下面是IPFW的規(guī)則
#add deny log ip from any to any ipoptions rr
#add deny log ip from any to any ipoptions ts
#add deny log ip from any to any ipoptions ssrr
#add deny log ip from any to any ipoptions lsrr
#add deny tcp from any to any in tcpflags syn,fin
#########re1 == WAN
#########re0 == LAN
add divert 8668 ip from any to any via re1 #WAN PORT
#add allow tcp from any to me 80
#add allow tcp from any to me 443
#add allow tcp from any to me 25
#add allow tcp from any to me 110
#######dummynet
pipe 1 config bw 50KByte/s
pipe 2 config bw 50KByte/s
add pipe 1 ip from 192.168.1.191 to any out
add pipe 2 ip from any to 192.168.1.191 in
### 192.168.10.2 # 3-4#
pipe 3 config bw 50KByte/s
pipe 4 config bw 50KByte/s
add pipe 3 ip from 192.168.10.2 to any out
add pipe 4 ip from any to 192.168.10.2 in
### 192.168.10.3 # 5-6#
pipe 5 config bw 50KByte/s
pipe 6 config bw 50KByte/s
add pipe 5 ip from 192.168.10.3 to any out
add pipe 6 ip from any to 192.168.10.3 in
。。。。
。。。。
。。。。
#######private network
add allow all from any to any via lo0
############lan #############
############ dns ###########
add allow udp from any 53 to me in recv x10
add allow udp from any 53 to 124.193.200.70
add allow udp from any to any out
add allow udp from any to any in
############
add check-state
add allow tcp from any to any out setup keep-state
add allow tcp from any to any out
add allow udp from any to any out
add allow gre from any to any out setup keep-state
add allow gre from any to any out
add allow udp from any 53 to any
add allow icmp from any to any
add allow all from any to 192.168.10.0/24
add allow all from 192.168.10.0/24 to any
add 65534 deny all from any to any
#add allow icmp from any to any icmptypes 3,4
#add allow icmp from any to any icmptypes 8 out
#add allow icmp from any to any icmptypes 0,11 in
用公司其他機(jī)器測試，下載速度在50K左右，但打開某些網(wǎng)頁速度很慢，而且還有沒限制的機(jī)器上網(wǎng)也很慢，不知道是不是和規(guī)則有關(guān)，請(qǐng)高手指點(diǎn)作者: lsstarboy 時(shí)間: 2008-10-16 17:49
1、都用ipfw了，為什么還要用ipnat？
2、divert natd的兩個(gè)方向最好分開。
3、192.168.10.3和192.168.10.4，192.168.1.191配置基本上差不多，為什么不合到一塊去？
4、限速時(shí)，最好指明xmit和recv。
5、內(nèi)網(wǎng)有點(diǎn)亂，估計(jì)65534規(guī)則沒什么用途。因?yàn)榛旧隙糰llow了。
6、內(nèi)網(wǎng)中，就別用keep-state了，對(duì)你的規(guī)則好像沒什么用途。作者: robinzhao518 時(shí)間: 2008-10-17 10:38
用ipnat做內(nèi)網(wǎng)服務(wù)器的端口映射，用ipfw做流量控制和過濾，但是做了流量控制后延時(shí)增大到50ms左右，特別是當(dāng)打開網(wǎng)站的時(shí)候，網(wǎng)速特別慢，刪除策略后恢復(fù)正常，請(qǐng)問是什么原因?qū)е卵訒r(shí)增大？使用的策略是否有問題？
# ping www.sina.com
PING jupiter.sina.com.cn (202.108.33.32): 56 data bytes
64 bytes from 202.108.33.32: icmp_seq=0 ttl=241 time=45.074 ms
64 bytes from 202.108.33.32: icmp_seq=1 ttl=241 time=45.916 ms
64 bytes from 202.108.33.32: icmp_seq=2 ttl=241 time=47.338 ms
64 bytes from 202.108.33.32: icmp_seq=3 ttl=241 time=45.575 ms
64 bytes from 202.108.33.32: icmp_seq=4 ttl=241 time=45.087 ms作者: lsstarboy 時(shí)間: 2008-10-17 11:20
限速增大延時(shí)正常，因?yàn)槊總�(gè)流量都要通過一個(gè)管道或隊(duì)列。