OpenBSD 3.8 双ADSL 架设 负载均衡 NAT服务器

default:
set log Phase Chat LCP  IPCP CCP tun command


# Client side PPP
#
#  Although the PPP protocol is a peer to peer protocol, we normally

# A PPPoE (PPP over Ethernet) setup may look like this:
# Dian Xin
ppp0:
set device "!/usr/sbin/pppoe -i rl0"
set mtu max 1492
set mru max 1492
set speed sync
disable acfcomp protocomp
deny acfcomp
set authname "xy_*******"
set authkey  "1111111"
#set crtscts off
enable lqr
set lqrperiod 5
set cd 5
set dial
set login
set timeout 0
add! default HISADDR
# enable dns
enable mssfixup
set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.255 0.0.0.0


# A PPPoE (PPP over Ethernet) setup may look like this:
# Tie Tong
ppp1:
set device "!/usr/sbin/pppoe -i rl1"
set mtu max 1492
set mru max 1492
set speed sync
disable acfcomp protocomp
deny acfcomp
set authname "p********"
set authkey  "892672"
#set crtscts off
enable lqr
set lqrperiod 5
set cd 5
set dial
set login
set timeout 0
add! default HISADDR
# enable dns
enable mssfixup   

#        $OpenBSD: pf.conf,v 1.29 2005/08/23 02:52:58 henning Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

ext_if0="tun0"
int_if="ne0"
lan_net="192.168.123.0/24"
dis_net="{127.0.0.0/8,192.168.0.0/24,172.16.0.0/12,10.0.0.0/8}"

scrub in on $ext_if0 all fragment reassemble #TCP 连接标准化整形

nat on $ext_if0 from $lan_net  to any -> ($ext_if0)



block out on $ext_if0 all
block in on  $ext_if0 all

antispoof quick for $int_if inet

pass quick on lo0 all

block return-rst out log on $ext_if0 proto tcp all
block return-rst in log on $ext_if0 proto tcp all
block return-icmp out log on $ext_if0 proto udp all
block return-icmp in log on $ext_if0 proto udp all

pass   quick on $int_if all

block drop in quick on $ext_if0 from $dis_net to any
block drop out quick on $ext_if0 from any  to $dis_net

pass out on $ext_if0  proto tcp all flags S/SA modulate state
pass out on $ext_if0  proto {udp,icmp} from any to any keep state

#        $OpenBSD: pf.conf,v 1.29 2005/08/23 02:52:58 henning Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.
ext_if0="tun0"
ext_if1="tun1"
int_if="ne0"
lan_net="192.168.123.0/24"
ext_gw0="tun0:peer"
ext_gw1="tun1:peer"

set block-policy return

scrub in on $ext_if0 all fragment reassemble
scrub in on $ext_if1 all fragment reassemble

nat on $ext_if0 from $lan_net to any -> ($ext_if0)
nat on $ext_if1 from $lan_net to any -> ($ext_if1)

block on $ext_if0 all
block on $ext_if1 all

pass quick on lo0 all

pass out on $int_if from any to $lan_net
pass in quick on $int_if from any to $lan_net

pass in on $int_if route-to \
{ ($ext_if0 $ext_gw0),($ext_if1 $ext_gw1) }  round-robin \
proto tcp from $lan_net to any flags S/SA modulate state

pass in on $int_if route-to \
{($ext_if0 $ext_gw0),($ext_if1 $ext_gw1)} round-robin \
proto {udp,icmp } from $lan_net to any keep state

pass out on $ext_if0 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if1 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if0 proto {udp,icmp} from any to any keep state
pass out on $ext_if1 proto {udp,icmp} from any to any keep state

pass out on $ext_if1 route-to ($ext_if0 $ext_gw0) from $ext_if0 to any
pass out on $ext_if0 route-to ($ext_if1 $ext_gw1) from $ext_if1 to any

#!/bin/sh
sleep 5 # wait the ADSL connetc
fg0=0
fg1=0
echo ====start=== `date` > /root/nat.log

/sbin/pfctl -F all -f /etc/pf1.conf
file=1

test_addr="202.101.224.69"

while :
do
if_add0="192.168.1.1"
if_add1="192.168.1.2"

ifconfig tun0 | grep inet  >>/dev/null
if [ $? -eq 0 ];then
  if_add0="`ifconfig tun0 | grep inet | awk '{printf $2}'`"
fi


ifconfig tun1 | grep inet >>/dev/null
if [ $?  -eq 0 ];then
echo a
  if_add1="`ifconfig tun1 | grep inet | awk '{printf $2}'`"
fi



ping -w 1 -c2 -I $if_add0 $test_addr  >> /dev/null
fg0=$?
ping -w 1 -c2 -I $if_add1 $test_addr  >> /dev/null
fg1=$?
echo "1.<< $if_add0 :$fg0  ,$if_add1 :$fg1 >> "

#=================================================#
echo $fg0,$fg1

if [ $fg0  -eq  $fg1 ];then
  echo 2. $file
  if [ $fg0 -eq 0 ];then
   if [ $file -ne 1 ];then   
   /sbin/pfctl -d
   /sbin/pfctl -e  -f /etc/pf1.conf ;
   echo "chang to --> /etc/pf1.conf :" `date`  >> /root/nat.log
   file=1
   fi
  fi
else
   echo 3.
   if [ $fg0 -eq 0 ]; then
   echo 4. $file
   if [ $file  -ne 0 ];then
   /sbin/pfctl -d
   /sbin/pfctl -e  -f /etc/pf.conf
   echo "chang to --> /etc/pf.conf:" `date` >> /root/nat.log
   file=0
   fi  
  else
    echo 5.
    if [ $file -ne 2 ];then
    /sbin/pfctl -d   
    /sbin/pfctl -e -f /etc/pf2.conf
    echo "chang to --> /etc/pf2.conf:" `date`>>/root/nat.log
    file=2
    fi
  fi
fi
echo "=============================================="


if [ $fg0 -eq $fg1 ] ; then
  sleep 600
else
  if [ $fg0 -ne 0 ] ;then
    PID= `ps -x | grep 'unit 0' | grep ppp0 | awk '{print $1}'`
    kill $PID
    ifconfig tun0 down
    ifconfig tun0 up
    /usr/sbin/ppp -unit 0 -auto ppp0
    echo ADSL _____ INTERNET tun0 `date`  >> /root/nat.log
  else
    PID=`ps -x | grep 'unit 1' | grep ppp1 | awk '{print $1}'`
    kill   $PID
    ifconfig tun1 down
    ifconfig tun1 up
    /usr/sbin/ppp -unit 1 -auto ppp1
    echo ADSL _____ INTERNET tun1 `date` >> /root/nat.log
   fi
fi
echo "=============================================="

done

=====================================

ppp -unit 0 -auto  ppp0
ppp -unit 1 -auto  ppp1
/etc/nat.sh &