openbsd做网关路由问题

door10000

1. # vi /etc/pf.conf
   
2. #pass out log on egress proto tcp to any port smtp
   
3. 
   
4. 
   
5. #block in quick from urpf-failed to any # use with care
   
6. 
   
7. # By default, do not permit remote connections to X11
   
8. block in on ! lo0 proto tcp to port 6000:6010
   
9. ext_if="tun0"
   
10. int_if="re1"
    
11. internal_net="192.168.1.0/24"
    
12. 
    
13. # for NAT
    
14. pass out on re0 from 192.168.1.0/24 to any nat-to 10.10.12.100
    
15. pass out on re0 from re1:network to any nat-to re0
    
16. 
    
17. # for firewall
    
18. block in all
    
19. block out all
    
20. pass quick on lo0 all
    
21. pass out on $ext_if proto tcp all modulate state flags S/SA
    
22. pass out on $ext_if proto { udp,icmp } all keep state
    
23. pass in on $int_if from $internal_net to any
    
24. pass out on $int_if from any to $internal_net
    
25. 
    
26. # cat /etc/sysctl.conf
    
27. #       $OpenBSD: sysctl.conf,v 1.53 2012/05/31 15:04:03 sthen Exp $
    
28. #
    
29. # This file contains a list of sysctl options the user wants set at
    
30. # boot time.  See sysctl(3) and sysctl(8) for more information on
    
31. # the many available variables.
    
32. #
    
33. net.inet.ip.forwarding=1        # 1=Permit forwarding (routing) of IPv4 packets
    
34. #net.inet.ip.mforwarding=1      # 1=Permit forwarding (routing) of IPv4 multicast packets
    
35. #net.inet.ip.multipath=1        # 1=Enable IP multipath routing
    
36. #net.inet.icmp.rediraccept=1    # 1=Accept ICMP redirects
    
37. #net.inet6.icmp6.rediraccept=1  # 1=Accept IPv6 ICMP redirects (for hosts)
    
38. net.inet6.ip6.forwarding=1      # 1=Permit forwarding (routing) of IPv6 packets
    
39. #net.inet6.ip6.mforwarding=1    # 1=Permit forwarding (routing) of IPv6 multicast packets
    
40. #net.inet6.ip6.multipath=1      # 1=Enable IPv6 multipath routing
    
41. #net.inet6.ip6.accept_rtadv=1   # 1=Permit IPv6 autoconf (forwarding must be 0)
    
42. #net.inet.tcp.always_keepalive=1 # 1=Keepalives for all connections (e.g. hotel/airport NAT)
    
43. #net.inet.tcp.keepidle=100      # 100=send TCP keepalives every 50 seconds
    
44. #net.inet.tcp.rfc1323=0         # 0=Disable TCP RFC1323 extensions (for if tcp is slow)
    
45. #net.inet.tcp.rfc3390=0         # 0=Disable RFC3390 for TCP window increasing
    
46. #net.inet.esp.enable=0          # 0=Disable the ESP IPsec protocol
    
47. #net.inet.ah.enable=0           # 0=Disable the AH IPsec protocol
    
48. #net.inet.esp.udpencap=0        # 0=Disable ESP-in-UDP encapsulation
    
49. #net.inet.ipcomp.enable=1       # 1=Enable the IPCOMP protocol
    
50. #net.inet.etherip.allow=1       # 1=Enable the Ethernet-over-IP protocol
    
51. #net.inet.tcp.ecn=1             # 1=Enable the TCP ECN extension
    
52. #net.inet.carp.preempt=1        # 1=Enable carp(4) preemption
    
53. #net.inet.carp.log=3            # log level of carp(4) info, default 2
    
54. #ddb.panic=0                    # 0=Do not drop into ddb on a kernel panic
    
55. #ddb.console=1                  # 1=Permit entry of ddb from the console
    
56. #fs.posix.setuid=0              # 0=Traditional BSD chown() semantics
    
57. #vm.swapencrypt.enable=0        # 0=Do not encrypt pages that go to swap
    
58. #vfs.nfs.iothreads=4            # Number of nfsio kernel threads
    
59. #net.inet.ip.mtudisc=0          # 0=Disable tcp mtu discovery
    
60. #kern.usercrypto=1              # 1=Enable userland use of /dev/crypto
    
61. #kern.userasymcrypto=1          # 1=Permit userland to do asymmetric crypto
    
62. #kern.splassert=2               # 2=Enable with verbose error messages
    
63. #kern.nosuidcoredump=2          # 2=Put suid coredumps in /var/crash
    
64. #kern.watchdog.period=32        # >0=Enable hardware watchdog(4) timer if available
    
65. #kern.watchdog.auto=0           # 0=Disable automatic watchdog(4) retriggering
    
66. #kern.pool_debug=0              # 0=Disable pool corruption checks (faster)
    
67. #hw.allowpowerdown=0            # 0=Disable power button shutdown
    
68. machdep.allowaperture=2         # See xf86(4)
    
69. #machdep.apmhalt=1              # 1=powerdown hack, try if halt -p doesn't work
    
70. #machdep.kbdreset=1             # permit console CTRL-ALT-DEL to do a nice halt
    
71. #machdep.lidsuspend=1           # laptop lid closes cause a suspend
    
72. #machdep.userldt=1              # allow userland programs to play with ldt,
    
73.                                 # required by some ports
    
74. #kern.emul.aout=1               # enable running dynamic OpenBSD a.out bins
    
75. #kern.emul.linux=1              # enable running Linux binaries
    
76. #
    

复制代码

door10000

两份配置文档已给出，还有什么需要给出的吗？回复 7# f5b


   

f5b

/etc/pf.conf

文件的内容？

door10000

1. 01.# vi /etc/pf.conf
   
2. 
   
3. 02.#pass out log on egress proto tcp to any port smtp
   
4. 
   
5. 03.
   
6. 
   
7. 04.
   
8. 
   
9. 05.#block in quick from urpf-failed to any # use with care
   
10. 
    
11. 06.
    
12. 
    
13. 07.# By default, do not permit remote connections to X11
    
14. 
    
15. 08.block in on ! lo0 proto tcp to port 6000:6010
    
16. 
    
17. 09.ext_if="tun0"
    
18. 
    
19. 10.int_if="re1"
    
20. 
    
21. 11.internal_net="192.168.1.0/24"
    
22. 
    
23. 12.
    
24. 
    
25. 13.# for NAT
    
26. 
    
27. 14.pass out on re0 from 192.168.1.0/24 to any nat-to 10.10.12.100
    
28. 
    
29. 15.pass out on re0 from re1:network to any nat-to re0
    
30. 
    
31. 16.
    
32. 
    
33. 17.# for firewall
    
34. 
    
35. 18.block in all
    
36. 
    
37. 19.block out all
    
38. 
    
39. 20.pass quick on lo0 all
    
40. 
    
41. 21.pass out on $ext_if proto tcp all modulate state flags S/SA
    
42. 
    
43. 22.pass out on $ext_if proto { udp,icmp } all keep state
    
44. 
    
45. 23.pass in on $int_if from $internal_net to any
    
46. 
    
47. 24.pass out on $int_if from any to $internal_net
    

复制代码

已经给出了。

f5b

结合http://www.openbsd.org/faq/pf/example1.html
还有OpenBSD 5.3默认的/etc/pf.conf

请把你的/etc/pf.conf 更改为以下内容
测试re1所在局域网其他电脑能上网再慢慢修改自己想要的功能吧

1. 
   
2. # increase default state limit from 10'000 states on busy systems
   
3. #set limit states 100000
   
4. 
   
5. int_if="re1"
   
6. 
   
7. set skip on lo
   
8. 
   
9. match out on egress inet from !(tun0:network) to any nat-to (tun0:0)
   
10. 
    
11. block in
    
12. pass out quick
    
13. 
    
14. antispoof quick for { lo $int_if }
    
15. 
    
16. pass in on $int_if
    
17. 
    
18. # By default, do not permit remote connections to X11
    
19. block in on ! lo0 proto tcp to port 6000:6010
    
20. 
    

复制代码

建议学习网址
http://www.openbsd.org/faq/pf/index.html
http://home.nuug.no/~peter/pf/

pppoe那里还可以参考我写的
http://bbs.chinaunix.net/thread-3850797-1-1.html

door10000

回复 15# f5b
谢谢大侠了，把pf配置档按你的一下就通了。不过我想问下那个十万是干什么用的？在忙碌系统中配置起什么作用？

   

door10000

我想配置一个限流2mb路线单个ip并用队列queue限制他们的上传流量要怎么配置？

door10000

另外我发现openbsd中的dhcp配置以后客户端只要获得了dns为网关地址就可以上外网但fb不可以哟一定要手动设置dns才能上外网。

congli

回复 18# door10000


    看规则怎样设吧