Биллинговая система Nodeny

authorize_check_query = "SELECT NULL, 'test', 'Password', '123456', '=='"

authorize_check_query = "call radcheck('%{SQL-User-Name}')"
authorize_reply_query = "call radreply('%{SQL-User-Name}')"
accounting_update_query = "call radupdate('%{SQL-User-Name}')"
accounting_stop_query = "call radstop('%{SQL-User-Name}')"

gw2# /usr/local/sbin/radiusd -X
Starting - reading configuration files ...
reread_config:  reading radiusd.conf
Config:   including file: /usr/local/etc/raddb/proxy.conf
Config:   including file: /usr/local/etc/raddb/clients.conf
Config:   including file: /usr/local/etc/raddb/snmp.conf
Config:   including file: /usr/local/etc/raddb/eap.conf
Config:   including file: /usr/local/etc/raddb/sql.conf
 main: prefix = "/usr/local"
 main: localstatedir = "/var"
 main: logdir = "/var/log"
 main: libdir = "/usr/local/lib"
 main: radacctdir = "/var/log/radacct"
 main: hostname_lookups = no
 main: max_request_time = 30
 main: cleanup_delay = 5
 main: max_requests = 1024
 main: delete_blocked_requests = 0
 main: port = 0
 main: allow_core_dumps = no
 main: log_stripped_names = no
 main: log_file = "/var/log/radius.log"
 main: log_auth = no
 main: log_auth_badpass = no
 main: log_auth_goodpass = no
 main: pidfile = "/var/run/radiusd/radiusd.pid"
 main: user = "(null)"
 main: group = "(null)"
 main: usercollide = no
 main: lower_user = "no"
 main: lower_pass = "no"
 main: nospace_user = "no"
 main: nospace_pass = "no"
 main: checkrad = "/usr/local/sbin/checkrad"
 main: proxy_requests = yes
 proxy: retry_delay = 5
 proxy: retry_count = 3
 proxy: synchronous = no
 proxy: default_fallback = yes
 proxy: dead_time = 120
 proxy: post_proxy_authorize = no
 proxy: wake_all_if_all_dead = no
 security: max_attributes = 200
 security: reject_delay = 1
 security: status_server = no
 main: debug_level = 0
read_config_files:  reading dictionary
read_config_files:  reading naslist
Using deprecated naslist file.  Support for this will go away soon.
read_config_files:  reading clients
read_config_files:  reading realms
radiusd:  entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec 
 exec: wait = yes
 exec: program = "(null)"
 exec: input_pairs = "request"
 exec: output_pairs = "(null)"
 exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec) 
Module: Loaded expr 
Module: Instantiated expr (expr) 
Module: Loaded PAP 
 pap: encryption_scheme = "crypt"
 pap: auto_header = yes
Module: Instantiated pap (pap) 
Module: Loaded CHAP 
Module: Instantiated chap (chap) 
Module: Loaded MS-CHAP 
 mschap: use_mppe = yes
 mschap: require_encryption = no
 mschap: require_strong = no
 mschap: with_ntdomain_hack = no
 mschap: passwd = "(null)"
 mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap) 
Module: Loaded System 
 unix: cache = no
 unix: passwd = "(null)"
 unix: shadow = "(null)"
 unix: group = "(null)"
 unix: radwtmp = "/var/log/radwtmp"
 unix: usegroup = no
 unix: cache_reload = 600
Module: Instantiated unix (unix) 
Module: Loaded eap 
 eap: default_eap_type = "md5"
 eap: timer_expire = 60
 eap: ignore_unknown_eap_types = no
 eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
 gtc: challenge = "Password: "
 gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
 mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap) 
Module: Loaded preprocess 
 preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
 preprocess: hints = "/usr/local/etc/raddb/hints"
 preprocess: with_ascend_hack = no
 preprocess: ascend_channels_per_line = 23
 preprocess: with_ntdomain_hack = no
 preprocess: with_specialix_jetstream_hack = no
 preprocess: with_cisco_vsa_hack = no
 preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess) 
Module: Loaded realm 
 realm: format = "suffix"
 realm: delimiter = "@"
 realm: ignore_default = no
 realm: ignore_null = no
Module: Instantiated realm (suffix) 
Module: Loaded files 
 files: usersfile = "/usr/local/etc/raddb/users"
 files: acctusersfile = "/usr/local/etc/raddb/acct_users"
 files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
 files: compat = "no"
Module: Instantiated files (files) 
Module: Loaded SQL 
 sql: driver = "rlm_sql_mysql"
 sql: server = "localhost"
 sql: port = ""
 sql: login = "bill_kernel"
 sql: password = "hardpass4"
 sql: radius_db = "bill"
 sql: nas_table = "nas"
 sql: sqltrace = no
 sql: sqltracefile = "/var/log/sqltrace.sql"
 sql: readclients = no
 sql: deletestalesessions = yes
 sql: num_sql_socks = 5
 sql: sql_user_name = "%{User-Name}"
 sql: default_user_profile = ""
 sql: query_on_not_found = no
 sql: authorize_check_query = "call radcheck('%{SQL-User-Name}')"
 sql: authorize_reply_query = "call radreply('%{SQL-User-Name}')"
 sql: authorize_group_check_query = ""
 sql: authorize_group_reply_query = ""
 sql: accounting_onoff_query = ""
 sql: accounting_update_query = "call radupdate('%{SQL-User-Name}')"
 sql: accounting_update_query_alt = ""
 sql: accounting_start_query = ""
 sql: accounting_start_query_alt = ""
 sql: accounting_stop_query = "call radstop('%{SQL-User-Name}')"
 sql: accounting_stop_query_alt = ""
 sql: group_membership_query = ""
 sql: connect_failure_retry_delay = 60
 sql: simul_count_query = ""
 sql: simul_verify_query = ""
 sql: postauth_query = ""
 sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
rlm_sql (sql): Attempting to connect to bill_kernel@localhost:/bill
rlm_sql (sql): starting 0
rlm_sql (sql): Attempting to connect rlm_sql_mysql #0
rlm_sql_mysql: Starting connect to MySQL server for #0
rlm_sql (sql): Connected new DB handle, #0
rlm_sql (sql): starting 1
rlm_sql (sql): Attempting to connect rlm_sql_mysql #1
rlm_sql_mysql: Starting connect to MySQL server for #1
rlm_sql (sql): Connected new DB handle, #1
rlm_sql (sql): starting 2
rlm_sql (sql): Attempting to connect rlm_sql_mysql #2
rlm_sql_mysql: Starting connect to MySQL server for #2
rlm_sql (sql): Connected new DB handle, #2
rlm_sql (sql): starting 3
rlm_sql (sql): Attempting to connect rlm_sql_mysql #3
rlm_sql_mysql: Starting connect to MySQL server for #3
rlm_sql (sql): Connected new DB handle, #3
rlm_sql (sql): starting 4
rlm_sql (sql): Attempting to connect rlm_sql_mysql #4
rlm_sql_mysql: Starting connect to MySQL server for #4
rlm_sql (sql): Connected new DB handle, #4
Module: Instantiated sql (sql) 
Module: Loaded Acct-Unique-Session-Id 
 acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique) 
Module: Loaded detail 
 detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d"
 detail: detailperm = 384
 detail: dirperm = 493
 detail: locking = no
Module: Instantiated detail (detail) 
Module: Loaded radutmp 
 radutmp: filename = "/var/log/radutmp"
 radutmp: username = "%{User-Name}"
 radutmp: case_sensitive = yes
 radutmp: check_with_nas = yes
 radutmp: perm = 384
 radutmp: callerid = yes
Module: Instantiated radutmp (radutmp) 
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1:63509, id=145, length=60
	User-Name = "notebook"
	User-Password = "ljcneg"
	NAS-IP-Address = 255.255.255.255
	NAS-Port = 0
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
  modcall[authorize]: module "preprocess" returns ok for request 0
  modcall[authorize]: module "chap" returns noop for request 0
  modcall[authorize]: module "mschap" returns noop for request 0
    rlm_realm: No '@' in User-Name = "notebook", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 0
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 0
  modcall[authorize]: module "files" returns notfound for request 0
radius_xlat:  'notebook'
rlm_sql (sql): sql_set_user escaped user --> 'notebook'
radius_xlat:  'call radcheck('notebook')'
rlm_sql (sql): Reserving sql socket id: 4
rlm_sql_mysql: MYSQL check_error: 1305 received
rlm_sql_getvpdata: database query error
rlm_sql (sql): SQL query error; rejecting user
rlm_sql (sql): Released sql socket id: 4
  modcall[authorize]: module "sql" returns fail for request 0
modcall: leaving group authorize (returns fail) for request 0
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 127.0.0.1:63509, id=145, length=60
Discarding duplicate request from client NoDenyDB:63509 - ID: 145
--- Walking the entire request list ---
Waking up in 3 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 145 with timestamp 4b926fd6
Nothing to do.  Sleeping until we see a request.
rad_recv: Access-Request packet from host 127.0.0.1:63509, id=145, length=60
	User-Name = "notebook"
	User-Password = "ljcneg"
	NAS-IP-Address = 255.255.255.255
	NAS-Port = 0
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
  modcall[authorize]: module "preprocess" returns ok for request 1
  modcall[authorize]: module "chap" returns noop for request 1
  modcall[authorize]: module "mschap" returns noop for request 1
    rlm_realm: No '@' in User-Name = "notebook", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 1
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 1
  modcall[authorize]: module "files" returns notfound for request 1
radius_xlat:  'notebook'
rlm_sql (sql): sql_set_user escaped user --> 'notebook'
radius_xlat:  'call radcheck('notebook')'
rlm_sql (sql): Reserving sql socket id: 3
rlm_sql_mysql: MYSQL check_error: 1305 received
rlm_sql_getvpdata: database query error
rlm_sql (sql): SQL query error; rejecting user
rlm_sql (sql): Released sql socket id: 3
  modcall[authorize]: module "sql" returns fail for request 1
modcall: leaving group authorize (returns fail) for request 1
Finished request 1
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 127.0.0.1:63509, id=145, length=60
Discarding duplicate request from client NoDenyDB:63509 - ID: 145
--- Walking the entire request list ---
Waking up in 3 seconds...
--- Walking the entire request list ---
Cleaning up request 1 ID 145 with timestamp 4b926fdc
Nothing to do.  Sleeping until we see a request.
rad_recv: Access-Request packet from host 127.0.0.1:63509, id=145, length=60
	User-Name = "notebook"
	User-Password = "ljcneg"
	NAS-IP-Address = 255.255.255.255
	NAS-Port = 0
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
  modcall[authorize]: module "preprocess" returns ok for request 2
  modcall[authorize]: module "chap" returns noop for request 2
  modcall[authorize]: module "mschap" returns noop for request 2
    rlm_realm: No '@' in User-Name = "notebook", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 2
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 2
  modcall[authorize]: module "files" returns notfound for request 2
radius_xlat:  'notebook'
rlm_sql (sql): sql_set_user escaped user --> 'notebook'
radius_xlat:  'call radcheck('notebook')'
rlm_sql (sql): Reserving sql socket id: 2
rlm_sql_mysql: MYSQL check_error: 1305 received
rlm_sql_getvpdata: database query error
rlm_sql (sql): SQL query error; rejecting user
rlm_sql (sql): Released sql socket id: 2
  modcall[authorize]: module "sql" returns fail for request 2
modcall: leaving group authorize (returns fail) for request 2
Finished request 2
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 127.0.0.1:63509, id=145, length=60
Discarding duplicate request from client NoDenyDB:63509 - ID: 145
--- Walking the entire request list ---
Waking up in 3 seconds...
--- Walking the entire request list ---
Cleaning up request 2 ID 145 with timestamp 4b926fe2
Nothing to do.  Sleeping until we see a request.
rad_recv: Access-Request packet from host 127.0.0.1:63509, id=145, length=60
	User-Name = "notebook"
	User-Password = "ljcneg"
	NAS-IP-Address = 255.255.255.255
	NAS-Port = 0
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 3
  modcall[authorize]: module "preprocess" returns ok for request 3
  modcall[authorize]: module "chap" returns noop for request 3
  modcall[authorize]: module "mschap" returns noop for request 3
    rlm_realm: No '@' in User-Name = "notebook", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 3
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 3
  modcall[authorize]: module "files" returns notfound for request 3
radius_xlat:  'notebook'
rlm_sql (sql): sql_set_user escaped user --> 'notebook'
radius_xlat:  'call radcheck('notebook')'
rlm_sql (sql): Reserving sql socket id: 1
rlm_sql_mysql: MYSQL check_error: 1305 received
rlm_sql_getvpdata: database query error
rlm_sql (sql): SQL query error; rejecting user
rlm_sql (sql): Released sql socket id: 1
  modcall[authorize]: module "sql" returns fail for request 3
modcall: leaving group authorize (returns fail) for request 3
Finished request 3
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 127.0.0.1:63509, id=145, length=60
Discarding duplicate request from client NoDenyDB:63509 - ID: 145
--- Walking the entire request list ---
Waking up in 3 seconds...
--- Walking the entire request list ---
Cleaning up request 3 ID 145 with timestamp 4b926fe8
Nothing to do.  Sleeping until we see a request.
rad_recv: Access-Request packet from host 127.0.0.1:63509, id=145, length=60
	User-Name = "notebook"
	User-Password = "ljcneg"
	NAS-IP-Address = 255.255.255.255
	NAS-Port = 0
  Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 4
  modcall[authorize]: module "preprocess" returns ok for request 4
  modcall[authorize]: module "chap" returns noop for request 4
  modcall[authorize]: module "mschap" returns noop for request 4
    rlm_realm: No '@' in User-Name = "notebook", looking up realm NULL
    rlm_realm: No such realm "NULL"
  modcall[authorize]: module "suffix" returns noop for request 4
  rlm_eap: No EAP-Message, not doing EAP
  modcall[authorize]: module "eap" returns noop for request 4
  modcall[authorize]: module "files" returns notfound for request 4
radius_xlat:  'notebook'
rlm_sql (sql): sql_set_user escaped user --> 'notebook'
radius_xlat:  'call radcheck('notebook')'
rlm_sql (sql): Reserving sql socket id: 0
rlm_sql_mysql: MYSQL check_error: 1305 received
rlm_sql_getvpdata: database query error
rlm_sql (sql): SQL query error; rejecting user
rlm_sql (sql): Released sql socket id: 0
  modcall[authorize]: module "sql" returns fail for request 4
modcall: leaving group authorize (returns fail) for request 4
Finished request 4
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
rad_recv: Access-Request packet from host 127.0.0.1:63509, id=145, length=60
Discarding duplicate request from client NoDenyDB:63509 - ID: 145
--- Walking the entire request list ---
Waking up in 3 seconds...
--- Walking the entire request list ---
Cleaning up request 4 ID 145 with timestamp 4b926fee
Nothing to do.  Sleeping until we see a request.

# mysql -pпарльру рута
> use bill;
> call radcheck('username');

mysql> call radcheck('notebook');
ERROR 1305 (42000): PROCEDURE bill.radcheck does not exist
mysql> call radcheck('igor');
ERROR 1305 (42000): PROCEDURE bill.radcheck does not exist
mysql>

я вобще не советую использовать phpmyadmin для создания таблиц, процедур.....

mysql> call radcheck('igor');
ERROR 1267 (HY000): Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (cp1251_general_ci,IMPLICIT) for operation '='
mysql> call radcheck('notebook');
ERROR 1267 (HY000): Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (cp1251_general_ci,IMPLICIT) for operation '='

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 339
Server version: 5.0.90-log FreeBSD port: mysql-server-5.0.90

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> use bill;
Database changed
mysql> call radcheck('vasya');
+----+-------+-----------+-------+----+
| id | name  | Attribute | Value | == |
+----+-------+-----------+-------+----+
|  1 | vasya | Password  | 12345 | == |
+----+-------+-----------+-------+----+
1 row in set (0.04 sec)

Query OK, 0 rows affected (0.04 sec)

mysql> quit
Bye
[root@nodenydemo1 ~/nodeny]# cat /etc/my.cnf | grep 1251
default-character-set=cp1251
character-set-server=cp1251
collation-server=cp1251_general_ci
init-connect="SET NAMES cp1251"

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 785
Server version: 5.0.67 FreeBSD port: mysql-server-5.0.67_1

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> use bill;
Database changed
mysql> call radcheck('igor');
ERROR 1267 (HY000): Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (cp1251_general_ci,IMPLICIT) for operation '='
mysql> quit
Bye
gw2# cat /etc/my.cnf | grep 1251
default-character-set=cp1251
character-set-server=cp1251
collation-server=cp1251_general_ci
init-connect="SET NAMES cp1251"

call radcheck('igor');
ERROR 1267 (HY000): Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (cp1251_general_ci,IMPLICIT) for operation '='

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 219
Server version: 5.0.67 FreeBSD port: mysql-server-5.0.67_1

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> use bill;
Database changed
mysql> call radcheck('igor');
+----+------+-----------+---------+----+
| id | name | Attribute | Value   | == |
+----+------+-----------+---------+----+
| 27 | igor | Password  | 1104133 | == | 
+----+------+-----------+---------+----+
1 row in set (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

ng1: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1480
	inet 10.7.7.2 --> 10.7.7.20 netmask 0xffffffff 

startup:
    set user admin hardpass6
    set console self 127.0.0.1 5005
    set console open
    set web self 193.108.2*.1** 5006
    set web open
##
default:
    load dialup
    load pptp_server
    load pppoe_server

dialup:
    create bundle static B1
    set iface route default
    set iface idle 0
    set iface session 0
    set iface enable tcpmssfix
    set ipcp ranges 0.0.0.0/0 0.0.0.0/0
    set ipcp enable req-pri-dns
    set ipcp enable req-sec-dns

    create link static L1 pppoe
    set link action bundle B1
    set link yes report-mac
    set auth authname "login"
    set auth password "pass"
    set link max-redial 0
    set link mtu 1492
    set link keep-alive 20 75
    set pppoe iface sk0
    set pppoe service "*"
    set link disable incoming
    open
#   
pptp_server:
    set ippool add poolsat 10.7.7.253 10.7.7.254
    create bundle template B
    set iface enable proxy-arp
    set iface idle 0
    set iface enable tcpmssfix
    set ipcp yes vjcomp
    set ipcp ranges 10.7.7.2/32 ippool poolsat
    set ipcp dns 10.7.7.2
    
    set bundle enable compression
    set ccp yes mppc
    set mppc yes compress e40 e56 e128 stateless
    
    create link template L pptp
    set link enable multilink
    set link yes acfcomp protocomp

    set link action bundle B
    set link no pap chap
    set link enable chap
    set link enable chap-msv1
    set link enable chap-msv2
    set link mtu 1460
    set link keep-alive 10 75
    
    set pptp self 193.108.2**.1**
    set link enable incoming
#
pppoe_server:

        create bundle template B
        set ipcp ranges 193.108.2**.1**/32 127.0.0.2/32
        set ipcp dns 10.7.7.2
	set ccp yes mppc
        set mppc yes e40
	set mppc yes e56
	set mppc yes e128
	set mppc yes stateless
	set ecp disable dese-bis dese-old

        create link template common pppoe
        set link enable multilink
        set link action bundle B
        set link disable chap pap eap
        set link enable pap
        load radius
        set pppoe service "*"

        create link template sk1 common
        set link max-children 1000
        set pppoe iface sk1
        set link enable incoming
radius:
	set radius server localhost hardpass5 1812 1813
        set radius retries 3
	set radius timeout 3
	set radius me 127.0.0.1
	set auth acct-update 45
	set auth enable radius-auth
	set auth enable radius-acct
	set radius enable message-authentic

netstat -r -n
ifconfig
sysctl -a net
cat /etc/pf.conf

gw2# netstat -r -n
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            193.108.248.19     UGS         0  2679757    ng0
10.7.7.0           ff:ff:ff:ff:ff:ff  UHLWb       1        3    sk1 =>
10.7.7.0/24        link#3             UC          0        0    sk1
10.7.7.2           00:1e:58:49:55:b7  UHLW        1     1103    lo0
10.7.7.16          00:15:6d:d6:fd:88  UHLW        1    12864    sk1    797
10.7.7.20          00:15:6d:ab:8b:50  UHLW        1  2019996    sk1    608
10.7.7.25          00:15:6d:a9:ed:02  UHLW        1    99201    sk1   1090
10.7.7.30          00:15:6d:ad:f5:33  UHLW        1    67515    sk1    445
10.7.7.31          00:1c:f0:d5:f2:58  UHLW        1      120    sk1     37
10.7.7.37          00:01:6c:f7:34:c2  UHLW        1    44228    sk1    448
10.7.7.39          00:18:f3:fe:ec:97  UHLW        1   117850    sk1    450
10.7.7.41          00:c0:26:a8:f2:cb  UHLW        1      689    sk1    471
10.7.7.43          00:15:6d:a9:ed:0b  UHLW        1     1628    sk1    337
10.7.7.45          00:15:6d:a9:ed:0b  UHLW        1   299232    sk1   1136
10.7.7.46          00:15:6d:a9:ed:0b  UHLW        1      130    sk1    517
10.7.7.47          00:15:6d:a9:ed:0b  UHLW        1        8    sk1   1111
10.7.7.48          00:15:6d:a9:ed:0b  UHLW        1     2010    sk1   1193
10.7.7.52          00:15:6d:a9:ed:0b  UHLW        1    21640    sk1    689
10.7.7.53          00:15:6d:a9:25:23  UHLW        1    20509    sk1   1081
10.7.7.55          00:1b:fc:72:40:fe  UHLW        1    19919    sk1    451
10.7.7.56          00:15:6d:e8:e9:63  UHLW        1    99786    sk1    464
10.7.7.57          00:15:6d:a9:ed:0b  UHLW        1    86195    sk1    933
10.7.7.58          00:15:6d:d6:fd:5d  UHLW        1      340    sk1    457
10.7.7.69          00:15:6d:ad:a3:98  UHLW        1    10888    sk1    446
10.7.7.71          00:15:6d:ad:a3:66  UHLW        1   125819    sk1   1092
10.7.7.80          00:15:6d:e8:e9:f6  UHLW        1     1200    sk1    451
10.7.7.82          00:15:6d:d6:fe:83  UHLW        1       56    sk1    517
10.7.7.83          00:15:6d:d6:fe:80  UHLW        1   185833    sk1    446
10.7.7.84          00:15:6d:d6:fe:11  UHLW        1    31584    sk1    457
10.7.7.85          00:15:6d:a9:ed:0b  UHLW        1      401    sk1   1139
10.7.7.86          00:15:6d:ad:fa:6c  UHLW        1      535    sk1    455
10.7.7.96          00:15:6d:dc:12:97  UHLW        1    12158    sk1   1105
10.7.7.153         00:15:6d:a9:25:23  UHLW        1     3985    sk1    802
10.7.77.0/24       link#3             UC          0        0    sk1
10.7.77.7          00:0c:42:36:3b:f7  UHLW        1    15689    sk1   1186
10.7.78.0/24       link#1             UC          0        0    sk0
10.7.78.10         00:0c:42:24:2c:ae  UHLW        1     2742    sk0   1156
10.7.78.11         00:0c:42:4c:d8:08  UHLW        1     2883    sk0    984
10.200.1.0/24      link#3             UC          0        0    sk1
10.200.1.1         00:15:6d:a9:ed:0b  UHLW        1      795    sk1    457
10.200.1.2         00:15:6d:a9:ed:0b  UHLW        1     3203    sk1    456
127.0.0.1          127.0.0.1          UH          0     2910    lo0
193.108.248.19     193.108.249.***    UH          1        0    ng0

gw2# ifconfig 
sk0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=b<RXCSUM,TXCSUM,VLAN_MTU>
	ether 00:13:d4:c9:f8:bb
	inet 10.7.78.2 netmask 0xffffff00 broadcast 10.7.78.255
	media: Ethernet autoselect (100baseTX <full-duplex>)
	status: active
vr0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=2808<VLAN_MTU,WOL_UCAST,WOL_MAGIC>
	ether 00:1c:f0:d5:f1:b3
	media: Ethernet autoselect (none)
	status: no carrier
sk1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=b<RXCSUM,TXCSUM,VLAN_MTU>
	ether 00:1e:58:49:55:b7
	inet 10.7.7.2 netmask 0xffffff00 broadcast 10.7.7.255
	inet 10.7.77.5 netmask 0xffffff00 broadcast 10.7.77.255
	inet 10.200.1.5 netmask 0xffffff00 broadcast 10.200.1.255
	media: Ethernet autoselect (100baseTX <full-duplex,flag0,flag1>)
	status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> metric 0 mtu 1500
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33204
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
	inet 127.0.0.1 netmask 0xff000000 
ng0: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1492
	inet 193.108.249.*** --> 193.108.248.19 netmask 0xffffffff 

gw2# sysctl -a net
net.local.stream.recvspace: 8192
net.local.stream.sendspace: 8192
net.local.dgram.recvspace: 4096
net.local.dgram.maxdgram: 2048
net.local.recycled: 0
net.local.taskcount: 0
net.local.inflight: 0
net.inet.ip.portrange.randomtime: 45
net.inet.ip.portrange.randomcps: 10
net.inet.ip.portrange.randomized: 1
net.inet.ip.portrange.reservedlow: 0
net.inet.ip.portrange.reservedhigh: 1023
net.inet.ip.portrange.hilast: 65535
net.inet.ip.portrange.hifirst: 49152
net.inet.ip.portrange.last: 65535
net.inet.ip.portrange.first: 49152
net.inet.ip.portrange.lowlast: 600
net.inet.ip.portrange.lowfirst: 1023
net.inet.ip.forwarding: 1
net.inet.ip.redirect: 1
net.inet.ip.ttl: 64
net.inet.ip.rtexpire: 3600
net.inet.ip.rtminexpire: 10
net.inet.ip.rtmaxcache: 128
net.inet.ip.sourceroute: 0
net.inet.ip.intr_queue_maxlen: 50
net.inet.ip.intr_queue_drops: 0
net.inet.ip.accept_sourceroute: 0
net.inet.ip.keepfaith: 0
net.inet.ip.gifttl: 30
net.inet.ip.same_prefix_carp_only: 0
net.inet.ip.subnets_are_local: 0
net.inet.ip.dummynet.debug: 0
net.inet.ip.dummynet.pipe_byte_limit: 1048576
net.inet.ip.dummynet.pipe_slot_limit: 100
net.inet.ip.dummynet.io_pkt_drop: 22899
net.inet.ip.dummynet.io_pkt_fast: 291897
net.inet.ip.dummynet.io_pkt: 3562597
net.inet.ip.dummynet.io_fast: 0
net.inet.ip.dummynet.tick_lost: 0
net.inet.ip.dummynet.tick_diff: 13578
net.inet.ip.dummynet.tick_adjustment: 6837
net.inet.ip.dummynet.tick_delta_sum: 591
net.inet.ip.dummynet.tick_delta: -1
net.inet.ip.dummynet.red_max_pkt_size: 1500
net.inet.ip.dummynet.red_avg_pkt_size: 512
net.inet.ip.dummynet.red_lookup_depth: 256
net.inet.ip.dummynet.max_chain_len: 16
net.inet.ip.dummynet.expire: 1
net.inet.ip.dummynet.search_steps: 0
net.inet.ip.dummynet.searches: 0
net.inet.ip.dummynet.extract_heap: 0
net.inet.ip.dummynet.ready_heap: 16
net.inet.ip.dummynet.curr_time: 3421195
net.inet.ip.dummynet.hash_size: 64
net.inet.ip.fastforwarding: 0
net.inet.ip.fw.dyn_keepalive: 1
net.inet.ip.fw.dyn_short_lifetime: 5
net.inet.ip.fw.dyn_udp_lifetime: 10
net.inet.ip.fw.dyn_rst_lifetime: 1
net.inet.ip.fw.dyn_fin_lifetime: 1
net.inet.ip.fw.dyn_syn_lifetime: 20
net.inet.ip.fw.dyn_ack_lifetime: 300
net.inet.ip.fw.static_count: 59
net.inet.ip.fw.dyn_max: 4096
net.inet.ip.fw.dyn_count: 126
net.inet.ip.fw.curr_dyn_buckets: 256
net.inet.ip.fw.dyn_buckets: 256
net.inet.ip.fw.default_rule: 65535
net.inet.ip.fw.verbose_limit: 0
net.inet.ip.fw.verbose: 1
net.inet.ip.fw.debug: 1
net.inet.ip.fw.one_pass: 1
net.inet.ip.fw.autoinc_step: 100
net.inet.ip.fw.enable: 1
net.inet.ip.maxfragpackets: 800
net.inet.ip.maxfragsperpacket: 16
net.inet.ip.fragpackets: 0
net.inet.ip.check_interface: 0
net.inet.ip.random_id: 0
net.inet.ip.sendsourcequench: 0
net.inet.ip.process_options: 1
net.inet.icmp.maskrepl: 0
net.inet.icmp.icmplim: 200
net.inet.icmp.bmcastecho: 0
net.inet.icmp.quotelen: 8
net.inet.icmp.reply_from_interface: 0
net.inet.icmp.reply_src: 
net.inet.icmp.icmplim_output: 1
net.inet.icmp.log_redirect: 0
net.inet.icmp.drop_redirect: 0
net.inet.icmp.maskfake: 0
net.inet.tcp.rfc1323: 1
net.inet.tcp.mssdflt: 512
net.inet.tcp.keepidle: 7200000
net.inet.tcp.keepintvl: 75000
net.inet.tcp.sendspace: 32768
net.inet.tcp.recvspace: 65536
net.inet.tcp.keepinit: 75000
net.inet.tcp.delacktime: 100
net.inet.tcp.hostcache.purge: 0
net.inet.tcp.hostcache.prune: 300
net.inet.tcp.hostcache.expire: 3600
net.inet.tcp.hostcache.count: 7
net.inet.tcp.hostcache.bucketlimit: 30
net.inet.tcp.hostcache.hashsize: 512
net.inet.tcp.hostcache.cachelimit: 15360
net.inet.tcp.recvbuf_max: 262144
net.inet.tcp.recvbuf_inc: 16384
net.inet.tcp.recvbuf_auto: 1
net.inet.tcp.insecure_rst: 0
net.inet.tcp.rfc3390: 1
net.inet.tcp.rfc3042: 1
net.inet.tcp.drop_synfin: 0
net.inet.tcp.delayed_ack: 1
net.inet.tcp.blackhole: 0
net.inet.tcp.log_in_vain: 0
net.inet.tcp.sendbuf_max: 262144
net.inet.tcp.sendbuf_inc: 8192
net.inet.tcp.sendbuf_auto: 1
net.inet.tcp.tso: 1
net.inet.tcp.newreno: 1
net.inet.tcp.local_slowstart_flightsize: 4
net.inet.tcp.slowstart_flightsize: 1
net.inet.tcp.path_mtu_discovery: 1
net.inet.tcp.reass.overflows: 0
net.inet.tcp.reass.maxqlen: 48
net.inet.tcp.reass.cursegments: 0
net.inet.tcp.reass.maxsegments: 1600
net.inet.tcp.sack.globalholes: 0
net.inet.tcp.sack.globalmaxholes: 65536
net.inet.tcp.sack.maxholes: 128
net.inet.tcp.sack.enable: 1
net.inet.tcp.inflight.stab: 20
net.inet.tcp.inflight.max: 1073725440
net.inet.tcp.inflight.min: 6144
net.inet.tcp.inflight.rttthresh: 10
net.inet.tcp.inflight.debug: 0
net.inet.tcp.inflight.enable: 1
net.inet.tcp.isn_reseed_interval: 0
net.inet.tcp.icmp_may_rst: 1
net.inet.tcp.pcbcount: 18
net.inet.tcp.do_tcpdrain: 1
net.inet.tcp.tcbhashsize: 512
net.inet.tcp.log_debug: 0
net.inet.tcp.minmss: 216
net.inet.tcp.syncache.rst_on_sock_fail: 1
net.inet.tcp.syncache.rexmtlimit: 3
net.inet.tcp.syncache.hashsize: 512
net.inet.tcp.syncache.count: 0
net.inet.tcp.syncache.cachelimit: 15360
net.inet.tcp.syncache.bucketlimit: 30
net.inet.tcp.syncookies_only: 0
net.inet.tcp.syncookies: 1
net.inet.tcp.timer_race: 0
net.inet.tcp.finwait2_timeout: 60000
net.inet.tcp.fast_finwait2_recycle: 0
net.inet.tcp.always_keepalive: 1
net.inet.tcp.rexmit_slop: 200
net.inet.tcp.rexmit_min: 30
net.inet.tcp.msl: 30000
net.inet.tcp.nolocaltimewait: 0
net.inet.tcp.maxtcptw: 2465
net.inet.udp.checksum: 1
net.inet.udp.maxdgram: 9216
net.inet.udp.recvspace: 41600
net.inet.udp.soreceive_dgram_enabled: 0
net.inet.udp.blackhole: 0
net.inet.udp.log_in_vain: 0
net.inet.sctp.enable_sack_immediately: 0
net.inet.sctp.udp_tunneling_port: 0
net.inet.sctp.udp_tunneling_for_client_enable: 0
net.inet.sctp.mobility_fasthandoff: 0
net.inet.sctp.mobility_base: 0
net.inet.sctp.default_frag_interleave: 1
net.inet.sctp.default_cc_module: 0
net.inet.sctp.log_level: 0
net.inet.sctp.max_retran_chunk: 30
net.inet.sctp.min_residual: 1452
net.inet.sctp.strict_data_order: 0
net.inet.sctp.abort_at_limit: 0
net.inet.sctp.hb_max_burst: 4
net.inet.sctp.do_sctp_drain: 1
net.inet.sctp.max_chained_mbufs: 5
net.inet.sctp.abc_l_var: 1
net.inet.sctp.nat_friendly: 1
net.inet.sctp.auth_disable: 0
net.inet.sctp.asconf_auth_nochk: 0
net.inet.sctp.early_fast_retran_msec: 250
net.inet.sctp.early_fast_retran: 0
net.inet.sctp.cwnd_maxburst: 1
net.inet.sctp.cmt_pf: 0
net.inet.sctp.cmt_use_dac: 0
net.inet.sctp.cmt_on_off: 0
net.inet.sctp.outgoing_streams: 10
net.inet.sctp.add_more_on_output: 1452
net.inet.sctp.path_rtx_max: 5
net.inet.sctp.assoc_rtx_max: 10
net.inet.sctp.init_rtx_max: 8
net.inet.sctp.valid_cookie_life: 60000
net.inet.sctp.init_rto_max: 60000
net.inet.sctp.rto_initial: 3000
net.inet.sctp.rto_min: 1000
net.inet.sctp.rto_max: 60000
net.inet.sctp.secret_lifetime: 3600
net.inet.sctp.shutdown_guard_time: 180
net.inet.sctp.pmtu_raise_time: 600
net.inet.sctp.heartbeat_interval: 30000
net.inet.sctp.asoc_resource: 10
net.inet.sctp.sys_resource: 1000
net.inet.sctp.sack_freq: 2
net.inet.sctp.delayed_sack_time: 200
net.inet.sctp.chunkscale: 10
net.inet.sctp.min_split_point: 2904
net.inet.sctp.pcbhashsize: 256
net.inet.sctp.tcbhashsize: 1024
net.inet.sctp.maxchunks: 3200
net.inet.sctp.maxburst: 4
net.inet.sctp.peer_chkoh: 256
net.inet.sctp.strict_init: 1
net.inet.sctp.loopback_nocsum: 1
net.inet.sctp.strict_sacks: 0
net.inet.sctp.ecn_nonce: 0
net.inet.sctp.ecn_enable: 1
net.inet.sctp.auto_asconf: 1
net.inet.sctp.recvspace: 233016
net.inet.sctp.sendspace: 233016
net.inet.raw.recvspace: 9216
net.inet.raw.maxdgram: 9216
net.inet.accf.unloadable: 0
net.inet.accf.http.parsehttpversion: 1
net.link.generic.system.ifcount: 7
net.link.ether.inet.log_arp_permanent_modify: 1
net.link.ether.inet.log_arp_movements: 0
net.link.ether.inet.log_arp_wrong_iface: 1
net.link.ether.inet.proxyall: 0
net.link.ether.inet.useloopback: 1
net.link.ether.inet.maxtries: 5
net.link.ether.inet.max_age: 1200
net.link.ether.ipfw: 0
net.link.gif.parallel_tunnels: 0
net.link.gif.max_nesting: 1
net.link.log_link_state_change: 1
net.link.tun.devfs_cloning: 1
net.bpf.maxinsns: 512
net.bpf.maxbufsize: 524288
net.bpf.bufsize: 4096
net.isr.swi_count: 13464
net.isr.drop: 0
net.isr.queued: 14124
net.isr.deferred: 0
net.isr.directed: 6999140
net.isr.count: 6999140
net.isr.direct: 1
net.raw.recvspace: 8192
net.raw.sendspace: 8192
net.my_fibnum: 0
net.add_addr_allfibs: 1
net.fibs: 1
net.route.netisr_maxqlen: 256
net.graph.msg_version: 8
net.graph.abi_version: 11
net.graph.maxdata: 512
net.graph.maxalloc: 4096
net.graph.control.proto: 2
net.graph.data.proto: 1
net.graph.family: 32
net.graph.recvspace: 20480
net.graph.maxdgram: 20480

cat /etc/pf.conf 
set limit states 128000
set optimization aggressive
nat pass on ng0 from 10.7.7.0/24 to any -> ng0
rdr on sk0 proto tcp from any to any port 1723 -> 193.108.249.*** port 1723
rdr on sk0 proto gre from any to any -> 193.108.249.***

193.108.248.19     193.108.249.***

193.108.248.19     193.108.249.***

PPP adapter Високошвидк?сне п?дключення:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Високошвидк?сне п?дключення
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Autoconfiguration IPv4 Address. . : 169.254.0.31(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 0.0.0.0
DNS Servers . . . . . . . . . . . : 10.7.7.2
NetBIOS over Tcpip. . . . . . . . : Disabled

Ethernet adapter П?дключення через локальну мережу:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Atheros AR8121/AR8113/AR8114 PCI-E Eth
et Controller(NDIS6.20)
Physical Address. . . . . . . . . : 00-22-15-75-4F-08
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::e5ec:a992:5f51:e95a%11(Preferred
IPv4 Address. . . . . . . . . . . : 10.7.7.20(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.7.7.2
DHCPv6 IAID . . . . . . . . . . . : 234889749
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-94-64-66-00-22-15-75-4F

DNS Servers . . . . . . . . . . . : 10.7.7.2
NetBIOS over Tcpip. . . . . . . . : Enabled

Interface List
31...........................Високошвидк 14...00 06 4f 7a 4d 98 ......Realtek R
TL8139/810x Family Fast Ethernet NIC
11...00 22 15 75 4f 08 ......Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Contro
ller(NDIS6.20)
1...........................Software Loopback Interface 1
12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
21...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
23...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.7.7.2 10.7.7.20 4501
0.0.0.0 0.0.0.0 On-link 169.254.0.31 21
10.7.7.0 255.255.255.0 On-link 10.7.7.20 4501
10.7.7.20 255.255.255.255 On-link 10.7.7.20 4501
10.7.7.255 255.255.255.255 On-link 10.7.7.20 4501
127.0.0.0 255.0.0.0 On-link 127.0.0.1 4531
127.0.0.1 255.255.255.255 On-link 127.0.0.1 4531
127.255.255.255 255.255.255.255 On-link 127.0.0.1 4531
169.254.0.0 255.255.0.0 On-link 169.254.0.31 276
169.254.0.31 255.255.255.255 On-link 169.254.0.31 276
169.254.255.255 255.255.255.255 On-link 169.254.0.31 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 4531
224.0.0.0 240.0.0.0 On-link 10.7.7.20 4498
255.255.255.255 255.255.255.255 On-link 127.0.0.1 4531
255.255.255.255 255.255.255.255 On-link 10.7.7.20 4501
255.255.255.255 255.255.255.255 On-link 169.254.0.31 276
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.7.7.2 Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
11 276 fe80::/64 On-link
11 276 fe80::e5ec:a992:5f51:e95a/128
On-link
1 306 ff00::/8 On-link
11 276 ff00::/8 On-link
===========================================================================
Persistent Routes:
None 

set ipcp ranges 10.7.7.2/32 127.0.0.2/32

gw2# ifconfig
sk0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=b<RXCSUM,TXCSUM,VLAN_MTU>
	ether 00:13:d4:c9:f8:bb
	inet 10.7.78.2 netmask 0xffffff00 broadcast 10.7.78.255
	media: Ethernet autoselect (100baseTX <full-duplex>)
	status: active
vr0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=2808<VLAN_MTU,WOL_UCAST,WOL_MAGIC>
	ether 00:1c:f0:d5:f1:b3
	media: Ethernet autoselect (none)
	status: no carrier
sk1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=b<RXCSUM,TXCSUM,VLAN_MTU>
	ether 00:1e:58:49:55:b7
	inet 10.7.7.2 netmask 0xffffff00 broadcast 10.7.7.255
	inet 10.7.77.5 netmask 0xffffff00 broadcast 10.7.77.255
	inet 10.200.1.5 netmask 0xffffff00 broadcast 10.200.1.255
	media: Ethernet autoselect (100baseTX <full-duplex,flag0,flag1>)
	status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> metric 0 mtu 1500
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33204
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
	inet 127.0.0.1 netmask 0xff000000 
ng0: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1492
	inet 193.108.249.*** --> 193.108.248.19 netmask 0xffffffff 
ng1: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1480
	inet 10.7.7.2 --> 10.7.7.20 netmask 0xffffffff

net.link.ether.inet.proxyall