Биллинговая система Nodeny

setfib -1 route add default 10.1.1.1  (шлюз 1 прова)
setfib -2 route add default 172.1.1.1 (шлюз 2 прова)
setfib -3 route add default 192.168.1.1 (шлюз 3 прова)
setfib -4 route add default 10.10.5.1 (дополнительная маршрутизация на пров. локалку )

#нат на 1 прова
nat pass on vr1 from 172.0.0.0/8 to any -> (vr1)
#нат на 2 прова
nat pass on vr2 from 172.0.0.0/8 to any -> (vr2)
#нат на 2 прова
nat pass on vr3 from 172.0.0.0/8 to any -> (vr3)

${f} add 200 skipto 500 ip from any to any via ${ifOut}
${f} add 200 skipto 500 ip from any to any via ${ifOur}
#${f} add 200 skipto 500 ip from any to any via ${ifTree}

${f} add 300 setfib 1 ip from 172.2.2.0/24 to not "table(30)" in
${f} add 310 setfib 2 ip from 172.3.3.0/24 to not "table(30)" in
${f} add 320 setfib 3 ip from 172.4.4.0/24 to not "table(30)" in
${f} add 330 setfib 4 ip from 172.0.0.0/8 to "table(30)" in
${f} add 350 skipto 4500 ip from any to any in

${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 400 skipto 450 ip from any to any recv ${ifOur}
#${f} add 400 skipto 450 ip from any to any recv ${ifTree}

${f} add 420 tee 1 ip from any to any
${f} add 450 tee 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 tee 1 ip from any to any
${f} add 540 allow ip from any to any


${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2050 deny ip from any to any via ${ifOur}
#${f} add 2050 deny ip from any to any via ${ifTree}

nat pass on vlan4 inet from <allusers> to any -> 10.11.10.202/31 source-hash sticky-address

ipfw table 41 list
172.2.2.4/32 0
172.2.2.7/32 0
172.2.2.10/32 0

ipfw table 42 list
172.2.2.6/32 0
172.2.2.9/32 0
172.2.2.12/32 0

ipfw add 300 setfib 1 ip from "table(41)" to not "table(30)" in
ipfw add 310 setfib 2 ip from "table(42)" to not "table(30)" in
ipfw add 320 setfib 3 ip from "table(43)" to not "table(30)" in

#!/bin/sh -
f='/sbin/ipfw'

ifOut='vr1'

${f} -f flush



${f} add 10 allow gre from any to any via vr0
${f} add 40 allow tcp from any to me 1723
${f} add 41 allow tcp from me 1723 to any

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me

${f} add 200 skipto 500 ip from any to any via ${ifOut}

${f} add 300 skipto 4500 ip from any to any in

${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any


${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723

${f} add 2100 deny ip from any to any

${f} add 32490 deny ip from any to any
${f} add 32490 deny ip from any to any