Биллинговая система Nodeny

00050 allow tcp from any to me dst-port 22,23,1723
00051 allow tcp from me 22,23,1723 to any
00052 allow gre from any to any
00110 allow ip from any to any via lo0
00120 skipto 1000 ip from me to any
00130 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00160 skipto 2000 ip from any to me
00200 skipto 500 ip from any to any via ng0
00280 fwd 127.0.0.1,81 tcp from table(35) to not me dst-port 80
00290 fwd 127.0.0.1,8080 tcp from not table(0) to not me dst-port 80
00300 skipto 4500 ip from any to any in
00400 skipto 450 ip from any to any recv ng0
00420 divert 1 ip from any to any
00450 divert 2 ip from any to any
00490 allow ip from any to any
00500 skipto 32500 ip from any to any in
00510 divert 1 ip from any to any
00540 allow ip from any to any
01000 allow udp from any 53,7723 to any
01010 allow tcp from any to any setup keep-state
01020 allow udp from any to any keep-state
01100 allow ip from any to any
02000 check-state
02010 allow icmp from any to any
02020 allow tcp from any to any dst-port 80,443
02050 deny ip from any to any via ng0
02060 allow udp from any to any dst-port 53,7723
02065 allow ip from 10.7.7.253 to any
02065 allow ip from 10.7.7.20 to any
02066 allow ip from any to 10.7.7.253
02066 allow ip from any to 10.7.7.20
02100 deny ip from any to any
05000 deny ip from not table(0) to any
05001 skipto 5010 ip from table(127) to table(126)
05002 skipto 5030 ip from any to not table(2)
05003 deny ip from any to not table(1)
05004 pipe tablearg ip from table(21) to any
05005 deny ip from any to any
05010 pipe tablearg ip from table(127) to any
05030 deny tcp from table(15) to any dst-port 25,135,139,445
05132 allow ip from table(33) to table(32)
05400 pipe tablearg ip from table(11) to any
32000 deny ip from any to any
32490 deny ip from any to any
33000 pipe tablearg ip from table(126) to table(127)
33001 skipto 33010 ip from not table(2) to any
33002 pipe tablearg ip from any to table(20)
33003 deny ip from any to any
33132 allow ip from table(32) to table(33)
33400 pipe tablearg ip from any to table(10)
65535 deny ip from any to any

#!/bin/sh -
f='/sbin/ipfw'

ifOut='re0'

${f} -f flush

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me

${f} add 200 skipto 500 ip from any to any via ${ifOut}

${f} add 300 skipto 4500 ip from any to any in

${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any

${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723

${f} add 2100 deny ip from any to any

${f} add 4900 fwd 127.0.0.1,80 tcp from not 'table(0)' to any 80

${f} add 32490 deny ip from any to any

skipto 450 ip from any to any recv If_Out

allow tcp from any to not table(0) out via If_In