ip from any to not table(126)
05226  0    0 pipe tablearg ip from table(127) to any
05400 38 2806 pipe tablearg ip from table(11) to any
32000  0    0 deny ip from any to any
32490  0    0 deny ip from any to any
33000 34 3893 skipto 33010 ip from not table(2) to any
33001  0    0 pipe tablearg ip from any to table(20)
33002 24 1872 deny ip from any to any
33226  0    0 pipe tablearg ip from table(126) to table(127)
33400 13 2305 pipe tablearg ip from any to table(10)
65535 25 1900 deny ip from any to any

h2# ipfw table 127 list

h2# ipfw table 127 list
192.168.0.133/32 1650

     else
    {  # входящий и исходящий трафик в одной трубе
       $speed_out=$speed_in;
       $pipe_out=$pipe_in;
    } 
 }
  else
 {  # Если какая-либо скорость не указана - берем стандартную. Нулевая скорость в пайпах = allow
    $pipe_in=$start_pipe;
    $pipe_out=$pipe_in+1;
    $speed_in=$s_in>0? $s_in*8 : $default_in;
    $speed_out=$s_out>0? $s_out*8 : $default_out;
    &Add_Rule("pipe $pipe_in config bw ${speed_in}Kbit/s");
    &Add_Rule("pipe $pipe_out config bw ${speed_out}Kbit/s")

 if( $speed2 )
 {
    $pipe2=$pipe_in+2;
    $queueix_in=$pipe2;
    $queueix_out=$pipe2+1;
#devel
    $table_ix="table(126)";
#devel
    &Add_Rule("pipe $pipe2 config bw ${speed2}Kbit/s");
#devel
    &Add_Rule("add queue $queueix_in ip from $table_ix to $ip");
    &Add_Rule("add queue $queueix_out ip from $ip to $table_ix");
    &Add_Rule("queue $queueix_in config weight 10 pipe $pipe2 mask dst-ip 0xffffffff");
    &Add_Rule("queue $queueix_out config weight 1 pipe $pipe2 mask src-ip 0xffffffff");
#devel
    &Add_Tbl_Rule(127,$ip,$pipe2);
 }

[root@gateway ~]# ipfw pipe 1006 show
01006: 256.000 Kbit/s    0 ms   50 sl. 1 queues (1 buckets) droptail
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
  0 icmp  192.168.160.55/0        86.57.250.18/0      617   470261 43 42436  17
q01007: weight 1 pipe 1006   50 sl. 0 queues (64 buckets) droptail
q01006: weight 10 pipe 1006   50 sl. 0 queues (64 buckets) droptail

[root@gateway ~]# ipfw table 127 list
192.168.0.55/32 1006
192.168.0.207/32 1094
192.168.31.10/32 1134
192.168.31.20/32 1134

 &Add_Rule("-f pipe flush"); 

# &SetIpfwRule(qq{pipe tablearg ip from table(126) to table(127)});

 &Add_Rule("pipe 126 config bw 6000kbit/s");

# &SetIpfwRule(qq{pipe tablearg ip from table(126) to table(127)});

 &SetIpfwRule(qq{pipe 126 ip from table(126) to table(127)});

00030        0           0 deny tcp from any to any not established tcpflags fin
00032        0           0 deny tcp from any to any tcpflags syn,fin,ack,psh,rst,urg
00034        0           0 deny tcp from any to any tcpflags !syn,!fin,!ack,!psh,!rst,!urg
00092   113005     6092800 allow tcp from any to me dst-port 22
00093   112951    15672408 allow tcp from me 22 to any
00094 41826890 22940942476 count ip from any to any in via ng0
00095 39007252 10057724672 count ip from any to any out via ng0
00096 15542034 14622844914 count ip from any to any in via vr0
00097  9762740  1033874409 count ip from any to any out via vr0
00100      622       30332 deny tcp from any to any dst-port 137,138,139,445
00102   439055    39226306 deny udp from any to any dst-port 137,138,139,445
00110  4724362  2594956600 allow ip from any to any via lo0
00120  8421069  5797123570 skipto 1000 ip from me to any
00130     4471      250376 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00160 11859913  1571158241 skipto 2000 ip from any to me
00200 25070969 15629300892 skipto 500 ip from any to any via vr0
00204 77382353 32759234895 skipto 500 ip from any to any via ng0
00300 50716190 11421707203 skipto 4500 ip from any to any in
00400 15240392 14453173543 skipto 450 ip from any to any recv vr0
00404 37264508 22162779908 skipto 450 ip from any to any recv ng0
00420   482390    97244029 divert 1 ip from any to any
00450 52987283 36713188841 divert 2 ip from any to any
00490 52987293 36713197760 allow ip from any to any
00500 53870361 37312227017 skipto 32500 ip from any to any in
00510 48584066 11076718039 divert 1 ip from any to any
00540 48584065 11076717913 allow ip from any to any
01000   191216    44459696 allow udp from any 53,7723 to any
01002      166       38222 allow tcp from any 53 to any
01010    52965    12660979 allow tcp from any to any setup keep-state
01020   145142    20100442 allow udp from any to any keep-state
01100  8131124  5745336333 allow ip from any to any
02000        0           0 check-state
02010   215365    18133398 allow icmp from any to any
02020   431579    61945271 allow tcp from any to any dst-port 80,443
02050     1537       81448 deny ip from any to any via vr0
02054  3299458   217853727 deny ip from any to any via ng0
02060   191857    12052212 allow udp from any to any dst-port 53,123,7723
02062      195        9569 allow tcp from any to any dst-port 53
02070      463       84388 allow tcp from any to any dst-port 1812,1813,5006
02074    12729      767272 allow tcp from any to any dst-port 1723
02076  7574037  1232928877 allow gre from any to any
02100    33161     1830726 deny ip from any to any
05000   129495    11224999 deny ip from not table(0) to any
05001  8528438  1012997518 skipto 5010 ip from table(127) to table(126)
05002 19967240  5679055809 skipto 5030 ip from any to not table(2)
05003     1950      154248 deny ip from any to not table(1)
05004   168069    10469131 pipe tablearg ip from table(21) to any
05005        0           0 deny ip from any to any
05010  8528438  1012997518 pipe tablearg ip from table(127) to any
05030        2         104 deny tcp from table(15) to any dst-port 25
05146   101046     8172802 allow ip from table(47) to table(46)
05226        0           0 allow ip from table(127) to table(126)
05400 19866191  5670882767 pipe tablearg ip from table(11) to any
32000        0           0 deny ip from any to any
32490       24        3232 deny ip from any to any
33000 12062534 11614164639 pipe 126 ip from table(126) to table(127)
33001 17516857 11513107631 skipto 33010 ip from not table(2) to any
33002        0           0 pipe tablearg ip from any to table(20)
33003        0           0 deny ip from any to any
33146     1293      433036 allow ip from table(46) to table(47)
33226        0           0 allow ip from table(126) to table(127)
33400 17512806 11512343606 pipe tablearg ip from any to table(10)
65535    16472     2958136 deny ip from any to any

00003  20659  16577707 allow tcp from any to me established
00005      3       152 allow tcp from any to me dst-port 20,21,50000-50100
00006     88      2464 allow ip from any to 224.0.0.0/4
00007      0         0 allow igmp from any to 224.0.0.0/4
00050     13       768 allow tcp from any to me dst-port 22,3000,4500,1234,4022,4500,4501,10011,7781
00054 637510  41561648 allow udp from any to me dst-port 161,162,8767,30033,10011,9987,27014,27015,27016,27017,27018,27019,27020,27021,27022,27023,27024,27025,27026,27030,27031,27032
00110   1512    147826 allow ip from any to any via lo0
00120 957819 124024493 skipto 1000 ip from me to any
00130     70      3920 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00160  59523   4034173 skipto 2000 ip from any to me
00200 539214 376863290 skipto 500 ip from any to any via msk0
00220 182819  38507643 skipto 500 ip from any to any via rl0
00300 202330 146856131 skipto 4500 ip from any to any in
00400 337554 234203340 skipto 450 ip from any to any recv msk0
00410 181296  38197164 skipto 450 ip from any to any recv rl0
00420      0         0 divert 1 ip from any to any
00450 518848 272399261 divert 2 ip from any to any
00490 518853 272400809 allow ip from any to any
00500 524258 273791283 skipto 32500 ip from any to any in
00510 197780 141585710 divert 1 ip from any to any
00540 197780 141585710 allow ip from any to any
01000   1499    396987 allow udp from any 53,7723,9987 to any
01002     36      6458 allow tcp from any 53 to any
01010    532     26745 allow tcp from any to any setup keep-state
01020 953154 116381895 allow udp from any to any keep-state
01100   5006   7457532 allow ip from any to any
02000      0         0 check-state
02010    188     24795 allow icmp from any to any
02020    185      9684 allow tcp from any to any dst-port 80,443
02030   1527     95098 allow udp from any to any dst-port 53,7723,9987
02040      9       468 allow tcp from any to any dst-port 53
02050  11908    906579 deny ip from any to any via msk0
02060  41315   2577465 deny ip from any to any via rl0
02100   1991    175424 deny ip from any to any
05000    105     43554 deny ip from not table(0) to any
05001  34687  26219392 skipto 5030 ip from any to not table(2)
05002      0         0 deny ip from any to not table(1)
05003      0         0 pipe tablearg ip from table(21) to any
05004      0         0 deny ip from any to any
05030      0         0 deny tcp from table(15) to any dst-port 25,110,135,139,445
05400  34687  26219392 pipe tablearg ip from table(11) to any
32000      0         0 deny ip from any to any
33000  93137  47086688 skipto 33010 ip from not table(2) to any
33001      0         0 pipe tablearg ip from any to table(20)
33002      0         0 deny ip from any to any
33400  92114  46913418 pipe tablearg ip from any to table(10)
65535   5022    834583 deny ip from any to any

ipfw table 10 list
10.0.0.2/32 1088
10.0.0.3/32 1320
10.0.0.4/32 1184
10.0.1.1/32 1008
10.0.1.2/32 1176

ipfw table 11 list
10.0.0.2/32 1089
10.0.0.3/32 1321
10.0.0.4/32 1185
10.0.1.1/32 1009
10.0.1.2/32 1177

ipfw pipe 1088 show
01088:   4.096 Mbit/s    0 ms burst 0
q132160  50 sl. 0 flows (1 buckets) sched 66624 weight 0 lmax 0 pri 0 droptail
 sched 66624 type FIFO flags 0x0 0 buckets 0 active


ipfw pipe 1089 show
01089: 512.000 Kbit/s    0 ms burst 0
q132161  50 sl. 0 flows (1 buckets) sched 66625 weight 0 lmax 0 pri 0 droptail
 sched 66625 type FIFO flags 0x0 0 buckets 0 active

FreeBSD 8.2-RELEASE FreeBSD 8.2-RELEASE #2: Fri Mar 11 22:42:14 UTC 2011     root@server:/usr/obj/usr/src/sys/server  amd64