Не прошло и пол года, но лучше поздно чем никогда:
1. Нужно собрать ядро с options ROUTETABLES=4
2. Конфиги (реальные с сервера):
nodeny.cfg
#=======================================================================#
# #
# NoDeny - конфигурационный файл ядра #
# #
#=======================================================================#
$Db_name = 'bill'; # имя базы данных NoDeny
$Db_user = 'bill_kernel'; # логин
$Db_pw = '*******'; # пароль
$Db_server = 'localhost'; # Сервер основной базы nodeny
$Db_server_2 = 'localhost'; # Сервер дополнительной базы nodeny,
# может совпадать с $Db_server
$Db_server_a = 'localhost'; # Сервер с базой авторизации,
# может совпадать с $Db_server
$Db_mysql_connect_timeout = 6; # Таймаут на соединение с сервером БД
$Smtp_server = '127.0.0.1'; # smtp сервер, через него будет выслано сообщение администрации о критической ошибке.
# В письме будет указан отправитель nodeny@nodeny.dp.ua
1;
nodeny.cfg.pl
#NoDeny Config File
$VER_cfg = 50.32;
$Nodeny_dir = '/usr/local/nodeny';
$Log_file = '/usr/local/nodeny/nodeny.log';
$Script_adm = '/cgi-bin/adm/adm.pl';
$Script_stat = '/cgi-bin/stat.pl';
$img_dir = '/i';
$Adm_img_f_dir = '/usr/local/www/apache22/data/i/upload';
$Adm_img_dir = '/i/upload';
$db_server = 'localhost';
$db_server2 = 'localhost';
$db_auth_server = 'localhost';
$db_conn_timeout = 4;
$db_conn_timeout2 = 4;
$db_name = 'bill';
$user = 'bill_www';
$pw = '********';
$Passwd_Key = '********';
$Reload_Nets_Time = 0;
@cl_nets = (
''
);
%Collectors = (
'1' => '127.0.0.1-Local ipcad',
);
%l_nets = (
'1' => '0.0.0.0/0-*_*',
);
$MaxSqlLen = 5000;
$MaxCashIp = 1000000;
$Kern_t_to_deny = 150;
$Kern_t_chk_auth = 5;
$Kern_t_traf = 30;
$Kern_t_usr_reload = 60;
$Kern_login_days_keep = 31;
$Kern_Dtraf_days_keep = 31;
$gr = 'грн.';
$kb = 1000;
$m_tarif = 100;
$Plan2_Title = 'Тарифы';
$Plan3_Title = '';
$Plan_got_money_day = 1;
$over_cmp = 1;
$Traf_zero_flush = 0;
$Traf_change_dir = 0;
%srvs = (
);
$Lang = '';
$Title_net = 'Интернет провайдер';
$email_admin = 'adm@gmail.com';
$smtp_server = '127.0.0.1';
$auto_on = 2;
$Max_list_users = 50;
$Max_list_pays = 40;
$Max_line_chanal = 40;
$Block_space_login = 0;
$Auto_ip = 0;
$Bold_out_traf = 1;
$Block_bonus_pay = 1;
$Show_reload_trf = 0;
$MakeMailMess = 'Пароль можете получить/изменить ~url([url="http://xx.xx.xx.xx/cgi-bin/stat.pl?a=110~"]http://xx.xx.xx.xx/c.../stat.pl?a=110~[/url])(здесь~). Установка и настройка почты описана ~url([url="http://xx.xx.xx.xx/index.php?showtopic=123~"]http://xx.xx.xx.xx/i...?showtopic=123~[/url])(здесь~)';
$Tnt_timestamp = 0;
$Block_rus_lat = 1;
$UsrList_cols_template_max = 3;
$How_show_balance = 0;
$Show_detail_traf = 0;
$Show_limit_balance = 0;
$Max_paket_sets = 3;
$mess_max_times = 5;
$mess_day = 15;
$Show_PPC = 1;
$Stat_AddLines = '';
@Plugins = (
'Spays',
'SSeance',
'Sdaytraf',
'Sdetailtraf',
'Stestnet',
'Smessadm',
'Ssetpacket',
'Scards',
'Sgraf'
);
%PluginsAdm = (
'1' => 'agraf-Загрузка канала',
);
$Sat_t_monitor = 24;
$Sat_t_no_ping = 11;
$card_login = 0;
$card_synbl = 14;
$card_slogin = 8;
$card_abc = 0;
$mail_enable = 0;
$mail_host = 'localhost';
$mail_db = 'mail';
$mail_user = 'mail_nodeny';
$mail_pass = '********';
$mail_table = 'users';
$mail_p_email = 'email';
$mail_p_pass = 'passwd';
$mail_p_user = 'name';
$mail_p_dir = 'maildir';
$mail_p_enable = 'enabled';
$mail_check_dir = 1;
@jobs = (
'Подключение',
'Первоначальная настройка',
'Ремонт',
'Настройка'
);
$MPfont = '/usr/local/www/apache22/data/maps/arial.ttf';
$MP_dir = '/maps/';
$MP_Cbox0 = '#000000';
$MP_Cbox1 = '#008000';
$MP_Cbox2 = '#00d000';
$MP_Cbox3 = '#999999';
$MP_Cline = '#0000ff';
$MP_Coffline = '#f0f080';
$MP_graf_clr = '#0088ff';
$MP_name0 = '';
$MP_map0 = '';
$MP_boxR0 = 0;
$MP_size0 = 0;
$MP_start0 = '';
$MP_name1 = '';
$MP_map1 = '';
$MP_boxR1 = 0;
$MP_size1 = 0;
$MP_start1 = '';
$MP_name2 = '';
$MP_map2 = '';
$MP_boxR2 = 0;
$MP_size2 = 0;
$MP_start2 = '';
$MP_name3 = '';
$MP_map3 = '';
$MP_boxR3 = 0;
$MP_size3 = 0;
$MP_start3 = '';
$MP_name4 = '';
$MP_map4 = '';
$MP_boxR4 = 0;
$MP_size4 = 0;
$MP_start4 = '';
$MP_name5 = '';
$MP_map5 = '';
$MP_boxR5 = 0;
$MP_size5 = 0;
$MP_start5 = '';
$MP_name6 = '';
$MP_map6 = '';
$MP_boxR6 = 0;
$MP_size6 = 0;
$MP_start6 = '';
$MP_name7 = '';
$MP_map7 = '';
$MP_boxR7 = 0;
$MP_size7 = 0;
$MP_start7 = '';
$MP_name8 = '';
$MP_map8 = '';
$MP_boxR8 = 0;
$MP_size8 = 0;
$MP_start8 = '';
$MP_name9 = '';
$MP_map9 = '';
$MP_boxR9 = 0;
$MP_size9 = 0;
$MP_start9 = '';
$MP_name10 = '';
$MP_map10 = '';
$MP_boxR10 = 0;
$MP_size10 = 0;
$MP_start10 = '';
$MP_name11 = '';
$MP_map11 = '';
$MP_boxR11 = 0;
$MP_size11 = 0;
$MP_start11 = '';
$MP_name12 = '';
$MP_map12 = '';
$MP_boxR12 = 0;
$MP_size12 = 0;
$MP_start12 = '';
$MP_name13 = '';
$MP_map13 = '';
$MP_boxR13 = 0;
$MP_size13 = 0;
$MP_start13 = '';
%Regions = (
'2' => 'Охотниково-',
'1' => 'Карьерное-',
);
%Presets = (
1 => 'Основной пресет',
);
%Dopfields_tmpl = (
'2' => 'Адрес-',
'1' => 'Технические данные-',
);
%Eq_types = (
);
1;
pf.conf
lan_net = "192.168.15.0/24"
int_if = "em1"
ext_if2 = "re0"
ext_gw2 = "xx.xx.xx.xx"
set limit states 128000
set optimization aggressive
#нат для сети нужно писать по 2 правила иначе кина не будет.
nat pass on re0 from 192.168.4.0/24 to any -> re0
nat pass on em0 from 192.168.4.0/24 to any -> em0
nat pass on em0 from 192.168.3.0/24 to any -> em0
nat pass on re0 from 192.168.5.0/24 to any -> re0
nat pass on em0 from 192.168.5.0/24 to any -> em0
nat pass on em0 from 192.168.6.0/24 to any -> em0
nat pass on re0 from 192.168.7.0/24 to any -> re0
nat pass on em0 from 192.168.7.0/24 to any -> em0
#nat pass on em0 from 192.168.8.0/24 to any -> re0
nat pass on em0 from 192.168.8.0/24 to any -> em0
nat pass on em0 from 192.168.9.0/24 to any -> em0
nat pass on em0 from 192.168.10.0/24 to any -> em0
nat pass on em0 from 192.168.11.0/24 to any -> em0
nat pass on em0 from 192.168.12.0/24 to any -> em0
nat pass on em0 from 192.168.2.0/24 to any -> em0
rc.conf
# -- sysinstall generated deltas -- # Fri Dec 17 22:10:20 2010
# Created: Fri Dec 17 22:10:20 2010
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
defaultrouter="xx.xx.xx.xx"
font8x14="cp866-8x14"
font8x16="cp866b-8x16"
font8x8="cp866-8x8"
gateway_enable="YES"
hostname="neos"
ifconfig_em0="inet xx.xx.xx.xx netmask 255.255.255.252"
ifconfig_em1="inet 192.168.2.1 netmask 255.255.255.0"
keymap="ru.koi8-r"
keyrate="fast"
mousechar_start="3"
saver="daemon"
scrnmap="koi8-r2cp866"
sshd_enable="YES"
mysql_enable="YES"
apache22_enable="YES"
firewall_enable="YES"
mpd_enable="YES"
mysql_dbdir="/usr/mysql"
radiusd_enable="YES"
pf_enable="YES"
ipcad_enable="YES"
# -- sysinstall generated deltas -- # Sun Feb 6 18:33:39 2011
ifconfig_em1="inet 192.168.2.1 netmask 255.255.255.0"
ifconfig em1 alias 192.168.1.1 netmask 255.255.0.0
ifconfig em1 alias 192.168.3.1 netmask 255.255.0.0
ifconfig em1 alias 192.168.4.1 netmask 255.255.0.0
ifconfig em1 alias 192.168.5.1 netmask 255.255.0.0
ifconfig em1 alias 192.168.6.1 netmask 255.255.0.0
ifconfig em1 alias 192.168.7.1 netmask 255.255.0.0
ifconfig em1 alias 192.168.8.1 netmask 255.255.0.0
ifconfig em1 alias 192.168.9.1 netmask 255.255.0.0
ifconfig em1 alias 192.168.10.1 netmask 255.255.0.0
ifconfig em1 alias 192.168.11.1 netmask 255.255.0.0
ifconfig em1 alias 192.168.15.1 netmask 255.255.0.0
hostname="neos.billing"
apache22_enable="YES"
hostname="neos.billing"
dhcpd_enable="YES"
dhcpd_ifaces="em1"
named_enable="YES"
ifconfig_re0="inet 194.24.237.106 netmask 255.255.255.252"
rc.firewall
#!/bin/sh -
f='/sbin/ipfw'
ifOut='em0'
# Сети, в/из которых трафик блокируем
${f} table 120 flush
${f} table 120 add 224.0.0.0/4
${f} table 120 add 172.16.0.0/12
#Сети которые ходят во второй канал
${f} table 30 add 192.168.4.0/24
${f} table 30 add 192.168.5.0/24
${f} table 30 add 192.168.7.0/24
${f} table 30 add 192.168.8.0/24
${f} -f flush
#${f} add 1 allow ip from any to any
${f} add 3 allow tcp from any to me dst-port 3306
${f} add 48 allow ip from any to me dst-port 8890
${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any
${f} add 52 allow tcp from any to me 80
${f} add 53 allow tcp from me 80 to any
${f} add 54 allow tcp from any to me 443
${f} add 55 allow tcp from me 443 to any
${f} add 100 deny tcp from any to any 445
${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 140 deny ip from any to "table(120)"
${f} add 150 deny ip from "table(120)" to any
${f} add 160 skipto 2000 ip from any to me
${f} add 200 skipto 500 ip from any to any via ${ifOut}
${f} add 201 skipto 500 ip from any to any via re0
${f} add 211 fwd 127.0.0.1,81 tcp from "table(35)" to not me dst-port 80
${f} add 212 fwd 127.0.0.1,8080 tcp from not "table(0)" to not me dst-port 80
${f} add 300 setfib 1 ip from "table(30)" to any in
${f} add 350 skipto 4500 ip from any to any in
${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 401 skipto 450 ip from any to any recv re0
${f} add 420 tee 1 ip from any to any
${f} add 450 tee 2 ip from any to any
${f} add 490 allow ip from any to any
${f} add 500 skipto 32500 ip from any to any in
${f} add 510 tee 1 ip from any to any
${f} add 540 allow ip from any to any
${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any
${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2051 deny ip from any to any via re0
${f} add 2060 allow udp from any to any 53,7723
${f} add 2100 deny ip from any to any
${f} add 32490 deny ip from any to any
