UTM реализация "прямого доступа"

$ sudo portinstall p5-Config-General
$ sudo portinstall p5-DBI
$ sudo portinstall p5-DBD-mysql

$ sudo mkdir /usr/inet
$ sudo ee /usr/inet/inetacls_generate

#!/usr/bin/perl —w
#
#  Turn on firewall rules for UTM users having persistent connections.
#  Should be called at startup from /etc/rc.local like following:
#     /root/scripts/enable_persistent_users | sh
#
#  Tested with UTM 3 and ipfw under FreeBSD 5.x on nas.sertolovo.ru.
#
#  Note: this script doesn't call ipfw, but simply displays needed commands.
#        You should manually pass they to shell input via pipe.
#        This is protection against dummy admin.
#
#  Written by Evseev/EBCEEB at Jan 2006
#  Rewritten on Perl at Apr 2006
#  Rewritten using DBI at Sep 2006
#  Rewritten for UTM5 at May 2008
#
# portinstall p5-Config-General
# portinstall p5-DBI
# portinstall p5-DBD-mysql
 
use strict;
use warnings;
 
use FindBin;
use lib "$FindBin::Bin";
use functions;
 
my $cfg = getconfig();
my $dbh = dbconnect();
 
my $rule_num  = $cfg- >{PERSIST_RULENUM} || '999';
my $table_num = $cfg- >{PERSIST_TABLE}   ||   '1';
 
our $check_tariff = $cfg- >{TARIFF_BLOCKED};
    $check_tariff = "and tariff != $check_tariff" if $check_tariff;
 
my $ipfw = "/sbin/ipfw —q";
 
my %allowed_ipaddrs;
 
#-  Routines  -#
 
sub handle_subnet(;$$)
{
        my $query = "SELECT INET_NTOA(4294967295 & ip_groups.ip) AS IP"
                . " FROM ip_groups, iptraffic_service_links, service_links, accounts"
                . " WHERE accounts.int_status != '0'";
        $query .= " AND (4294967295 & ip_groups.ip) >= INET_ATON(?)" if $_[0];  #..ipstart
        $query .= " AND (4294967295 & ip_groups.ip) < = INET_ATON(?)" if $_[1];  #..ipend
        $query .= " AND ip_groups.is_deleted = '0'"
                . " AND iptraffic_service_links.ip_group_id = ip_groups.ip_group_id"
                . " AND iptraffic_service_links.is_deleted = '0'"
                . " AND service_links.id = iptraffic_service_links.id"
                . " AND service_links.is_deleted = '0'"
                . " AND service_links.account_id = accounts.id"
                . " AND accounts.is_deleted = '0'";
 
        my $sth = dbquery($dbh, $query, @_);
 
        $allowed_ipaddrs{$_} = 1 while ($_) = $sth- >fetchrow_array;
}
 
#-  Main routine  -#
 
handle_subnet();
 
my $new_count = &ipfw_table_sync($table_num, \%allowed_ipaddrs);
if ($new_count) {
        print "$ipfw list $rule_num 2 >&1 | grep —q '$rule_num allow ip from table($table_num) to any' || $ipfw add $rule_num allow all from 'table($table_num)' to any\n" ;
        print "$ipfw list $rule_num 2 >&1 | grep —q '$rule_num allow ip from any to table($table_num)' || $ipfw add $rule_num allow all from any to 'table($table_num)'\n" ;
} else {
        print "$ipfw delete $rule_num 2 >/dev/null || echo \"Old rule $rule_num can't be deleted. Probably it's normal.\"\n" ;
}
 
## EOF ##

$ sudo ee /usr/inet/functions.pm

#/usr/bin/perl
 
use strict;
use warnings;
 
use DBI;
use FindBin;
use Config::General;
 
sub getconfig(;$) {
        my $fname = shift || "$FindBin::Bin/options";
        my $conf = new Config::General($fname);
        my %all = $conf- >getall;
        \%all;
}
 
sub dbconnect(;$) {
        my $cfg = shift || getconfig();
 
        my $dbhost = $cfg- >{UTM_DBHOST} || 'localhost';
        my $dbuser = $cfg- >{UTM_DBUSER};
        my $dbpass = $cfg- >{UTM_DBPASS};
        my $dbname = $cfg- >{UTM_DBNAME};
 
        my $dbh = DBI- >connect("DBI:mysql:database=$dbname:host=$dbhost", $dbuser, $dbpass)
                or die "Cannot connect to database $dbhost:$dbname : ".$DBI::errstr."\n";
        $dbh;
}
 
sub dbquery($$;@) {
        my $dbh = shift;
        my $query = shift;
        my $sth = $dbh- >prepare($query)
                or die "Cannot prepare query \"$query\": ".$dbh- >errstr."\n";
        $sth- >execute(@_)
                or die "Cannot execute query \"$query\": ".$dbh- >errstr."\n";
        $sth;
}
 
sub ipfw_table_sync($$)
{
        my ($table_num, $newdata_ref) = (@_);
        my %old;
        my $ipfw = '/sbin/ipfw';
        my $result = 0;
 
        open F, "$ipfw table $table_num list |"
                or die "ipfw_sync_table: $!\n";
 
        while(< F >) {
                chomp;
                next unless /^(\d+\.\d+\.\d+\.\d+)\/\d+\s+(\d+)$/;
                #print "DEBUG: line = \"$_\", A = \“".($1||'undef')."\", B = \“".($2||'undef')."\"\n";
                if (defined $1 and defined $2) {
                        $old{$1} = $2;
                } else {
                        print "# Wrong table line: $_\n";
                }
        }
 
        close F;
 
        while (my ($k,$v) = each %$newdata_ref) {
                $result++;
                #next if defined $old{$k} and $old{$k} eq $v;
                system("$ipfw —q table $table_num add $k $v \n"); # && echo —n \".\"\n";
        }
 
        while (my ($k,$v) = each %old) {
                next if defined $$newdata_ref{$k};
                system("$ipfw —q table $table_num delete $k 2 >/dev/null\n"); # && echo —n \"-\"\n";
        }
 
        print "echo\n";
        $result;
}
 
1;
 
## EOF ##

$ sudo ee /usr/inet/options

#!/bin/sh
 
UTM_DBHOST="192.168.110.2"
UTM_DBUSER="UTM5"
UTM_DBNAME="utm5"
UTM_DBPASS="my password"
 
PERSIST_RULENUM=999
PERSIST_TABLE=1
 
## EOF ##

mysql> GRANT ALL PRIVILEGES ON utm5.* TO  IDENTIFIED BY "my password";

$ sudo /usr/inet/inetacls_generate > /usr/inet/inetacls_apply
$ sudo /usr/inet/inetacls_apply

$ sudo ipfw show 999

00999  18969165   2069893966 allow ip from table(1) to any
00999   6179982   2669213084 allow ip from any to table(1)

$ sudo ipfw table 1 list
192.168.110.10/32 1
192.168.110.11/32 1
192.168.110.13/32 1
192.168.110.16/32 1
192.168.110.17/32 1
192.168.110.23/32 1
192.168.110.25/32 1

ipfw nat 1 config ip 111.111.111.111
ipfw 00400 add nat 1 ip from 'table(1)' to any out via vr0
ipfw 00400 add nat 1 ip from any to 111.111.111.111 in via vr0