HIT
NoDeny
Пользователь
Карма: 0
 Offline
Сообщений: 9
|
 |
« : 22 Мая 2010, 02:29:39 » |
|
Исходящая при этом шейпится. # ipfw show
00050 317 23444 allow tcp from any to me dst-port 22
00051 292 45884 allow tcp from me 22 to any
00100 0 0 deny tcp from any to any dst-port 445
00110 1160 116448 allow ip from any to any via lo0
00120 30 1957 skipto 1000 ip from me to any
00130 0 0 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00140 0 0 deny ip from any to table(120)
00150 0 0 deny ip from table(120) to any
00160 1056 170891 skipto 2000 ip from any to me
00200 2363 881615 skipto 500 ip from any to any via re0
00300 2901 971917 skipto 4500 ip from any to any in
00400 0 0 skipto 450 ip from any to any recv re0
00420 0 0 divert 1 ip from any to any
00450 0 0 divert 2 ip from any to any
00490 0 0 allow ip from any to any
00500 7 777 skipto 32500 ip from any to any in
00510 2356 880838 divert 1 ip from any to any
00540 2343 880100 allow ip from any to any
01000 18 1186 allow udp from any 53,7723 to any
01010 0 0 allow tcp from any to any setup keep-state
01020 24 5196 allow udp from any to any keep-state
01100 0 0 allow ip from any to any
02000 0 0 check-state
02010 0 0 allow icmp from any to any
02020 0 0 allow tcp from any to any dst-port 80,443
02050 1026 165669 deny ip from any to any via re0
02060 18 797 allow udp from any to any dst-port 53,7723
02100 0 0 deny ip from any to any
05000 485 55398 deny ip from not table(0) to any
05001 0 0 skipto 5010 ip from table(127) to table(126)
05002 2335 906766 skipto 5030 ip from any to not table(2)
05003 0 0 deny ip from any to not table(1)
05004 0 0 pipe tablearg ip from table(21) to any
05005 0 0 deny ip from any to any
05010 0 0 pipe tablearg ip from table(127) to any
05030 0 0 deny tcp from table(15) to any dst-port 25
05400 2335 906766 pipe tablearg ip from table(11) to any
32000 0 0 deny ip from any to any
32490 8 731 deny ip from any to any
33000 0 0 pipe tablearg ip from table(126) to table(127)
33001 6 666 skipto 33010 ip from not table(2) to any
33002 0 0 pipe tablearg ip from any to table(20)
33003 0 0 deny ip from any to any
33400 0 0 pipe tablearg ip from any to table(10)
65535 7 777 deny ip from any to any
# ipfw pipe show
01004: 512.000 Kbit/s 0 ms 50 sl. 0 queues (1 buckets) droptail
burst: 0 Byte
00001: unlimited 0 ms 50 sl. 0 queues (1 buckets) droptail
burst: 0 Byte
01008: 512.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 1.2.1.2/1319 74.125.87.105/80 2754 971313 0 0 33
# ipfw table 11 list
1.2.1.2/32 1008
1.2.1.15/32 1004
nodeny 49.33 freebsd 8.0 |
|
|
|
|
Записан
|
|
|
|
ser970
NoDeny
Спец
Карма: 70
Offline
Сообщений: 1323
|
|
« Ответ #1 : 22 Мая 2010, 10:36:36 » |
|
в правило 33400 pipe tablearg ip from any to table(10) не попал не один пакет вот и не режеится входящая.
мало даных что бы сказать почему . для начала интерфейсы что куда.
и еще 00300 2901 971917 skipto 4500 ip from any to any in скип означет перешод на правлило с номером 0 но я в упор не вижу правила 4500
ipfw table 11 list поакзывает исходящую
в даном случае надо ipfw table 10 list но до пайпов дело тут не доходит так как ни один пакет не попап в 33400 правило
ни один пакет на попал в диверт
скорее всего с настройками парсетов и направлений и аписадом
нужно больше инфы.
|
|
|
|
|
Записан
|
|
|
|
|
versus
|
|
« Ответ #2 : 22 Мая 2010, 12:04:18 » |
|
cat /etc/rc.firewall
cat /etc/rc.conf
cat /etc/rc.local
ipfw table 10 list
cat /etc/pf.conf
|
|
|
|
|
Записан
|
|
|
|
nops
NoDeny
Постоялец
Карма: 3
Offline
Сообщений: 177
А ведь так и есть!!!!
|
|
« Ответ #3 : 26 Мая 2010, 18:26:10 » |
|
Народ, у меня такая же проблема. Включен ещё и динамический шейпер. Версия 49,32 даю все логи: [root@novour /home/admin]# ipfw show
00050 97489 7383267 allow tcp from any to me dst-port 22
00051 74467 16120124 allow tcp from me 22 to any
00060 38 2260 allow tcp from any to me dst-port 53
00061 28 4415 allow tcp from me 53 to any
00062 35150 2234837 allow udp from any to me dst-port 53
00063 30674 5811512 allow udp from me 53 to any
00064 0 0 allow tcp from any to me dst-port 953
00065 0 0 allow tcp from me 953 to any
00066 0 0 allow udp from any to me dst-port 953
00067 0 0 allow udp from me 953 to any
00070 97718 67258864 allow tcp from any to me dst-port 25
00071 77176 6889161 allow tcp from me 25 to any
00072 76286 4823743 allow tcp from any to me dst-port 143
00073 63575 40699374 allow tcp from me 143 to any
00074 0 0 allow udp from any to me dst-port 110
00080 0 0 allow tcp from any to me dst-port 67
00081 0 0 allow tcp from me 67 to any
00082 0 0 allow udp from any to me dst-port 67
00084 0 0 allow tcp from any to me dst-port 68
00085 0 0 allow tcp from me 68 to any
00086 0 0 allow udp from any to me dst-port 68
00110 2789716 364917198 allow ip from any to any via lo0
00120 1384716 957060360 skipto 1000 ip from me to any
00130 35 1960 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00160 1369778 174209674 skipto 2000 ip from any to me
00200 48435098 35536452167 skipto 500 ip from any to any via re0
00300 18358834 1492874611 skipto 4500 ip from any to any in
00400 30086588 33987333729 skipto 450 ip from any to any recv re0
00420 8 2177 divert 1 ip from any to any
00450 30086597 33987335014 divert 2 ip from any to any
00490 30086602 33987335958 allow ip from any to any
00500 30155885 34052674259 skipto 32500 ip from any to any in
00510 18279222 1483779584 divert 1 ip from any to any
00540 18279222 1483779584 allow ip from any to any
01000 0 0 allow udp from any 53,7723 to any
01010 650152 332440915 allow tcp from any to any setup keep-state
01020 454436 52194637 allow udp from any to any keep-state
01100 757275 649714856 allow ip from any to any
02000 0 0 check-state
02010 25971 2094464 allow icmp from any to any
02020 686112 80544114 allow tcp from any to any dst-port 80,443,10000,20000,21,25,411,4111,110,143,993,10024,10025,10026,10027,14120,14121,10101
02050 178882 14196874 deny ip from any to any via re0
02060 0 0 allow udp from any to any dst-port 53,7723
02100 1668 82753 deny ip from any to any
05000 57342 6281671 deny ip from not table(0) to any
05001 0 0 skipto 5010 ip from table(127) to table(126)
05002 18301188 1486537660 skipto 5030 ip from any to not table(2)
05003 0 0 deny ip from any to not table(1)
05004 0 0 pipe tablearg ip from table(21) to any
05005 0 0 deny ip from any to any
05010 0 0 pipe tablearg ip from table(127) to any
05030 0 0 deny tcp from table(15) to any dst-port 25
05400 18301188 1486537660 pipe tablearg ip from table(11) to any
32000 0 0 deny ip from any to any
32490 72 3869 deny ip from any to any
33000 0 0 pipe tablearg ip from table(126) to table(127)
33001 30155682 34052596468 skipto 33010 ip from not table(2) to any
33002 0 0 pipe tablearg ip from any to table(20)
33003 0 0 deny ip from any to any
33400 30129889 34044757836 pipe tablearg ip from any to table(10)
65535 25795 7839020 deny ip from any to any
[root@novour /home/admin]# ipfw pipe show
01028: 4.096 Mbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 94.230.139.74/143 192.168.0.6/38913 5180 1085561 0 0 0
01020: 4.096 Mbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 93.158.134.69/80 192.168.0.16/51587 2011471 2744938599 0 0 0
01005: 512.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 udp 192.168.0.5/48274 194.85.163.125/34234 22807 4042471 0 0 17
01029: 512.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 192.168.0.6/38912 94.230.139.74/143 6760 2408085 0 0 0
01021: 512.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 192.168.0.16/51587 93.158.134.69/80 1261966 105796600 0 0 407
01004: 4.096 Mbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 udp 84.23.36.77/47518 192.168.0.5/48274 18164 9290456 0 0 0
00001: unlimited 0 ms 50 sl. 0 queues (1 buckets) droptail
burst: 0 Byte
01041: 128.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 192.168.0.17/50700 91.203.99.45/80 11197894 517104384 0 0 468
01024: 4.096 Mbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 81.177.6.151/80 192.168.0.2/80 208 23471 0 0 0
01040: 900.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 91.203.99.45/80 192.168.0.17/50700 19817614 24021153979 0 0 43124
01025: 512.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 192.168.0.2/80 81.177.6.151/80 286 247478 0 0 0
01012: 900.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 93.184.71.10/80 192.168.0.13/49454 832559 1125426549 0 0 248
01013: 128.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 udp 192.168.0.13/138 192.168.255.255/138 545931 50792823 0 0 128
01008: 4.096 Mbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 205.188.1.41/443 192.168.0.11/50203 7395403 6115290484 0 0 0
01009: 512.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 192.168.0.11/50203 205.188.1.41/443 5237969 804669668 0 0 33
[root@novour /home/admin]# ipfw table 10 list
192.168.0.2/32 1024
192.168.0.5/32 1004
192.168.0.6/32 1028
192.168.0.11/32 1008
192.168.0.12/32 1012
192.168.0.13/32 1012
192.168.0.14/32 1012
192.168.0.16/32 1020
192.168.0.17/32 1040
[root@novour /home/admin]#
а так же: [root@novour /home/admin]# cat /etc/rc.firewall
#!/bin/sh -
f='/sbin/ipfw'
ifOut='re0'
${f} -f flush
${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any
${f} add 60 allow tcp from any to me 53
${f} add 61 allow tcp from me 53 to any
${f} add 62 allow udp from any to me 53
${f} add 63 allow udp from me 53 to any
${f} add 64 allow tcp from any to me 953
${f} add 65 allow tcp from me 953 to any
${f} add 66 allow udp from any to me 953
${f} add 67 allow udp from me 953 to any
${f} add 70 allow tcp from any to me 25
${f} add 71 allow tcp from me 25 to any
${f} add 72 allow tcp from any to me 143
${f} add 73 allow tcp from me 143 to any
${f} add 74 allow udp from any to me 110
${f} add 75 allow udt from me 110 to any
${f} add 80 allow tcp from any to me 67
${f} add 81 allow tcp from me 67 to any
${f} add 82 allow udp from any to me 67
${f} add 83 allow udt from me 67 to any
${f} add 84 allow tcp from any to me 68
${f} add 85 allow tcp from me 68 to any
${f} add 86 allow udp from any to me 68
${f} add 87 allow udt from me 68 to any
${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me
${f} add 200 skipto 500 ip from any to any via ${ifOut}
${f} add 300 skipto 4500 ip from any to any in
${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any
${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any
${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any
${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443,10000,20000,21,25,411,4111,110,143,993,10024,10025,10026,10027,14120,14121,10101
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723
${f} add 2100 deny ip from any to any
${f} add 32490 deny ip from any to any
[root@novour /home/admin]# cat /etc/rc.conf
defaultrouter="80.78.106.190"
gateway_enable="YES"
hostname="domen.com"
ifconfig_re0="inet 80.78.106.181 netmask 255.255.255.0"
ifconfig_em0="inet 192.168.0.1 netmask 255.255.0.0"
firewall_enable="YES"
inetd_enable="YES"
sshd_enable="YES"
mysql_enable="YES"
named_enable="YES"
enable_quotas="YES"
apache22_enable="YES"
pf_enable="YES"
ipcad_enable="YES"
webmin_enable="YES"
usermin_enable="YES"
sendmail_enable="NONE"
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
postfix_enable="YES"
courier_authdaemond_enable="YES"
courier_imap_pop3d_enable="YES"
courier_imap_imapd_enable="YES"
clamav_clamd_enable="YES"
clamav_freshclam_enable="YES"
spamd_enable="YES"
amavisd_enable="YES"
vsftpd_enable="YES"
ptokax_enable="YES"
PtokaX_enable="YES"
syslog_ng_enable="YES"
syslogd_enable="NO"
smartd_enable="YES"
arping_serv="YES"
arp_refresh="YES"
dhcpd_enable="YES"
dhcpd_ifaces="em0"
dhcpd_conf="/usr/local/etc/dhcpd.conf"
nomake_enable="YES"
munin_node_enable="YES"
[root@novour /home/admin]# cat /etc/rc.local
/sbin/kldload accf_http
/usr/bin/perl /usr/local/nodeny/nomake.pl /usr/local/nodeny/arp.txt &
[root@novour /home/admin]# cat /etc/pf.conf
set limit states 128000
set optimization aggressive
rdr pass on re0 proto { tcp, udp } from any to 80.78.106.181 port 10101 \ -> 192.168.0.2 port 80
nat pass on re0 from 192.168.0.0/16 to any -> re0
nat pass on re0 from 192.168.0.2 port 80 to any -> re0
[root@novour /home/admin]#
em0 - внутренняя re0 - внешняя |
|
|
|
|
Записан
|
Не надо говорить СПАСИБО! Для этого есть специально "Прибавить" к карме!!
|
|
|
elite
Начальник планеты
NoDeny
Спец
Карма: 52
Offline
Сообщений: 1226
In LAN we trust!
|
|
« Ответ #4 : 26 Мая 2010, 21:54:57 » |
|
содержимое /etc/sysctl.conf и /boot/loader.conf в студию
|
|
|
|
|
Записан
|
|
|
|
nops
NoDeny
Постоялец
Карма: 3
Offline
Сообщений: 177
А ведь так и есть!!!!
|
|
« Ответ #5 : 27 Мая 2010, 14:09:58 » |
|
[root@novour /home/admin]# cat /etc/sysctl.conf
# $FreeBSD: src/etc/sysctl.conf,v 1.8.34.1.2.1 2009/10/25 01:10:29 kensmith Exp $
#
# This file is read when going to multi-user and its contents piped thru
# ``sysctl'' to adjust kernel values. ``man 5 sysctl.conf'' for details.
#
# Uncomment this to prevent users from seeing information about processes that
# are being run under another UID.
#security.bsd.see_other_uids=0
[root@novour /home/admin]# cat /boot/loader.conf
pf_load="YES"
kern.maxdsiz="1G"
kern.dfldsiz="1G"
[root@novour /home/admin]# |
|
|
|
|
Записан
|
Не надо говорить СПАСИБО! Для этого есть специально "Прибавить" к карме!!
|
|
|
elite
Начальник планеты
NoDeny
Спец
Карма: 52
Offline
Сообщений: 1226
In LAN we trust!
|
|
« Ответ #6 : 27 Мая 2010, 14:58:11 » |
|
uname -a и содержимое файла конфигурации ядра
|
|
|
|
|
Записан
|
|
|
|
nops
NoDeny
Постоялец
Карма: 3
Offline
Сообщений: 177
А ведь так и есть!!!!
|
|
« Ответ #7 : 27 Мая 2010, 15:19:43 » |
|
[root@novour /home/admin]# uname -a
FreeBSD novour.com 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Wed Mar 17 22:16:55 YEKT 2010 admin@novour.com:/usr/src/sys/i386/compile/NODENY i386
[root@novour /home/admin]# [root@novour /usr/src/sys/i386/conf]# cat /usr/src/sys/i386/conf/NODENY
#
# GENERIC -- Generic kernel configuration file for FreeBSD/i386
#
# For more information on this file, please read the config(5) manual page,
# and/or the handbook section on Kernel Configuration Files:
#
# http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/kernelconfig-config.html
#
# The handbook is also available locally in /usr/share/doc/handbook
# if you've installed the doc distribution, otherwise always see the
# FreeBSD World Wide Web server (http://www.FreeBSD.org/) for the
# latest information.
#
# An exhaustive list of options and more detailed explanations of the
# device lines is also present in the ../../conf/NOTES and NOTES files.
# If you are in doubt as to the purpose or necessity of a line, check first
# in NOTES.
#
# $FreeBSD: src/sys/i386/conf/GENERIC,v 1.519.2.4.2.2 2009/11/09 23:48:01 kensmith Exp $
#cpu I486_CPU
#cpu I586_CPU
cpu I686_CPU
ident GENERIC
# To statically compile in device wiring instead of /boot/device.hints
#hints "GENERIC.hints" # Default places to look for devices.
# Use the following to compile in values accessible to the kernel
# through getenv() (or kenv(1) in userland). The format of the file
# is 'variable=value', see kenv(1)
#
# env "GENERIC.env"
makeoptions DEBUG=-g # Build kernel with gdb(1) debug symbols
options IPFIREWALL
options IPDIVERT
options IPFIREWALL_FORWARD
options DUMMYNET
options SCHED_ULE # ULE scheduler
options PREEMPTION # Enable kernel thread preemption
options INET # InterNETworking
options INET6 # IPv6 communications protocols
options SCTP # Stream Control Transmission Protocol
options FFS # Berkeley Fast Filesystem
options SOFTUPDATES # Enable FFS soft updates support
options UFS_ACL # Support for access control lists
options UFS_DIRHASH # Improve performance on big directories
options UFS_GJOURNAL # Enable gjournal-based UFS journaling
options MD_ROOT # MD is a potential root device
options NFSCLIENT # Network Filesystem Client
options NFSSERVER # Network Filesystem Server
options NFSLOCKD # Network Lock Manager
options NFS_ROOT # NFS usable as /, requires NFSCLIENT
options MSDOSFS # MSDOS Filesystem
options CD9660 # ISO 9660 Filesystem
options PROCFS # Process filesystem (requires PSEUDOFS)
options PSEUDOFS # Pseudo-filesystem framework
options GEOM_PART_GPT # GUID Partition Tables.
options GEOM_LABEL # Provides labelization
options COMPAT_43TTY # BSD 4.3 TTY compat (sgtty)
options COMPAT_FREEBSD4 # Compatible with FreeBSD4
options COMPAT_FREEBSD5 # Compatible with FreeBSD5
options COMPAT_FREEBSD6 # Compatible with FreeBSD6
options COMPAT_FREEBSD7 # Compatible with FreeBSD7
options SCSI_DELAY=5000 # Delay (in ms) before probing SCSI
options KTRACE # ktrace(1) support
options STACK # stack(9) support
options SYSVSHM # SYSV-style shared memory
options SYSVMSG # SYSV-style message queues
options SYSVSEM # SYSV-style semaphores
options P1003_1B_SEMAPHORES # POSIX-style semaphores
options _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options PRINTF_BUFR_SIZE=128 # Prevent printf output being interspersed.
options KBD_INSTALL_CDEV # install a CDEV entry in /dev
options HWPMC_HOOKS # Necessary kernel hooks for hwpmc(4)
options AUDIT # Security event auditing
options MAC # TrustedBSD MAC Framework
options FLOWTABLE # per-cpu routing cache
#options KDTRACE_HOOKS # Kernel DTrace hooks
# To make an SMP kernel, the next two lines are needed
options SMP # Symmetric MultiProcessor Kernel
device apic # I/O APIC
# CPU frequency control
device cpufreq
# Bus support.
device acpi
device eisa
device pci
# Floppy drives
device fdc
# ATA and ATAPI devices
device ata
device atadisk # ATA disk drives
device ataraid # ATA RAID drives
device atapicd # ATAPI CDROM drives
device atapifd # ATAPI floppy drives
device atapist # ATAPI tape drives
options ATA_STATIC_ID # Static device numbering
# SCSI Controllers
device ahb # EISA AHA1742 family
device ahc # AHA2940 and onboard AIC7xxx devices
options AHC_REG_PRETTY_PRINT # Print register bitfields in debug
# output. Adds ~128k to driver.
device ahd # AHA39320/29320 and onboard AIC79xx devices
options AHD_REG_PRETTY_PRINT # Print register bitfields in debug
# output. Adds ~215k to driver.
device amd # AMD 53C974 (Tekram DC-390(T))
device hptiop # Highpoint RocketRaid 3xxx series
device isp # Qlogic family
#device ispfw # Firmware for QLogic HBAs- normally a module
device mpt # LSI-Logic MPT-Fusion
#device ncr # NCR/Symbios Logic
device sym # NCR/Symbios Logic (newer chipsets + those of `ncr')
device trm # Tekram DC395U/UW/F DC315U adapters
device adv # Advansys SCSI adapters
device adw # Advansys wide SCSI adapters
device aha # Adaptec 154x SCSI adapters
device aic # Adaptec 15[012]x SCSI adapters, AIC-6[23]60.
device bt # Buslogic/Mylex MultiMaster SCSI adapters
device ncv # NCR 53C500
device nsp # Workbit Ninja SCSI-3
device stg # TMC 18C30/18C50
# SCSI peripherals
device scbus # SCSI bus (required for SCSI)
device ch # SCSI media changers
device da # Direct Access (disks)
device sa # Sequential Access (tape etc)
device cd # CD
device pass # Passthrough device (direct SCSI access)
device ses # SCSI Environmental Services (and SAF-TE)
# RAID controllers interfaced to the SCSI subsystem
device amr # AMI MegaRAID
device arcmsr # Areca SATA II RAID
device asr # DPT SmartRAID V, VI and Adaptec SCSI RAID
device ciss # Compaq Smart RAID 5*
device dpt # DPT Smartcache III, IV - See NOTES for options
device hptmv # Highpoint RocketRAID 182x
device hptrr # Highpoint RocketRAID 17xx, 22xx, 23xx, 25xx
device iir # Intel Integrated RAID
device ips # IBM (Adaptec) ServeRAID
device mly # Mylex AcceleRAID/eXtremeRAID
device twa # 3ware 9000 series PATA/SATA RAID
# RAID controllers
device aac # Adaptec FSA RAID
device aacp # SCSI passthrough for aac (requires CAM)
device ida # Compaq Smart RAID
device mfi # LSI MegaRAID SAS
device mlx # Mylex DAC960 family
device pst # Promise Supertrak SX6000
device twe # 3ware ATA RAID
# atkbdc0 controls both the keyboard and the PS/2 mouse
device atkbdc # AT keyboard controller
device atkbd # AT keyboard
device psm # PS/2 mouse
device kbdmux # keyboard multiplexer
device vga # VGA video card driver
device splash # Splash screen and screen saver support
# syscons is the default console driver, resembling an SCO console
device sc
device agp # support several AGP chipsets
# Power management support (see NOTES for more options)
#device apm
# Add suspend/resume support for the i8254.
device pmtimer
# PCCARD (PCMCIA) support
# PCMCIA and cardbus bridge support
device cbb # cardbus (yenta) bridge
device pccard # PC Card (16-bit) bus
device cardbus # CardBus (32-bit) bus
# Serial (COM) ports
device uart # Generic UART driver
# Parallel port
device ppc
device ppbus # Parallel port bus (required)
device lpt # Printer
device plip # TCP/IP over parallel
device ppi # Parallel port interface device
#device vpo # Requires scbus and da
# If you've got a "dumb" serial or parallel PCI card that is
# supported by the puc(4) glue driver, uncomment the following
# line to enable it (connects to sio, uart and/or ppc drivers):
#device puc
# PCI Ethernet NICs.
device de # DEC/Intel DC21x4x (``Tulip'')
device em # Intel PRO/1000 Gigabit Ethernet Family
device igb # Intel PRO/1000 PCIE Server Gigabit Family
device ixgb # Intel PRO/10GbE Ethernet Card
device le # AMD Am7900 LANCE and Am79C9xx PCnet
device ti # Alteon Networks Tigon I/II gigabit Ethernet
device txp # 3Com 3cR990 (``Typhoon'')
device vx # 3Com 3c590, 3c595 (``Vortex'')
# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device miibus # MII bus support
device ae # Attansic/Atheros L2 FastEthernet
device age # Attansic/Atheros L1 Gigabit Ethernet
device alc # Atheros AR8131/AR8132 Ethernet
device ale # Atheros AR8121/AR8113/AR8114 Ethernet
device bce # Broadcom BCM5706/BCM5708 Gigabit Ethernet
device bfe # Broadcom BCM440x 10/100 Ethernet
device bge # Broadcom BCM570xx Gigabit Ethernet
device dc # DEC/Intel 21143 and various workalikes
device et # Agere ET1310 10/100/Gigabit Ethernet
device fxp # Intel EtherExpress PRO/100B (82557, 82558)
device jme # JMicron JMC250 Gigabit/JMC260 Fast Ethernet
device lge # Level 1 LXT1001 gigabit Ethernet
device msk # Marvell/SysKonnect Yukon II Gigabit Ethernet
device nfe # nVidia nForce MCP on-board Ethernet
device nge # NatSemi DP83820 gigabit Ethernet
#device nve # nVidia nForce MCP on-board Ethernet Networking
device pcn # AMD Am79C97x PCI 10/100 (precedence over 'le')
device re # RealTek 8139C+/8169/8169S/8110S
device rl # RealTek 8129/8139
device sf # Adaptec AIC-6915 (``Starfire'')
device sis # Silicon Integrated Systems SiS 900/SiS 7016
device sk # SysKonnect SK-984x & SK-982x gigabit Ethernet
device ste # Sundance ST201 (D-Link DFE-550TX)
device stge # Sundance/Tamarack TC9021 gigabit Ethernet
device tl # Texas Instruments ThunderLAN
device tx # SMC EtherPower II (83c170 ``EPIC'')
device vge # VIA VT612x gigabit Ethernet
device vr # VIA Rhine, Rhine II
device wb # Winbond W89C840F
device xl # 3Com 3c90x (``Boomerang'', ``Cyclone'')
# ISA Ethernet NICs. pccard NICs included.
device cs # Crystal Semiconductor CS89x0 NIC
# 'device ed' requires 'device miibus'
device ed # NE[12]000, SMC Ultra, 3c503, DS8390 cards
device ex # Intel EtherExpress Pro/10 and Pro/10+
device ep # Etherlink III based cards
device fe # Fujitsu MB8696x based cards
device ie # EtherExpress 8/16, 3C507, StarLAN 10 etc.
device sn # SMC's 9000 series of Ethernet chips
device xe # Xircom pccard Ethernet
# Wireless NIC cards
device wlan # 802.11 support
options IEEE80211_DEBUG # enable debug msgs
options IEEE80211_AMPDU_AGE # age frames in AMPDU reorder q's
options IEEE80211_SUPPORT_MESH # enable 802.11s draft support
device wlan_wep # 802.11 WEP support
device wlan_ccmp # 802.11 CCMP support
device wlan_tkip # 802.11 TKIP support
device wlan_amrr # AMRR transmit rate control algorithm
device an # Aironet 4500/4800 802.11 wireless NICs.
device ath # Atheros pci/cardbus NIC's
device ath_hal # pci/cardbus chip support
options AH_SUPPORT_AR5416 # enable AR5416 tx/rx descriptors
device ath_rate_sample # SampleRate tx rate control for ath
device ral # Ralink Technology RT2500 wireless NICs.
device wi # WaveLAN/Intersil/Symbol 802.11 wireless NICs.
#device wl # Older non 802.11 Wavelan wireless NIC.
# Pseudo devices.
device loop # Network loopback
device random # Entropy device
device ether # Ethernet support
device tun # Packet tunnel.
device pty # BSD-style compatibility pseudo ttys
device md # Memory "disks"
device gif # IPv6 and IPv4 tunneling
device faith # IPv6-to-IPv4 relaying (translation)
device firmware # firmware assist module
# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
# Note that 'bpf' is required for DHCP.
device bpf # Berkeley packet filter
# USB support
device uhci # UHCI PCI->USB interface
device ohci # OHCI PCI->USB interface
device ehci # EHCI PCI->USB interface (USB 2.0)
device usb # USB Bus (required)
#device udbp # USB Double Bulk Pipe devices
device uhid # "Human Interface Devices"
device ukbd # Keyboard
device ulpt # Printer
device umass # Disks/Mass storage - Requires scbus and da
device ums # Mouse
device rum # Ralink Technology RT2501USB wireless NICs
device ural # Ralink Technology RT2500USB wireless NICs
device uath # Atheros AR5523 wireless NICs
device zyd # ZyDAS zb1211/zb1211b wireless NICs
device urio # Diamond Rio 500 MP3 player
# USB Serial devices
device u3g # USB-based 3G modems (Option, Huawei, Sierra)
device uark # Technologies ARK3116 based serial adapters
device ubsa # Belkin F5U103 and compatible serial adapters
device uftdi # For FTDI usb serial adapters
device uipaq # Some WinCE based devices
device uplcom # Prolific PL-2303 serial adapters
device uslcom # SI Labs CP2101/CP2102 serial adapters
device uvisor # Visor and Palm devices
device uvscom # USB serial support for DDI pocket's PHS
# USB Ethernet, requires miibus
device aue # ADMtek USB Ethernet
device axe # ASIX Electronics USB Ethernet
device cdce # Generic USB over Ethernet
device cue # CATC USB Ethernet
device kue # Kawasaki LSI USB Ethernet
device rue # RealTek RTL8150 USB Ethernet
device udav # Davicom DM9601E USB
# FireWire support
device firewire # FireWire bus code
#device sbp # SCSI over FireWire (Requires scbus and da)
device fwe # Ethernet over FireWire (non-standard!)
device fwip # IP over FireWire (RFC 2734,3146)
device dcons # Dumb console driver
device dcons_crom # Configuration ROM for dcons
[root@novour /usr/src/sys/i386/conf]#
|
|
|
|
|
Записан
|
Не надо говорить СПАСИБО! Для этого есть специально "Прибавить" к карме!!
|
|
|
elite
Начальник планеты
NoDeny
Спец
Карма: 52
Offline
Сообщений: 1226
In LAN we trust!
|
|
« Ответ #8 : 27 Мая 2010, 17:33:40 » |
|
попробуй добавить в конфиг ядра и пересобрать ядро, а еще лучше - обновись до стейбл |
|
|
|
|
Записан
|
|
|
|
nops
NoDeny
Постоялец
Карма: 3
Offline
Сообщений: 177
А ведь так и есть!!!!
|
|
« Ответ #9 : 27 Мая 2010, 18:18:57 » |
|
Ну пересобрать ядро это понятно, а обновить, это что имеется ввиду? freebsd-update fetch
freebsd-update install
Или что-то ещё? Я же ещё не такой великий знаток во фре, как некоторые тут)))) |
|
|
|
|
Записан
|
Не надо говорить СПАСИБО! Для этого есть специально "Прибавить" к карме!!
|
|
|
nops
NoDeny
Постоялец
Карма: 3
Offline
Сообщений: 177
А ведь так и есть!!!!
|
|
« Ответ #10 : 27 Мая 2010, 19:19:59 » |
|
Вообщем, попробовал так сделать, получил: [root@novour /usr/local/nodeny]# uname -a
FreeBSD novour.com 8.0-RELEASE-p3 FreeBSD 8.0-RELEASE-p3 #0: Wed May 26 05:45:12 UTC 2010 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386
[root@novour /usr/local/nodeny]#
завтра переобиру ядро. |
|
|
|
|
Записан
|
Не надо говорить СПАСИБО! Для этого есть специально "Прибавить" к карме!!
|
|
|
ser970
NoDeny
Спец
Карма: 70
Offline
Сообщений: 1323
|
|
« Ответ #11 : 27 Мая 2010, 21:41:54 » |
|
если в первом посте 33400 0 0 pipe tablearg ip from any to table(10) тут да не попали правила в шейпер - все понятно
то у nops если судить по єтому :
192.168.0.2/32 1024
192.168.0.2/32 1025
01024: 4.096 Mbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 81.177.6.151/80 192.168.0.2/80 208 23471 0 0 0
01025: 512.000 Kbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail
burst: 0 Byte
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
0 tcp 192.168.0.2/80 81.177.6.151/80 286 247478 0 0 0
05400 18301188 1486537660 pipe tablearg ip from table(11) to any
33400 30129889 34044757836 pipe tablearg ip from any to table(10)
то тут все верно.
канал 4096 на 512
но
00120 1384716 957060360 skipto 1000 ip from me to any
тогда судя по
01000 0 0 allow udp from any 53,7723 to any
посмотри что в переменой ipfw.one.pass
как именно не шейпится?
как проверяешь какие значения скорости получашь ?
походу или пролемы именно с думунет (не помню там был баг с пайпами)
или системные переменые
покаж sysctl -a
|
|
|
|
« Последнее редактирование: 27 Мая 2010, 21:48:21 от ser970 »
|
Записан
|
|
|
|
nops
NoDeny
Постоялец
Карма: 3
Offline
Сообщений: 177
А ведь так и есть!!!!
|
|
« Ответ #12 : 28 Мая 2010, 03:40:40 » |
|
получился очень большой, выкладываю в отдельный файл: www.novour.com/sysctl.txtТут правда много лишнего. Я поглядел, видел, что создаётся правила 4096/512 но, у меня в тариве стоит 900/128 Помимо этого стоит динамический шейпер, вот программирование тарифа: <time 19,20,21,22,23>0:0-450
0:0-900 т.е. с 19 до 24 часов я скорость уменьшаю в 2 раза, а в остальное время возвращаю обратно на 900 кбит/сек Проблема в том, что раньше это работало, а сейчас проблема какая-то((((( Да, скорость запросто можно и поглядеть, смотрю после 19-00 в "Статистике" беру цыфру, умножаю на 8 и дулю на 31, получаю скорость в кбитах/сек |
|
|
|
« Последнее редактирование: 28 Мая 2010, 03:51:33 от nops »
|
Записан
|
Не надо говорить СПАСИБО! Для этого есть специально "Прибавить" к карме!!
|
|
|
ser970
NoDeny
Спец
Карма: 70
Offline
Сообщений: 1323
|
|
« Ответ #13 : 28 Мая 2010, 05:34:59 » |
|
хм не там копаете батенька. оставте ядро и сисему в покое. у вас все с шейпером нормально.почитайте документацию на билинг.
|
|
|
|
|
Записан
|
|
|
|
nops
NoDeny
Постоялец
Карма: 3
Offline
Сообщений: 177
А ведь так и есть!!!!
|
|
« Ответ #14 : 28 Мая 2010, 11:55:55 » |
|
Читал, и не раз. Дело в том, что раньше всё шейпилось прекрасно, что и когда произошло незнаю, не заметил, но сейчас скорость не шейпится.
|
|
|
|
|
Записан
|
Не надо говорить СПАСИБО! Для этого есть специально "Прибавить" к карме!!
|
|
|
|
