[FUGSPBR] dois link....

Qui Fev 26 09:07:06 BRT 2004

Olá Aprigio,

    Em principio a ideia e estas fazer redundância de links, a segunda opção
não deixa de ser interesante tambem...inclusive fiz algo usando natd e ipfw
so que nao deu certo... onde eu posso conseguir documentação ou ainda melhor
alguem na lista ja tem isto em pratica e poderia me da um ajuda....segue
abaixo o script do ipfw....

----------####-----------
#!/bin/sh
#
# Setup system for firewall service.
#
# Suck in the configuration variables.

if [ -r /etc/defaults/rc.conf ]; then
        . /etc/defaults/rc.conf
        source_rc_confs
elif [ -r /etc/rc.conf ]; then
        . /etc/rc.conf
fi

############
# Set quiet mode if requested
#
case ${firewall_quiet} in
[Yy][Ee][Ss])
                fwcmd="/sbin/ipfw -q"
                ;;
        *)
                fwcmd="/sbin/ipfw"
                ;;
esac

natcmd="/sbin/natd"

############
#
# Local Variables

net_iface="ed0"
lan_iface="rl0"
tun_iface=`ifconfig | grep tun | cut -d: -f1`
loc_iface="lo0"

lan_ip="172.18.1.0/24"
net_ip="200.164.x.x/24"
tun_ip=""
loc_ip="127.0.0.0/8"

lan_ip_local="172.18.1.254"
net_ip_local="200.164.x.x"
tun_ip_local=`ifconfig $tun_iface | grep inet | awk '{print $2}'`
loc_ip_local="127.0.0.1"

route_net_ip="200.164.x.x"
route_tun_ip=`ifconfig $tun_iface | grep inet | awk '{print $4}'`

############
# Flush out the list before we begin.
#
${fwcmd} -f flush

############
#
#

############
# start natd
#
${natcmd} -p 8868 -dynamic -interface $net_iface
${natcmd} -p 8869 -dynamic -interface $tun_iface

############
# Only in rare cases do you want to change these rules
#

# allow local traffic
${fwcmd} add 00100 allow ip from $lan_ip to $lan_ip
${fwcmd} add 00125 allow ip from 127.0.0.0/24 to $lan_ip
${fwcmd} add 00130 allow ip from $lan_ip to 127.0.0.0/24

${fwcmd} add 00140 allow all from $lan_ip to $net_ip
${fwcmd} add 00145 allow all from $net_ip to $lan_ip

${fwcmd} add 00150 pass all from any to any via lo0
${fwcmd} add 00160 deny all from any to 127.0.0.0/8
${fwcmd} add 00170 deny ip from 127.0.0.0/8 to any

# stop simple incoming attempts from internet
${fwcmd} add 00200 deny tcp from any to any setup in via $tun_iface
${fwcmd} add 00250 deny tcp from any to any setup in via $net_iface

#send incoming traffic to natd
${fwcmd} add 00450 divert 8868 ip from any to any in via $net_iface
${fwcmd} add 00400 divert 8869 ip from any to any in via $tun_iface

#if flow is already going via NATD, send it back to same NATD
${fwcmd} add 00500 check-state

# send 38% of traffic to isp 1 as 600k = 38% of 1mb + 600k
${fwcmd} add 00600 prob 0.380000 skipto 700 ip from $lan_ip to any out
keep-state

# remaining 62% of traffic send to isp2
${fwcmd} add 00650 skipto 900 ip from $lan_ip to any out keep-state

#nat everything that get's here, should be ok as local allowed in first
lines to go direct
${fwcmd} add 00700 divert 8868 ip from $lan_ip to any in
${fwcmd} add 00750 divert 8868 ip from $lan_ip to any out
${fwcmd} add 00900 divert 8869 ip from $lan_ip to any out
${fwcmd} add 00950 divert 8869 ip from $lan_ip to any in

#policy route to send traffic to correct isp
${fwcmd} add 02000 fwd $route_net_ip ip from $net_ip_local to any
${fwcmd} add 02500 fwd $route_tun_ip ip from $tun_ip_local to any

#break out traffic to allow accounting to show me what's going where
${fwcmd} add 30000 allow ip from any to $lan_ip
${fwcmd} add 30100 allow ip from any to any in via $tun_iface
${fwcmd} add 30200 allow ip from any to any in via $net_iface
${fwcmd} add 30300 allow ip from any to any out via $tun_iface
${fwcmd} add 30400 allow ip from any to any out via $net_iface

${fwcmd} add 65000 allow ip from any to any
#${fwcmd} add 65535 deny ip from any to any

----------####-----------

onde esta o error aqui... ja que este script parte dele eu obtive de alguns
colegas da lista outra parte eu fiz.....

agradeço......

[]´s

Marcelo Olate

----- Original Message ----- 
From: "Aprigio Neto" <aprigio em w2bnet.com.br>
To: <fugspbr em fugspbr.org>
Sent: Tuesday, February 24, 2004 4:14 AM
Subject: Re: [FUGSPBR] dois link....

> Olá Marcelo,
>
> Se for um acesso da intranet, oq sair por um link, tem que retornar por
este,
> a não ser que faça redundância de links, ai vc utilizaria os 2 ao mesmo
> tempo. Caso contrário daria pra vc fazer que um link responda acessos
> externos e outro acessos internos. Se tem alguma outra solução,
desconheço.
>
> []s
>
> Aprigio Neto
>
> On Monday 23 February 2004 00:01, Marcelo Aldi Vera Olate wrote:
> > Boa noite a todos,
> >
> >     Galera e o seguinte eu tenho duas conexões para internet um link
128K
> > ip-validado e outra um velox de 512k, bom eu ja fiz uma leitura no
> > historico e chegue a seguinte conclusão para o script do meu ipfw.... so
> > que nao consigo fazer-lo funcionar.... o esquema eh;
> >
> > <ip_link_128> -------------|
> >
> >                                     | ----------[Firewall]
> >                                     | ------------[rede
> >
> > local]
> >
> > <ip_link_512>--------------|
> >
> > onde estou querendo que o trafego de internet de saida va pelo link_512
e
> > de entrada link_128..... a pergunta e possivel?
> >
> >
> > desde ja agradeço.....
> >
> > _______________________________________________________________
> > Sair da Lista: http://lists.fugspbr.org/listinfo.cgi
> > Historico: http://www4.fugspbr.org/lista/html/FUG-BR/
>
> _______________________________________________________________
> Sair da Lista: http://lists.fugspbr.org/listinfo.cgi
> Historico: http://www4.fugspbr.org/lista/html/FUG-BR/

_______________________________________________________________
Sair da Lista: http://lists.fugspbr.org/listinfo.cgi
Historico: http://www4.fugspbr.org/lista/html/FUG-BR/