模板
教程
环境
性能
功能
管理
用OpenBSD作网关
但是，随着员工数量的增多，同时造成访问互联网拥挤，有时甚至耽误正常的工作需要。
为了解决这个情况，决定对内部员工访问互联网加以限制。
我用一台淘汰的电脑（PIII 500 64M内存）,装了一个OpenBSD 3.6系统，利用自身的PF进行管理。
两块网卡，一块连接Modem 另一快连接内部网络
主要想实现：
1。对内部员工上网限制，只有允许的IP才可以上网。
2。对上网的员工进行分组，分成2组。1组只能浏览网页，另一组没有限制。
3。对不同组进行带宽分配
到现在为止只实现了第一个目的，如果谁能提供帮助请于我联系：QQ：845243 MSN:SlackwareLinux@hotmail.com
以下是我的配置文件
# $OpenBSD: pf.conf,v 1.28 2004/04/29 21:03:09 frantzen Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.
ext_if="rl1"
int_if="rl0"
lan_net="192.3.88.0/24"
Admin="192.3.88.15"
server="{53 80}"
# --- Define Table
table <leader> persist file "/etc/leader_user"
table <software> persist file "/etc/software_user"
table <message> persist file "/etc/message.block"
table <other> persist file "/etc/other.block"
# --- Option
set block-policy drop
set loginterface $ext_if
scrub in all
# --- Queue
altq on $ext_if cbq bandwidth 2Mb queue {other, Admin}
queue other bandwidth 1Mb cbq(default)
queue Admin bandwidth 1Mb priority 3 cbq(borrow)
# --- NAT
#nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat on $ext_if from $Admin -> ($ext_if:0)
nat on $ext_if from <software> -> ($ext_if:0)
nat on $ext_if from <leader> -> ($ext_if:0)
# --- Redirection
rdr on $ext_if proto tcp from any to $ext_if port 22 -> 192.3.88.3 port 22
rdr on $int_if proto tcp from $Admin to $int_if port 8888 -> 192.168.42.1 port 8888
rdr on $int_if proto tcp from $Admin to any port 21 -> 127.0.0.1 port 8021
# --- Block All
block in on $ext_if from $lan_net to any
block out on $ext_if from any to $lan_net
#block on $ext_if all
pass quick on lo0 all
pass out on $ext_if inet proto { tcp udp } from any to any port domain keep state
# ---- Manager SSH
block in on $int_if proto tcp from $lan_net to $int_if port 22
pass in on $int_if proto tcp from $Admin to $int_if port 22 keep state
# --- Pass Administrator
pass out on $ext_if from $Admin to any keep state queue Admin
# --- Pass Table<leader>
pass out on $ext_if proto tcp from <leader> to any port 80 keep state queue other
block out on $ext_if from <leader> to <message>
block out on $ext_if from <leader> to <other>
block in on $int_if from <leader> to <message>
block in on $int_if from <leader> to <other>
# --- Pass Table<software>
pass out on $ext_if from <software> to any keep state queue Admin
