14/05/2012
Compartilhamento de internet, Priorização de Tráfego e controle de banda com PF ( OpenBSD Packet Filter ) no FreeBSD 9.
-> Configuração a ser adicionada na recompilação do kernel:
device pf
device pflog
device pfsync
options ALTQ
options ALTQ_RED
options ALTQ_RIO
options ALTQ_CBQ
options ALTQ_CDNR
options ALTQ_PRIQ
options ALTQ_HFSC
options ALTQ_NOPCC # se voce usa sistemas SMP
-> Configuração da inicialização do FreeBSD:
server # more /etc/rc.conf
= int
= ext
pf_enable="YES"
pf_rules="/etc/pf.conf"
pflog_enable="YES"
gateway_enable="YES"
ifconfig_vr0="inet 192.168.1.1 netmask 255.255.255.0"
ifconfig_nfe0="DHCP"
-> Arquivo de configuração do PF:
server # more /etc/pf.conf
# Macros
ext_if="nfe0"
int_if="vr0"
tcp_services = "{ 22, 113, 80, 21 }"
icmp_types = "echoreq"
# Opções
set block-policy return
set loginterface $ext_if
set skip on lo
de Priorização de tráfego e controle de banda (O link será divido em 2 partes).
altq on nfe0 cbq bandwidth 1Mb queue { segmento1, msn, segmento2 }
queue segmento1 bandwidth 2% cbq(default)
queue msn bandwidth 1% cbq(red)
queue segmento2 bandwidth 97% { http, ftp, mail, ssh }
queue http bandwidth 97% priority 7 cbq(ecn, red)
queue ftp bandwidth 1% priority 2 cbq(ecn, red)
queue mail bandwidth 1% priority 5 cbq(borrow, red)
queue ssh bandwidth 1% priority 3 cbq(ecn,red)
da Internet (NAT/PAT)
nat on $ext_if from !($ext_if) to any -> ($ext_if:0)
e Portas
block in
pass out keep state
antispoof quick for { lo $int_if }
pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
pass in on $ext_if inet proto tcp from any to 192.168.1.0/24 port 80 flags S/SA synproxy state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick on $int_if
pass out on nfe0 proto tcp from any to any port 22 queue ssh
pass out on vr0 proto tcp from any to any port 22 queue ssh
in on nfe0 proto tcp from any to any port 22 queue ssh
pass out on nfe0 proto tcp from any to any port 21 queue ftp
pass out on nfe0 proto tcp from any to any port 20 queue ftp
pass out on nfe0 proto tcp from any to any port 80 queue http
pass out on nfe0 proto tcp from any to any port 443 queue https
pass out on nfe0 proto tcp from any to any port 14346 queue ssh
-> Filas de pacotes (pfctl -vvsq):
queue root_nfe0 on nfe0 bandwidth 1Mb priority 0 cbq( wrr root ) {segmento1, segumento3, segmento2}
[ pkts: 4421 bytes: 447414 dropped pkts: 0 bytes: 0 ]
[ qlength: 0/ 50 borrows: 0 suspends: 0 ]
[ measured: 79.8 packets/s, 53.89Kb/s ]
queue segmento1 on nfe0 bandwidth 20Kb cbq( default )
[ pkts: 111 bytes: 10389 dropped pkts: 0 bytes: 0 ]
[ qlength: 0/ 50 borrows: 0 suspends: 0 ]
[ measured: 1.1 packets/s, 846.39 b/s ]
queue msn on nfe0 bandwidth 10Kb cbq( red )
[ pkts: 0 bytes: 0 dropped pkts: 0 bytes: 0 ]
[ qlength: 0/ 50 borrows: 0 suspends: 0 ]
[ measured: 0.0 packets/s, 0 b/s ]
queue segmento2 on nfe0 bandwidth 970Kb {http, https, ftp, mail, ssh}
[ pkts: 0 bytes: 0 dropped pkts: 0 bytes: 0 ]
[ qlength: 0/ 50 borrows: 0 suspends: 0 ]
[ measured: 0.0 packets/s, 0 b/s ]
queue http on nfe0 bandwidth 455.90Kb priority 7 cbq( red ecn )
[ pkts: 3427 bytes: 265403 dropped pkts: 0 bytes: 0 ]
[ qlength: 0/ 50 borrows: 0 suspends: 17 ]
[ measured: 70.2 packets/s, 39.86Kb/s ]
queue https on nfe0 bandwidth 485Kb priority 7 cbq( red ecn )
[ pkts: 867 bytes: 170493 dropped pkts: 0 bytes: 0 ]
[ qlength: 0/ 50 borrows: 0 suspends: 27 ]
[ measured: 8.2 packets/s, 13.05Kb/s ]
queue ftp on nfe0 bandwidth 9.70Kb priority 2 cbq( red ecn )
[ pkts: 16 bytes: 1129 dropped pkts: 0 bytes: 0 ]
[ qlength: 0/ 50 borrows: 0 suspends: 0 ]
[ measured: 0.2 packets/s, 132.36 b/s ]
queue mail on nfe0 bandwidth 9.70Kb priority 5 cbq( red borrow )
[ pkts: 0 bytes: 0 dropped pkts: 0 bytes: 0 ]
[ qlength: 0/ 50 borrows: 0 suspends: 0 ]
[ measured: 0.0 packets/s, 0 b/s ]
queue ssh on nfe0 bandwidth 9.70Kb priority 3 cbq( red ecn )
[ pkts: 0 bytes: 0 dropped pkts: 0 bytes: 0 ]
[ qlength: 0/ 50 borrows: 0 suspends: 0 ]
[ measured: 0.0 packets/s, 0 b/s ]
^C
server #
