This may be the most effective stat that this program was produced. After I show the manager this page, The network load reduce dramatically. Especially the traffic to movie trailer sites.
Intranet<------->Firewall<------>Internet
FileServer<-----------|
I need to store the outbound traffic statistic , to the server. All
Firewall log message via syslogd must go to FileServer. The firewall
configuration is store on FileServer which must be loaded to FireWall
when the machine start. This allow me to reconfig FireWall without
rewrite new CD (FireWall has only a CD-ROM -- no writeable
storage on FireWall).
cd /home mkdir fwCD cd fwCD mkdir images cd images tar -X ./tar-exclude -c -p -v -f - / | tar xpf -And this is content of tar-exclude
/tmp /home /usr/objNow, you can use the images folder as a images for the boot able CD.
proc /proc procfs rw 0 0
options CD9660 options CD9660_ROOTAll other options are the same as standard FreeBSD firewall.This is my kernel configuration.
/var /tmp /etcThey need to be mounted to mfs (memory file system). These file systems must be mounted as soon as posible. To archive this, you need to set /etc/rc.conf.
ifconfig_xl0="DHCP" diskless_mount="/cdboot/rc.cdboot" sshd_enable="YES" inetd_enable="NO" sendmail_enable="NO"In the /etc/rc.conf, I config my primary interface which connect to the Intranet, with DHCP, therefore, I can change the IP address of the Firewall later.
/sbin/mount_mfs swap /mnt cd /mnt /bin/cp -R -p /etc /mnt /sbin/mount_mfs swap /etc cd / /bin/cp -R -p /mnt/etc / umount /mnt sh /etc/rc.diskless2First, just copy /etc off CD-ROM, remount /etc , and copy tempory stored files to /etc.
#!/bin/sh
# $Id: index.html,v 1.10 2004/02/24 08:11:38 cws Exp $
# start
if [ "x$1" = "xstart" ]; then
m=`/sbin/mount | /usr/bin/grep "/stat"`
if [ "x$m" = "x" ]
then
/sbin/mount_smbfs //FIREWALL@SERVER/FIREWALL /stat
fi
if [ -f /stat/rc ]
then
A
IFCONFIG=/sbin/ifconfig
AWK=/usr/bin/awk
GREP=/usr/bin/grep
if1=`$IFCONFIG -l -u | $AWK -F ' ' '{print $1}'`
ip=`$IFCONFIG ${if1} | $GREP -w inet | $AWK -F ' ' '{print $2}'`
/bin/sh /stat/rc ${ip}
fi
fi
First, the script try to mount /stat to FIREWALL SMB shared on file server(SERVER) using
account FIREWALL, the password is stored in /etc/nsmb.conf -- to /stat.
#!/bin/sh
#
#$Id: index.html,v 1.10 2004/02/24 08:11:38 cws Exp $
#
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin
base_folder=`/usr/bin/dirname $0`
script_name=`echo $base_folder/rc.d/rc.$1`
if [ -f $script_name ];
then
exec $script_name
fi
if [ "x$1" = "x" ];
then
echo usage : $0 caller_ip
else
echo Unknown script name [$script_name]
fi
#!/bin/sh
#
#$Id: index.html,v 1.10 2004/02/24 08:11:38 cws Exp $
#
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin
base_path=`dirname $0`
#Fix errors in CD-ROM images
chmod og+rw /dev/null
#Kill unused daemon that start in CD-ROM etc/rc.conf
killall -9 inetd
killall -9 sendmail
killall -9 dhclient
#Sendmail for outbound mail only.
sendmail -q30m &
hostname firewall.net0.intranet
#Config network interface and routing
route delete default 2>/dev/null
ifconfig xl1 inet 192.168.1.1 netmask 255.255.255.0
route add default 192.168.1.254
#Make /etc read/write
chown -R root:wheel /etc
cd /etc/mail
make
#Copy program need for ipaudit
mkdir /var/ipaudit
cp ${base_path}/../scripts/ipaudit /var/ipaudit
cp ${base_path}/../scripts/cappkg.pl /var/ipaudit
cp ${base_path}/../scripts/synclock.sh /var/ipaudit
#Home for root
mkdir /var/root
mkdir /var/admin
chown admin:admin /var/admin
#Start package capture stat
/var/ipaudit/cappkg.pl &
/var/ipaudit/synclock.sh &
#Install cron
crontab -u root ${base_path}/../config/10.0.0.200/crontab
cp ${base_path}/../config/192.168.0.1/periodic.conf /etc
#--------------------
# Firewall configuration
# Prevent any host to use this host as a switch.
#--------------------
#Enable gateways and routing
sysctl net.inet.ip.forwarding=1 >/dev/null
routed -s &
ipfw=/sbin/ipfw
sysctl net.inet.ip.fw.dyn_max=8192
${ipfw} -q flush
#Not need with current rule set because we have keep-stat
#Rule
#${ipfw} add check-state
#Limit bandwidth
#${ipfw} add pipe 1 ip from ${x.x.x.x} to any out
#${ipfw} add pipe 2 ip from ${x.x.x.x} to any in
#${ipfw} pipe 1 config bw 64Kbit/s queue 10Kbytes
#${ipfw} pipe 2 config bw 64Kbit/s queue 10Kbytes
#Traffic to firewall
${ipfw} add allow ip from me to any
${ipfw} add allow ip from any to me
#If you have multiple external lines and want to divert some traffic
#${ipfw} add forward a.b.c.d ip from x.x.x.x to not ${x.x.x.x/24}
#Open firewall -- trade security with convenient
${ipfw} add 65535 allow ip from any to any
vnconfig -s labels -c vn0 boot.flp mount /dev/vn0 /mnt #Copy new kernel gzip -c images/kernel > /mnt/kernel.gzTo make standard kernel boot from CD-ROM instead of first hard disk , modify /mnt/boot/loader.rc to
set vfs.root.mountfrom="cd9660:acd0a" load /kernel echo \007\007 autoboot 3When finished with boot.flp ,
umount /mnt vnconfig -u vn0 cp boot.flp images/boot.flp
mkisofs -l -R -L -o fwCD.iso -b boot.flp -c boot.catalog imagesThen burn the CD.
burncd -f /dev/acd0a -s 8 data fwCD.iso fixateNow you got them
# DO NOT EDIT THIS FILE - edit the master and reinstall. # (/tmp/crontab.nkFFKn2GAm installed on Thu Apr 10 10:02:12 2003) # (Cron version -- $FreeBSD: src/usr.sbin/cron/crontab/crontab.c,v 1.12.2.4 2001/06/16 03:18:37 peter Exp $) 20 0-23/2 * * * /var/ipaudit/synclock.sh 0 * * * * /var/ipaudit/cappkg.pl
#!/bin/sh #$Id: index.html,v 1.10 2004/02/24 08:11:38 cws Exp $ # # What files override these defaults ? # See /etc/default/periodic.conf for options # Daily options # Weekly options # 310.locate weekly_locate_enable="NO" # Update locate weekly # 320.whatis weekly_whatis_enable="NO" # Update whatis weekly
host firewall {
hardware ethernet XX:XX:XX:XX:XX:XX;
fixed-address firewall.net0.intranet;
option routers X.X.X.X;
}
Don't forget the line routers -- set it to any IP that is not firewall.net0.intranet.
Note:
$STAT_CFG['RAWSTAT_FOLDER'] = '/home/firewall/traffic/raw';
$STAT_CFG['COOKEDSTAT_FOLDER']='/home/firewall/traffic/cooked';
$STAT_CFG['CURRENTSTAT_FOLDER']='/home/firewall/traffic/raw/current';
$STAT_CFG['CRONLOG_FILE'] = '/home/firewall/cronlog.txt';
$STAT_CFG['STAT_COOKER'] = '/home/firewall/public_html/tools/cookstat.php';
Change them to the folder that you store the statistic collected from firewall.
See cappkg.pl source code for more detail.
$STAT_CFG['LOCALNET'] = '10\.\d{1,3}\.\d{1,3}\.\d{1,3}';
$STAT_CFG['LOADGRAPH'] = array( array('TITLE'=>'ALL','NET'=>'255.255.255.255'),
array('TITLE'=>'NET0','NET'=>'10.0.0.255'),
array('TITLE'=>'NET1','NET'=>'10.0.1.255'));
Change them to match your local network configuration. The LOCALNET
string is perl pattern that match the IP range of your local network.
The LOADGRAPH is an array to indicate number of graphs to be shown.
$STAT_CFG['MAX_TRAFFIC'] = 128;
Change the value to match maximum bandwidth of your network. The unit of
this value is Kbit per second.
2 * * * * /home/firewall/public_html/tools/cron_run.php
10 0 * * * /home/firewall/public_html/tools/cook_remotehost.php
Note: I run the scripts at xx:02 and 0:10 becase I want
the cappkg.pl a time to copy the data to file server.
|
|
Network loading graph of last 60 minutes. |
|
|
Daily Network loading graph. |
|
|
Network loading detail. |
|
|
Local Host Monthly Network loading statistic. This may be the most effective stat that this program was produced. After I show the manager this page, The network load reduce dramatically. Especially the traffic to movie trailer sites. |
The document theme copy from
FreeBSD Handbook
For questions about this documentation, e-mail <cws@miraclenet.co.th>.
Last update : $Id: index.html,v 1.10 2004/02/24 08:11:38 cws Exp $