#!/bin/sh
cmd="/sbin/ipfw -q"
lif="rl0"
lif_ng="ng*"
pif="fxp0"
#ab500="85.121.64.129/25,85.121.65.1/24,85.121.66.1/23"
#ab350="85.121.68.1/22"
#net="85.121.64.1/21"

ab500="192.168.2.4"
ab350="192.168.2.2,192.168.2.3,192.168.2.1"
net="192.168.0.0/16"

#flush rules
$cmd flush
$cmd pipe flush
$cmd table 1 flush

# pipe 1 --> pipe mare (35M)
# pipe 2 --> pipe download ab500 - mask 0x0000ffff 4096K
# pipe 3 --> pipe download ab350 - mask 0x0000ffff 1024K
# pipe 4 --> pipe upload ab500 - mask 0x0000ffff 512K
# pipe 5 --> pipe upload ab350 - mask 0x0000ffff 256K
# queue 1 --> down trafic prioritizat - mask 0x0000ffff weight 15
# queue 2 --> down trafic neprioritizat - mask 0x0000ffff weight 10

# configurare pipe si cozi
$cmd pipe 1 config bw 35000Kbit/s

#queues download
$cmd queue 1 config weight 15 pipe 1 queue 100 mask dst-ip 0xffffffff
$cmd queue 2 config weight 10 pipe 1 queue 50  mask dst-ip 0xffffffff

# pipe pentru download ab500
$cmd pipe 2 config bw 4096kbits/s mask dst-ip 0xffffffff
#upload ab500
$cmd pipe 4 config bw 512kbit/s mask src-ip 0xffffffff

# pipe pentru download ab350
$cmd pipe 3 config bw 256kbits/s mask dst-ip 0xffffffff
#upload ab350
$cmd pipe 5 config bw 128kbit/s mask src-ip 0xffffffff

#se definesc table cu ip-uri permise
$cmd table 1 add 10.0.0.8
$cmd table 1 add 85.121.64.2

#natd
# static nat pentru camera de comert
#$cmd add 1 divert 8668 ip from any to 88.158.148.251 dst-ip 88.158.148.251 via $pif
#$cmd add 2 divert 8668 ip from any to any src-ip 10.0.0.0/16 via $pif
#$cmd add 3 divert 8668 ip from any to me in recv $pif

#blocare macuri
#$cmd add 4 deny ip from any to any MAC any 00:0d:87:29:69:26

#permit localhost
$cmd add 7 allow ip from any to me
$cmd add 8 allow ip from me to any

$cmd add 10 allow ip from any to any via lo0
$cmd add 20 deny ip from any to 127.0.0.1

# permit ssh si pagina locala
$cmd add 30 allow ip from any to me 222
$cmd add 40 allow ip from me 222 to any

# antispoof
$cmd add 50 deny ip from any to any not verrevpath in

# fixed ips allow
$cmd add 100 queue 1 ip from any to "table(1)" out xmit $lif
$cmd add 110 pipe 2 ip from "table(1)" to any in recv $lif
$cmd add 120 skipto 60000 ip from "table(1)" to any in recv $lif

# se lasa intervalul 1000-3000 pentru deny-uri per client
# blocare MAC-uri
#$cmd add 3620 deny ip from any to any MAC any 00:a0:d2:a4:30:61

#redirectatre useri neconectati cu pppoe
#$cmd add 3630 allow ip from 10.1.1.180 to any in recv $lif
#$cmd add 3630 fwd 10.1.1.1,80 tcp from any to any 80 in recv $lif

# permite trafic din retea catre server si invers
$cmd add 3500 allow ip from me to any out xmit $lif

# antivirus
$cmd add 3600 deny ip from any 135-139,445,1080,2283,2745,2745,3127-3198,5554,8866,10080,65506 to any in
# bloc mirc
$cmd add 3700 deny ip from any to any dst-port 6666, 6667, 6668, 6669, 7000, 9000

$cmd add 3800 deny ip from any to any in recv $lif

# download clienti ab500
# trafic prioritizat
$cmd add 4100 queue 1 ip from any 80,443,53 to $ab500 out xmit $lif_ng
$cmd add 4200 pipe 2 ip from any 80,443,53 to $ab500 out xmit $lif_ng
$cmd add 4300 skipto 60000 ip from any 80,443,53 to $ab500 out xmit $lif_ng

# trafic default
$cmd add 4400 queue 2 ip from any to $ab500 out xmit $lif_ng
$cmd add 4400 pipe 3 ip from any to $ab500 out xmit $lif_ng

# upload clienti ab500
# trafic prioritizat
$cmd add 5200 pipe 4 ip from $ab500 to any in recv $lif_ng

#download clienti ab350
$cmd add 6000 queue 1 ip from any 80,443,53 to $ab350 out xmit $lif_ng
$cmd add 6100 pipe 3 ip from any 80,443,53 to $ab350 out xmit $lif_ng
$cmd add 6200 skipto 60000 ip from any 80,443,53 to $ab350 out xmit $lif_ng
#trafic default
$cmd add 6300 queue 2 ip from any to $ab350 out xmit $lif_ng
$cmd add 6400 pipe 3 ip from any to $ab350 out xmit $lif_ng


#upload clienti ab350
$cmd add 6500 pipe 5 ip from $ab350 to any in recv $lif_ng

#$cmd add 60000 allow ip from any to any
$cmd add 60000 allow ip from any to $ab350 out xmit $lif_ng
$cmd add 60100 allow ip from $ab350 to any in recv $lif_ng

$cmd add 60200 allow ip from any to $net in recv $pif
$cmd add 60300 allow ip from $net to any out xmit $pif