嗨: pf 的功能约可分为五部分: (我随便讲的,有错请指正) 1.NAT 2.Load Blancing 3.Alternate Queueing (ALTQ) 4.Firewall 5.Log 我在某个地方弄到两条双向 512k 的 adsl 来玩, 一条是 Hinet,一条是 Seed. 目前大概完成的是 NAT 加 Load Blancing, 我把我的设定公开出来. 目前已知的问题有几个: 1.PF 不能自动侦测对外线路有没断线, 2.虽然是 Load Blancing,不过没办法将两条频宽"视为"一条 　(不过如果用多点序传软体也许就可用到两条线路的频宽, 　还没试,不知道...) 上面这两个问题可能要从 routed 去做, 不过这就超出 pf 的范围,所以将来再说吧. 接下来我在犹豫是要先做 Firewall 或 ALTQ, 搞 Firewall 还要去偷机器来做被保护的对象, 搞 ALTQ 好像还挺复杂... 如果这个设定档,前辈们有觉得不够漂亮的地方, 恳请指点. 唉,都六月中了,照这样下去,等到全部做完, 要办 OpenBSD 3.3 PF 试乘会(啊,不是,是体验会)时,搞不好 3.4 都出来了 >< 你们有人有兴趣参加吗? 喔,对了,第一本 OpenBSD 专书出来罗 : ) http://www.amazon.com/exec/obidos/tg/detail/-/1886411999/002-3001659-5995218 　　　　　　　　　　　　　　　　　ghost 03'06/13 －－－－－－－－－－－－－－－－－－－－－－－－－ pf.conf: # $OpenBSD: pf.conf,v 1.19 2003/03/24 01:47:28 ian Exp $ # # See pf.conf(5) and /usr/share/pf for syntax and examples. # Required order: options, normalization, queueing, translation, filtering. # Macros and tables may be defined and used anywhere. # Note that translation rules are first match while filter rules are last match. # Macros: define common values, so they can be referenced and changed easily. #external_addr1 = "211.21.32.58" #external_addr2 = "210.64.89.130" ext_if1 = "xl0" # replace with actual external interface name i.e., dc0 ext_if2 = "fxp0"# replace with actual external interface name i.e., dc0 int_if = "dc0" # replace with actual internal interface name i.e., dc1 internal_net = "192.168.1.0/24" # nat subnet ext_gw1 = "a.b.c.d" # your gateway ip of external interface 1 ext_gw2 = "d.e.f.g" # your gateway ip of external interface 2 (这些要跟着你的硬体与网路做变更,照抄若通会见鬼喔.) # Tables: similar to macros, but more flexible for many addresses. #table <foo> { 10.0.0.0/8, !10.1.0.0/16, 192.168.0.0/24, 192.168.1.18 } table <isp1> {168.95.4.0/24, 168.95.195.16, 168.95.1.1 } # Hinet SMTP,NEWS,DNS table <isp2> {139.175.54.240, 139.175.55.249, 139.175.55.244 } # Seed SMTP,NEWS,DNS (这些随着你用的 ISP 不同会有不同,如果两条线路都用同一家 ISP 的,就不需要了.) # Normalization: reassemble fragments and resolve or reduce traffic ambiguities. scrub in all # Translation: specify how addresses are to be mapped or redirected. # nat: packets going out through $ext_if with source address $internal_net will # get translated as coming from the address of $ext_if, a state is created for # such packets, and incoming packets will be redirected to the internal address. nat on $ext_if1 from $internal_net to any -> ($ext_if1) nat on $ext_if2 from $internal_net to any -> ($ext_if2) # rdr outgoing FTP requests to the ftp-proxy rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8081 (这一行要配合在 inetd.conf 做对应的设定) # request Service from isp use the Line which provide by that isp pass in on $int_if route-to ($ext_if1 $ext_gw1) round-robin proto tcp from $internal_net to <isp1> flags S/SA modulate state pass in on $int_if route-to ($ext_if2 $ext_gw2) round-robin proto tcp from $internal_net to <isp2> flags S/SA modulate state (这个与 table 那两行是为了让你可以用该 ISP 所提供的 ADSL 连线去取得该 ISP 提供的服务) # Filtering: the implicit first two rules are pass in all pass out all pass quick on lo0 all # pass all outgoing packets on internal interface pass out on $int_if from any to $internal_net # pass in quick any packets destined for the gateway itself pass in quick on $int_if from $internal_net to $int_if # load balance outgoing tcp traffic from internal network. pass in on $int_if route-to { ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } round-robin proto tcp from $internal_net to any flags S/SA modulate state # load balance outgoing udp and icmp traffic from internal network pass in on $int_if route-to { ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } round-robin proto { udp, icmp } from $internal_net to any keep state # route packets from any IPs on $ext_if1 to $ext_gw1 and the same for # $ext_if2 and $ext_gw2 pass out on $ext_if1 route-to ($ext_if2 $ext_gw2) from $ext_if2 to any pass out on $ext_if2 route-to ($ext_if1 $ext_gw1) from $ext_if1 to any # ICQ Client with Load Blancing pass in on $int_if proto tcp from $internal_net to any port 5190 flags S/SA modulate state (在平衡负载功能作用时,加上这行设定才能让 client 正常的连上 ICQ server.) # FTP Client with Load Blancing pass in on $int_if proto tcp from $internal_net to 127.0.0.1 port 8081 flags S/SA keep state (在平衡负载功能作用时,加上这行设定才能让 client 正常的连上 FTP server.) # general "pass out" rules for external interfaces pass out on $ext_if1 proto tcp from any to any flags S/SA modulate state pass out on $ext_if1 proto { udp, icmp } from any to any keep state pass out on $ext_if2 proto tcp from any to any flags S/SA modulate state pass out on $ext_if2 proto { udp, icmp } from any to any keep state －－－－－－－－－－－－－－－－－－－－－－－－－－ -- ＊请加入连署抵制使用 RedHat Linux 8.0 後续版本的行动 http://www.slat.org/event/redhat-flag ＊请支持并参与 Freenix 伺服文件撰写验证计画 http://www.freenix-server.info -- 得　即　高　歌　失　即　休 任　多　悲　愁　也　悠　悠 青　松　影　里　朦　胧　睡 燕　飞　无　楼　月　已　钩 　 　　　 风起云涌II－幽灵