Печать страницы - Ядро работает, а traf

Ситуация:
захожу в статистуку через веб
Таблица traf_info, содержащая данные о ходе записи трафика, пуста. Проверьте запущено ли ядро NoDeny.
Ядро запущено, клиенты подключаются и "всегда онлайн" и через PPPoE.
Клиенты шейпятся и работат без проблем.
Клиентская статистика работает (показывает и трафик посуточно и поминутно).

Что может быть?

Код:

ipfw show | grep divert
00420       0          0 divert 1 ip from any to any
00450 5200659 5242843358 divert 2 ip from any to any
00510 3562183  392378113 divert 1 ip from any to any

Код:

# cat /etc/pf.conf
set limit states 128000
set optimization aggressive
#nat pass on igb1 from 10.0.0.0/8 to any -> igb1
nat pass on re0 from 10.0.0.0/8 to any -> re0
nat pass on vlan577 from 10.0.0.0/8 to any -> vlan577
nat pass on vlan578 from 10.0.0.0/8 to any -> vlan578

#FOR rsh
pass proto tcp from 194.x.x.1 to (self) port shell allow-opts
pass proto tcp from 194.x.x.1 to (self) port shell allow-opts

pass proto tcp from 217.x.x.2 to (self) port shell allow-opts
pass proto tcp from 217.x.x.3 to (self) port shell allow-opts

#nat pass on rl0 from 192.168.0.0/16 to any -> rl0

Код:

[# cat /usr/local/etc/ipcad.conf
#capture-ports enable;
capture-ports disable;
interface divert port 1 netflow-disable;
interface divert port 2 netflow-disable;
rsh enable at 127.0.0.1;
rsh root@127.0.0.1 admin;
rsh ttl = 10;
rsh timeout = 60;
dumpfile = ipcad.dump;
chroot = /tmp;
memory_limit = 50m;
/code]

[code]# cat /etc/rc.firewall                                                               
#!/bin/sh -                                                                                          
f='/sbin/ipfw'                                                                                       

ifOut='re0'
ifOut1='vlan577'
ifOut2='vlan578'

${f} -f flush

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any
${f} add 52 allow tcp from any to me 5006
${f} add 53 allow tcp from me 5006 to any
${f} add 54 allow tcp from any to me 3306
${f} add 55 allow tcp from me 3306 to any

${f} add 56 allow tcp from me 1812 to any
${f} add 57 allow tcp from any to me 1812
${f} add 58 allow tcp from me 1813 to any
${f} add 59 allow tcp from any to me 1813

${f} add 60 allow udp from me 1812 to any
${f} add 61 allow udp from any to me 1812
${f} add 62 allow udp from me 1813 to any
${f} add 63 allow udp from any to me 1813

${f} add 64 allow ip from 10.0.0.0/8 to me 53
${f} add 65 allow tcp from 194.x.x.1 to me 512-1023
${f} add 66 allow tcp from 194.x.x.2 to me 512-1023
${f} add 67 allow tcp from 217.x.x.2 to me 512-1023    
${f} add 68 allow tcp from 217.x.x.3 to me 512-1023    

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any   
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me                           

${f} add 201 skipto 500 ip from any to any via ${ifOut}
${f} add 202 skipto 500 ip from any to any via ${ifOut1}
${f} add 203 skipto 500 ip from any to any via ${ifOut2}

${f} add 300 skipto 4500 ip from any to any in

${f} add 401 skipto 450 ip from any to any recv ${ifOut}
${f} add 402 skipto 450 ip from any to any recv ${ifOut1}
${f} add 403 skipto 450 ip from any to any recv ${ifOut2}
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any


${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2051 deny ip from any to any via ${ifOut1}
${f} add 2052 deny ip from any to any via ${ifOut2}
${f} add 2060 allow udp from any to any 53,7723

${f} add 2100 deny ip from any to any

${f} add 32490 deny ip from any to any

Код:

# ifconfig 
igb0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=19b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4>
        ether 00:1b:21:55:ab:ec
        inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
igb1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=19b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4>
        ether 00:1b:21:55:ab:ed
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=389b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC>
        ether 00:26:18:d3:c5:5f
        inet 217.x.x.1 netmask 0xffffff00 broadcast 217.66.99.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
        inet6 ::1 prefixlen 128
        inet 127.0.0.1 netmask 0xff000000
vlan577: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=3<RXCSUM,TXCSUM>
        ether 00:1b:21:55:ab:ed
        inet 193.x.x.1 netmask 0xfffffffc broadcast 193.110.107.119
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        vlan: 577 parent interface: igb1
vlan578: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=3<RXCSUM,TXCSUM>
        ether 00:1b:21:55:ab:ed
        inet 193.x.x.2 netmask 0xfffffffc broadcast 193.110.107.123
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
        vlan: 578 parent interface: igb1

[/code]

Биллинговая система Nodeny

Главная категория => Курилка => Тема начата: a_eugene от 27 Февраля 2010, 17:20:31