народ неужели ни у кого не случалось подобное??
1. создал 2 view для двух сателитов с их групами. создал для них юзери для мускула. с правами как написано в доке.
2. поставил на сателитах
mysql51-client ,
p5-DBD-mysql ,
mpd,
ipcad 3. скопировал
noserver.pl , nofire.pl, nosat.pm , sat.cfg на сателит 1 и 2.
на ядре Nodeny
1. через веб админку создал 2 сателлита и на поле "таблица БД со списком пользователей" написал имя вюхи . нечего другого не менял.
2. отключил noserver.pl на ядре.
на мониторинге все сателиты зеление. в логах нигде нет ошибок. все работае. инет идет но не шейпится. если поставить стандартные скрипты
noserver.pl и
nofire.pl то все режется... но как меняю на nofire с 4 направлениями нечего не шейпится.
[root@satelit1 /usr/local/nodeny]# uname -a
FreeBSD satelit1.mynet.am 8.1-RELEASE FreeBSD 8.1-RELEASE #0: Tue Aug 3 01:57:54 UTC 2010 root@satelit1.mynet.com:/usr/src/sys/amd64/compile/NODENY amd64
[root@satelit1 /usr/local/nodeny]#
конфиги сателита
[root@satelit1 ~]# cat /etc/rc.conf
# Created: Sun Jul 14 01:15:19 2030
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
defaultrouter="10.0.0.254"
ifconfig_re0="inet 10.0.0.4 netmask 255.255.255.0"
ifconfig_re1="inet 192.168.254.1 netmask 255.255.255.128"
ifconfig_re1_alias0="inet 10.100.0.1 netmask 255.255.255.0"
ifconfig_re1_alias1="inet 77.95.xx.xx netmask 255.255.255.240"
hostname="satelit1.mynet.com"
gateway_enable="YES"
sshd_enable="YES"
firewall_enable="YES"
ipcad_enable="YES"
mpd_enable="YES"
fsck_y_enable="YES"
background_fsck="NO"
apache22_enable="YES"
[root@satelit1 ~]#
[root@satelit1 ~]# cat /etc/rc.firewall
#!/bin/sh -
f='/sbin/ipfw'
ifOut='re0'
${f} -f flush
${f} add 10 allow ip from any to 10.0.0.1
${f} add 10 allow ip from 10.0.0.1 to any
${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any
${f} add 100 deny tcp from any to any 445
${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 140 deny ip from any to "table(120)"
${f} add 150 deny ip from "table(120)" to any
${f} add 160 skipto 2000 ip from any to me
${f} add 200 skipto 500 ip from any to any via ${ifOut}
${f} add 300 skipto 4500 ip from any to any in
${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any
${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any
${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any
${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723
${f} add 2100 deny ip from any to any
${f} add 32490 deny ip from any to any
[root@satelit1 ~]#
[root@satelit1 ~]# cat /usr/local/etc/ipcad.conf
capture-ports disable;
interface divert port 1 netflow-disable;
interface divert port 2 netflow-disable;
rsh enable at 127.0.0.1;
rsh enable at 10.0.0.4;
rsh root@10.0.0.1 admin;
rsh root@127.0.0.1 admin;
rsh ttl = 6;
rsh timeout = 30;
dumpfile = ipcad.dump;
chroot = /tmp;
memory_limit = 50m;[root@satelit1 ~]#
[root@satelit1 ~]# cat /usr/local/etc/mpd5/mpd.conf
startup:
set user admin xxx
set console self 127.0.0.1 5005
set console open
set web self 0.0.0.0 5006
set web open
default:
load pppoe_server
pppoe_server:
create bundle template B
set ipcp ranges 10.0.0.4/32 127.0.0.2/32
set ipcp dns 10.0.0.1
set ccp yes mppc
set mppc yes e40
set mppc yes e56
set mppc yes e128
set mppc yes stateless
set ecp disable dese-bis dese-old
create link template common pppoe
set link enable multilink
set link action bundle B
set link disable chap pap eap
set link enable pap
load radius
set pppoe service "*"
create link template re1 common
set link max-children 1000
set pppoe iface re1
set link enable incoming
radius:
set radius server 10.0.0.1 xxx 1812 1813
set radius retries 3
set radius timeout 3
set radius me 127.0.0.1
set auth acct-update 45
set auth enable radius-auth
set auth enable radius-acct
set radius enable message-authentic
[root@satelit1 ~]#
[root@satelit1 /usr/local/nodeny]# ipfw show
00010 1587349 414740613 allow ip from any to 10.0.0.1
00010 1465917 557447586 allow ip from 10.0.0.1 to any
00050 2836 222920 allow tcp from any to me dst-port 22
00051 2890 690016 allow tcp from me 22 to any
00100 2098 103600 deny tcp from any to any dst-port 445
00110 0 0 allow ip from any to any via lo0
00120 978 56404 skipto 1000 ip from me to any
00130 24 1344 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00140 0 0 deny ip from any to table(120)
00150 0 0 deny ip from table(120) to any
00160 829 54599 skipto 2000 ip from any to me
00200 103617793 57657087756 skipto 500 ip from any to any via re0
00300 48191046 11170614939 skipto 4500 ip from any to any in
00400 55081974 45842336418 skipto 450 ip from any to any recv re0
00420 372079 117190590 divert 1 ip from any to any
00450 55453923 45959707236 divert 2 ip from any to any
00490 55455858 45960521429 allow ip from any to any
00500 56091908 46627300835 skipto 32500 ip from any to any in
00510 47528240 11031118392 divert 1 ip from any to any
00540 47529453 11031326391 allow ip from any to any
01000 0 0 allow udp from any 53,7723 to any
01010 0 0 allow tcp from any to any setup keep-state
01020 0 0 allow udp from any to any keep-state
01100 978 56404 allow ip from any to any
02000 0 0 check-state
02010 8 512 allow icmp from any to any
02020 0 0 allow tcp from any to any dst-port 80,443
02050 53 3870 deny ip from any to any via re0
02060 722 48487 allow udp from any to any dst-port 53,7723
02100 46 1730 deny ip from any to any
05000 0 0 deny ip from not table(0) to any
05001 1619095 149461139 skipto 5030 ip from any to not table(2)
05002 858 60170 deny ip from any to not table(1)
05003 67160 37698987 pipe tablearg ip from table(21) to any
05004 5 708 deny ip from any to any
05030 1076 51656 deny tcp from table(15) to any dst-port 25
05140 1564177 143941730 skipto 5141 ip from any to not table(40)
05140 0 0 pipe tablearg ip from table(41) to any
05142 52165 5030604 skipto 5143 ip from any to not table(42)
05142 1557088 143202456 pipe tablearg ip from table(43) to any
05144 6747 631790 skipto 5145 ip from any to not table(44)
05144 52162 5030312 pipe tablearg ip from table(45) to any
05400 3714 515296 pipe tablearg ip from table(11) to any
32000 5051 661175 deny ip from any to any
32490 8 862 deny ip from any to any
33000 0 0 skipto 33010 ip from not table(2) to any
33001 2605784 3563004085 pipe tablearg ip from any to table(20)
33002 980 434612 deny ip from any to any
33140 0 0 pipe tablearg ip from table(40) to table(41)
33142 0 0 pipe tablearg ip from table(42) to table(43)
33144 0 0 pipe tablearg ip from table(44) to table(45)
33400 0 0 pipe tablearg ip from any to table(10)
65535 12172 1571872 deny ip from any to any
[root@satelit1 /usr/local/nodeny]#
[root@satelit1 /usr/local/nodeny]# ipfw table 40 list
10.0.0.100/32 0
[root@satelit1 /usr/local/nodeny]# ipfw table 42 list
10.0.0.101/32 0
10.0.0.102/32 0
[root@satelit1 /usr/local/nodeny]# ipfw table 44 list
62.89.0.0/24 0
62.89.0.0/19 0
77.95.184.0/21 0
78.109.64.0/20 0
80.86.224.0/24 0
[root@satelit1 /usr/local/nodeny]#
[root@satelit1 /usr/local/nodeny]# ipfw table 41 list
[root@satelit1 /usr/local/nodeny]# ipfw table 43 list | more
10.1.0.12/32 2723
10.1.0.13/32 2075
10.1.0.14/32 1915
10.4.0.10/32 1995
10.4.0.11/32 2083
10.4.0.13/32 1571
10.4.0.19/32 2811
10.4.0.22/32 2819
10.4.0.29/32 2363
10.4.0.31/32 2051
10.4.0.32/32 2059
10.4.0.39/32 2203
10.6.0.10/32 1395
10.6.0.11/32 1411
10.6.0.21/32 3283
10.8.0.12/32 1387
10.8.0.26/32 1435
10.8.0.43/32 1451
10.100.0.14/32 1827
10.100.0.16/32 2635
10.100.0.17/32 2387
10.100.0.22/32 1067
10.100.0.23/32 2867
10.100.0.25/32 2011
10.100.0.26/32 3179
10.100.0.27/32 3107
10.100.0.28/32 3163
10.100.0.29/32 3187
10.100.0.41/32 1035
10.100.0.51/32 2467
10.100.0.52/32 3019
10.100.0.53/32 3027
10.100.0.54/32 3035
10.100.0.55/32 3051
10.100.0.56/32 3043
10.100.0.57/32 2563
10.100.0.58/32 1347
10.100.0.59/32 1355
10.100.0.60/32 3059
10.100.0.61/32 3067
10.100.0.62/32 3075
10.100.0.63/32 3083
10.100.0.64/32 3091
[root@satelit1 /usr/local/nodeny]# ipfw table 45 list | more
10.1.0.12/32 2724
10.1.0.13/32 2076
10.1.0.14/32 1916
10.4.0.10/32 1996
10.4.0.11/32 2084
10.4.0.13/32 1572
10.4.0.19/32 2812
10.4.0.22/32 2820
10.4.0.29/32 2364
10.4.0.31/32 2052
10.4.0.32/32 2060
10.4.0.39/32 2204
10.6.0.10/32 1396
10.6.0.11/32 1412
10.6.0.21/32 3284
10.8.0.12/32 1388
10.8.0.26/32 1436
10.8.0.43/32 1452
10.100.0.14/32 1828
10.100.0.16/32 2636
10.100.0.17/32 2388
10.100.0.22/32 1068
10.100.0.23/32 2868
10.100.0.25/32 2012
10.100.0.26/32 3180
10.100.0.27/32 3108
10.100.0.28/32 3164
10.100.0.29/32 3188
10.100.0.41/32 1036
10.100.0.51/32 2468
10.100.0.52/32 3020
10.100.0.53/32 3028
10.100.0.54/32 3036
10.100.0.55/32 3052
10.100.0.56/32 3044
10.100.0.57/32 2564
10.100.0.58/32 1348
10.100.0.59/32 1356
10.100.0.60/32 3060
10.100.0.61/32 3068
10.100.0.62/32 3076
10.100.0.63/32 3084
10.100.0.64/32 3092
[root@satelit1 /usr/local/nodeny]#
что мне делать?? взять и отказаться от nofire с 4 направлениями или опять таки все на 1 ПС? и без сателитов?
