Биллинговая система Nodeny

#!/bin/sh -
f='/sbin/ipfw'

ifOut='nfe0'

# Сети, в/из которых трафик блокируем
${f} table 120 flush
${f} table 120 add 224.0.0.0/4
${f} table 120 add 192.168.0.0/16
${f} table 120 add 172.16.0.0/12

${f} -f flush

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any

${f} add 100 deny tcp from any to any 445

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 140 deny ip from any to "table(120)"
${f} add 150 deny ip from "table(120)" to any
${f} add 160 skipto 2000 ip from any to me

${f} add 200 skipto 500 ip from any to any via ${ifOut}

${f} add 300 skipto 4500 ip from any to any in

${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any

${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2030 allow gre from any to any
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723


${f} add 2100 deny ip from any to any


${f} add 32490 deny ip from any to any

capture-ports enable;
interface divert port 1 netflow-disable;
interface divert port 2 netflow-disable;
rsh enable at 127.0.0.1;
rsh root@127.0.0.1 admin;
rsh ttl = 3;
rsh timeout = 30;
dumpfile = ipcad.dump;
chroot = /tmp;
memory_limit = 50m;

nfe0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 00:10:dc:a8:a2:1b
        inet 192.168.111.1 netmask 0xffffff00 broadcast 192.168.111.255
        media: Ethernet autoselect (none)
        status: no carrier
em0: flags=9843<UP,BROADCAST,RUNNING,SIMPLEX,LINK0,MULTICAST> metric 0 mtu 1500
        options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
        ether 00:07:e9:0c:49:48
        inet 192.168.1.10 netmask 0xffffff00 broadcast 192.168.1.255
        media: Ethernet autoselect (1000baseTX <full-duplex>)
        status: active
em1: flags=9843<UP,BROADCAST,RUNNING,SIMPLEX,LINK0,MULTICAST> metric 0 mtu 1500
        options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
        ether 00:07:e9:0c:55:d9
        inet 192.168.0.100 netmask 0xffffff00 broadcast 192.168.0.255
        media: Ethernet autoselect (1000baseTX <full-duplex>)
        status: active
fxp0: flags=9843<UP,BROADCAST,RUNNING,SIMPLEX,LINK0,MULTICAST> metric 0 mtu 1500
        options=2009<RXCSUM,VLAN_MTU,WOL_MAGIC>
        ether 00:90:27:65:25:6a
        inet 192.168.111.11 netmask 0xffffff00 broadcast 192.168.111.255
        media: Ethernet autoselect (none)
        status: no carrier
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> metric 0 mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
        inet6 ::1 prefixlen 128
        inet 127.0.0.1 netmask 0xff000000

00420         0            0 divert 1 ip from any to any
00450         0            0 divert 2 ip from any to any
00510         0            0 divert 1 ip from any to any

ifOut='nfe0'

status: no carrier

CREATE TABLE `traf_info` (
  `time` int(10) unsigned NOT NULL,
  `cod` mediumint(8) unsigned NOT NULL,
  `data1` text NOT NULL,
  KEY `time` (`time`)
) ENGINE=MyISAM DEFAULT CHARSET=cp1251

CREATE TABLE `traf_lost` (
  `mid` mediumint(9) NOT NULL default '0',
  `time` int(11) NOT NULL default '0',
  `in` int(10) unsigned NOT NULL default '0',
  `out` int(10) unsigned NOT NULL default '0',
  `ip` tinytext NOT NULL,
  KEY `mid` (`mid`),
  KEY `time` (`time`)
) ENGINE=MyISAM DEFAULT CHARSET=cp1251