One additional piece of information that’s needed to do this is the IP address of the adjacent router on each Internet connection. This is fed to the route-to option to control the destination of outgoing packets.

The following example balances outgoing traffic across two Internet connections:

lan_net = “192.168.0.0/24″
int_if = “dc0″
ext_if1 = “fxp0″
ext_if2 = “fxp1″
ext_gw1 = “68.146.224.1″
ext_gw2 = “142.59.76.1″

pass in on $int_if route-to \
{ ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } round-robin \
from $lan_net to any keep state

The route-to option is used on traffic coming in on the internal interface to specify the outgoing network interfaces that traffic will be balanced across along with their respective gateways. Note that the route-to option must be present on each filter rule that traffic is to be balanced for. Return packets will be routed back to the same external interface that they exited (this is done by the ISPs) and will be routed back to the internal network normally.

To ensure that packets with a source address belonging to $ext_if1 are always routed to $ext_gw1 (and similarly for $ext_if2 and $ext_gw2), the following two lines should be included in the ruleset:

pass out on $ext_if1 route-to ($ext_if2 $ext_gw2) from $ext_if2 \
to any
pass out on $ext_if2 route-to ($ext_if1 $ext_gw1) from $ext_if1 \
to any

Finally, NAT can also be used on each outgoing interface:

nat on $ext_if1 from $lan_net to any -> ($ext_if1)
nat on $ext_if2 from $lan_net to any -> ($ext_if2)

A complete example that load balances outgoing traffic might look something like this:

lan_net = “192.168.0.0/24″
int_if = “dc0″
ext_if1 = “fxp0″
ext_if2 = “fxp1″
ext_gw1 = “68.146.224.1″
ext_gw2 = “142.59.76.1″

# nat outgoing connections on each internet interface
nat on $ext_if1 from $lan_net to any -> ($ext_if1)
nat on $ext_if2 from $lan_net to any -> ($ext_if2)

# default deny
block in from any to any
block out from any to any

# pass all outgoing packets on internal interface
pass out on $int_if from any to $lan_net
# pass in quick any packets destined for the gateway itself
pass in quick on $int_if from $lan_net to $int_if
# load balance outgoing tcp traffic from internal network.
pass in on $int_if route-to \
{ ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } round-robin \
proto tcp from $lan_net to any flags S/SA modulate state
# load balance outgoing udp and icmp traffic from internal network
pass in on $int_if route-to \
{ ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } round-robin \
proto { udp, icmp } from $lan_net to any keep state

# general “pass out” rules for external interfaces
pass out on $ext_if1 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if1 proto { udp, icmp } from any to any keep state
pass out on $ext_if2 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if2 proto { udp, icmp } from any to any keep state

# route packets from any IPs on $ext_if1 to $ext_gw1 and the same for
# $ext_if2 and $ext_gw2
pass out on $ext_if1 route-to ($ext_if2 $ext_gw2) from $ext_if2 to any
pass out on $ext_if2 route-to ($ext_if1 $ext_gw1) from $ext_if1 to any

from http://openbsd.org/faq/pf/pools.html

Pc-Router Speknya

PIII -1Ghz-Memory 256Mhz -Hardisk 40 Gb

Konfigurasinya

1. Interface Konfigurasi

/ interface ethernet
set Modem1 name=”Modem1″ mtu=1500 mac-address=00:10:4B:0D:95:02 arp=enabled \
disable-running-check=yes auto-negotiation=yes full-duplex=yes \
cable-settings=default speed=100Mbps comment=”” disabled=no
set Lan name=”Lan” mtu=1500 mac-address=00:0D:88:B2:7D:50 arp=enabled \
disable-running-check=yes auto-negotiation=yes full-duplex=yes \
cable-settings=default speed=100Mbps comment=”” disabled=no
set Modem2 name=”Modem2″ mtu=1500 mac-address=00:13:46:2C:DE:13 arp=enabled \
disable-running-check=yes auto-negotiation=yes full-duplex=yes \
cable-settings=default speed=100Mbps comment=”” disabled=no
2. Ip Address Konfigurasi

/ ip address
add address=192.168.0.254/24 network=192.168.0.0 broadcast=192.168.0.255 \
interface=Lan comment=”” disabled=no
add address=192.168.1.2/24 network=192.168.1.0 broadcast=192.168.1.255 \
interface=Modem1 comment=”” disabled=no
add address=192.168.2.2/24 network=192.168.2.0 broadcast=192.168.2.255 \
interface=Modem2 comment=”” disabled=no

3. Routing IP

/ ip route
add dst-address=0.0.0.0/0 gateway=192.168.2.1 scope=255 target-scope=10 \
routing-mark=odd comment=”” disabled=no
add dst-address=0.0.0.0/0 gateway=192.168.1.1 scope=255 target-scope=10 \
routing-mark=even comment=”” disabled=no
add dst-address=0.0.0.0/0 gateway=192.168.1.1 scope=255 target-scope=10 \
comment=”” disabled=no

4. Mangle Marking Paket

/ ip firewall mangle

a. Load Balancing
add chain=prerouting in-interface=Lan connection-state=new nth=1,1,0 \
action=mark-connection new-connection-mark=odd passthrough=yes \
comment=”Load Balancing” disabled=no
add chain=prerouting in-interface=Lan connection-mark=odd action=mark-routing \
new-routing-mark=odd passthrough=no comment=”” disabled=no
add chain=prerouting in-interface=Lan connection-state=new nth=1,1,1 \
action=mark-connection new-connection-mark=even passthrough=yes comment=”” \
disabled=no
add chain=prerouting in-interface=Lan connection-mark=even action=mark-routing \
new-routing-mark=even passthrough=no comment=”” disabled=no

b. Turunin latensy ( ping ke dns )

add chain=prerouting src-address=192.168.0.0/24 protocol=icmp \
action=mark-connection new-connection-mark=ICMP-CM passthrough=yes \
comment=”ToS” disabled=no
add chain=prerouting connection-mark=ICMP-CM action=mark-packet \
new-packet-mark=ICMP-PM passthrough=yes comment=”” disabled=no
add chain=prerouting packet-mark=ICMP-PM action=change-tos new-tos=min-delay \
comment=”” disabled=no
add chain=prerouting src-address=192.168.0.0/24 protocol=tcp dst-port=53 \
action=mark-connection new-connection-mark=DNS-CM passthrough=yes \
comment=”” disabled=no
add chain=prerouting src-address=192.168.0.0/24 protocol=udp dst-port=53 \
action=mark-connection new-connection-mark=DNS-CM passthrough=yes \
comment=”” disabled=no
add chain=prerouting connection-mark=DNS-CM action=mark-packet \
new-packet-mark=DNS-PM passthrough=yes comment=”” disabled=no
add chain=prerouting packet-mark=DNS-PM action=change-tos new-tos=min-delay \
comment=”” disabled=no

c. Tandain Services Yang mau di prioritykan
add chain=prerouting protocol=tcp dst-port=80 action=mark-connection \
new-connection-mark=http_conn passthrough=yes comment=”Tandai Service” \
disabled=no
add chain=prerouting connection-mark=http_conn action=mark-packet \
new-packet-mark=http passthrough=no comment=”” disabled=no
add chain=prerouting protocol=tcp dst-port=6000-7000 action=mark-connection \
new-connection-mark=irc_conn passthrough=yes comment=”” disabled=no
add chain=prerouting connection-mark=irc_conn action=mark-packet \
new-packet-mark=irc passthrough=no comment=”” disabled=no
add chain=prerouting protocol=tcp dst-port=5050-5061 action=mark-connection \
new-connection-mark=ym_conn passthrough=yes comment=”” disabled=no
add chain=prerouting connection-mark=ym_conn action=mark-packet \
new-packet-mark=ym passthrough=no comment=”” disabled=no
add chain=prerouting protocol=tcp dst-port=8291 action=mark-connection \
new-connection-mark=mt_conn passthrough=yes comment=”” disabled=no
add chain=prerouting connection-mark=mt_conn action=mark-packet \
new-packet-mark=mt passthrough=no comment=”” disabled=no
add chain=prerouting protocol=tcp dst-port=443 action=mark-connection \
new-connection-mark=http_conn passthrough=yes comment=”” disabled=no

d. Optimasi Proxy pada paket mark

add chain=prerouting src-address=192.168.0.0/24 action=mark-packet \
new-packet-mark=Naik passthrough=no comment=”Up Traffic” disabled=yes
add chain=forward src-address=192.168.0.0/24 action=mark-connection \
new-connection-mark=Koneksi passthrough=yes comment=”Conn-Mark” \
disabled=yes
add chain=output out-interface=Lan dst-address=192.168.0.0/24 \
action=mark-packet new-packet-mark=Turun passthrough=no comment=”Down-Via \
Proxy” disabled=yes

4. Filter Firewall

/ ip firewall filter

a. penentuan proteksi router

add chain=input connection-state=invalid action=drop comment=”Drop invalid \
connections” disabled=no
add chain=input connection-state=established action=accept comment=”Allow \
esatblished connections” disabled=no
add chain=input connection-state=related action=accept comment=”Allow related \
connections” disabled=no
add chain=input protocol=udp action=accept comment=”Allow UDP” disabled=no
add chain=input protocol=icmp action=accept comment=”Allow ICMP” disabled=no
add chain=input in-interface=!Modem1 action=accept comment=”Allow connection \
to router from local network” disabled=no
add chain=input in-interface=!Modem2 action=accept comment=”” disabled=no
add chain=input action=accept comment=”” disabled=no
add chain=forward in-interface=Lan protocol=tcp dst-port=6112 \
connection-limit=100,32 action=reject reject-with=icmp-network-unreachable \
comment=”” disabled=no

b. penentuan proteksi dari akses gain ke router
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list \
address-list=”port scanners” address-list-timeout=2w comment=”Port \
scanners to list ” disabled=no

add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg \
action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w comment=”NMAP FIN Stealth scan” disabled=no
add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list \
address-list=”port scanners” address-list-timeout=2w comment=”SYN/FIN \
scan” disabled=no
add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list \
address-list=”port scanners” address-list-timeout=2w comment=”SYN/RST \
scan” disabled=no
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack \
action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w comment=”FIN/PSH/URG scan” disabled=no
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg \
action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w comment=”ALL/ALL scan” disabled=no
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg \
action=add-src-to-address-list address-list=”port scanners” \
address-list-timeout=2w comment=”NMAP NULL scan” disabled=no
add chain=input src-address-list=”port scanners” action=drop comment=”dropping \ port scanners” disabled=no

c. Drop Port Aneh2
add chain=virus protocol=tcp dst-port=135-139 action=drop comment=”Drop \
Blaster Worm” disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment=”Drop \
Messenger Worm” disabled=no
add chain=virus protocol=tcp dst-port=445-3000 action=drop comment=”Drop \
Blaster Worm” disabled=no
add chain=virus protocol=udp dst-port=445-3000 action=drop comment=”Drop \
Blaster Worm” disabled=no
add chain=virus protocol=tcp dst-port=593 action=drop comment=”________” \
disabled=no
add chain=virus protocol=udp dst-port=7000 action=drop comment=”Setan1″ \
disabled=no
add chain=virus protocol=tcp dst-port=100-1000 action=drop comment=”Setan1″ \
disabled=no
add chain=virus protocol=udp dst-port=100-1000 action=drop comment=”Drop \
Messenger Worm” disabled=no
add chain=virus protocol=tcp dst-port=1000-3000 action=drop comment=”Setan1″ \
disabled=no
add chain=virus protocol=udp dst-port=1000-3000 action=drop comment=”Drop \
Messenger Worm” disabled=no
add chain=virus protocol=tcp dst-port=40000-50000 action=drop comment=”Setan1″ \
disabled=no
add chain=virus protocol=udp dst-port=40000-50000 action=drop comment=”Drop \
Messenger Worm” disabled=no
add chain=virus protocol=tcp dst-port=7000 action=drop comment=”Setan1″ \
disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment=”Drop \
Messenger Worm” disabled=no
add chain=virus protocol=tcp dst-port=7000 action=drop comment=”Setan1″ \
disabled=no
add chain=virus protocol=tcp dst-port=25 action=drop comment=”Drop Blaster \
Worm” disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment=”Drop \
Messenger Worm” disabled=no
add chain=virus action=return comment=”” disabled=no
add chain=virus protocol=tcp dst-port=110 action=drop comment=”Drop Blaster \
Worm” disabled=no

5. Proxy

a. Aktivasi proxy di ip web proxy

/ ip web-proxy
set enabled=yes src-address=0.0.0.0 port=8080 hostname=”proxy.phonix.net” \
transparent-proxy=yes parent-proxy=0.0.0.0:0 \
cache-administrator=”webmaster@phonix.net” max-object-size=4096KiB \
cache-drive=system max-cache-size=unlimited max-ram-cache-size=unlimited

max-cache-size=unlimited max-ram-cache-size=unlimited –>> tegantung besar hardisk

b. memblok web disini

/ ip web-proxy access
add dst-port=23-25 action=deny comment=”block telnet & spam e-mail relaying” \
disabled=no

c. optimasi cache isi web

/ ip web-proxy cache
add action=allow comment=”” disabled=no
add url=”http*youtube*get_video*” action=allow comment=”YouTube” disabled=no
add url=”http*friendster.com” action=allow comment=”Friendster” disabled=no
add url=”http*pu.go.id” action=allow comment=”PU” disabled=no
add url=”http*detik*com” action=allow comment=”Detik” disabled=no
add url=”http*domai.com” action=allow comment=”Domai” disabled=no
add url=”http*nigmae.net” action=allow comment=”Nigmae” disabled=no
add url=”http*kompas.com” action=allow comment=”Kompas” disabled=no
add url=”http*lalatx.com” action=allow comment=”Lalatx” disabled=no
add url=”http*yahoo.com” action=allow comment=”Yahoo” disabled=no
add url=”http*kapanlagi.com” action=allow comment=”Kapanlagi” disabled=no
add url=”http*plasa.com” action=allow comment=”Plasa” disabled=no
add url=”http*kaskus.us” action=allow comment=”Kaskus” disabled=no
add url=”http*avaxhome*org” action=allow comment=”Avaxhome” disabled=no
add url=”www.worth1000.com” action=allow comment=”Worth1000″ disabled=no
add action=allow comment=”Allow sado alahe” disabled=no
add url=”:cgi-bin \\?” action=deny comment=”don’t cache dynamic http pages” \
disabled=no

6. Quee type

/ queue type
set default name=”default” kind=pfifo pfifo-limit=50
set ethernet-default name=”ethernet-default” kind=pfifo pfifo-limit=50
set wireless-default name=”wireless-default” kind=sfq sfq-perturb=5 \
sfq-allot=1514
set synchronous-default name=”synchronous-default” kind=red red-limit=60 \
red-min-threshold=10 red-max-threshold=50 red-burst=20 red-avg-packet=1000
set hotspot-default name=”hotspot-default” kind=sfq sfq-perturb=5 \
sfq-allot=1514

a. pcq konsep
add name=”pcq-download” kind=pcq pcq-rate=0 pcq-limit=50 \
pcq-classifier=dst-address pcq-total-limit=2000
add name=”pcq-upload” kind=pcq pcq-rate=0 pcq-limit=50 \
pcq-classifier=src-address pcq-total-limit=2000

b. limit bw untuk icmp

add name=”PFIFO-64″ kind=pfifo pfifo-limit=64

add name=”default-small” kind=pfifo pfifo-limit=10

7. quee simple untuk bagi bw /pc

/ queue simple
add name=”Phonix.Net” dst-address=192.168.0.0/24 interface=Lan parent=none \
priority=1 queue=ethernet-default/ethernet-default limit-at=0/768000 \
max-limit=0/768000 total-queue=default disabled=no
add name=”01″ target-addresses=192.168.0.1/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”02″ target-addresses=192.168.0.2/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”03″ target-addresses=192.168.0.3/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”04″ target-addresses=192.168.0.4/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”05″ target-addresses=192.168.0.5/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”06″ target-addresses=192.168.0.6/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”07″ target-addresses=192.168.0.7/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”08″ target-addresses=192.168.0.8/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”09″ target-addresses=192.168.0.9/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”10″ target-addresses=192.168.0.10/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”11″ target-addresses=192.168.0.11/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”12″ target-addresses=192.168.0.12/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”13″ target-addresses=192.168.0.13/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”14″ target-addresses=192.168.0.14/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”15″ target-addresses=192.168.0.15/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=8/96000 \
total-queue=default disabled=no
add name=”16″ target-addresses=192.168.0.16/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”17″ target-addresses=192.168.0.17/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”18″ target-addresses=192.168.0.18/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net packet-marks=”” priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”19″ target-addresses=192.168.0.19/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”20″ target-addresses=192.168.0.20/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”21″ target-addresses=192.168.0.21/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”22″ target-addresses=192.168.0.22/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net packet-marks=”” priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”23″ target-addresses=192.168.0.23/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”24″ target-addresses=192.168.0.24/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no
add name=”25″ target-addresses=192.168.0.25/32 dst-address=0.0.0.0/0 \
interface=Lan parent=Phonix.Net packet-marks=”” priority=8 \
queue=ethernet-default/ethernet-default limit-at=0/16000 max-limit=0/96000 \
total-queue=default disabled=no

8. quee tree

/ queue tree

a. pcq
add name=”downstream” parent=Lan packet-mark=Turun limit-at=0 \
queue=pcq-download priority=1 max-limit=0 burst-limit=0 burst-threshold=0 \
burst-time=0s disabled=no
add name=”upstream” parent=global-in packet-mark=Naik limit-at=0 \
queue=pcq-upload priority=1 max-limit=0 burst-limit=0 burst-threshold=0 \
burst-time=0s disabled=no

b. bw over untuk icmp / latensy
add name=”ICMP” parent=global-in packet-mark=ICMP-PM limit-at=8000 \
queue=PFIFO-64 priority=1 max-limit=16000 burst-limit=0 burst-threshold=0 \
burst-time=0s disabled=no
add name=”DNS” parent=global-in packet-mark=DNS-PM limit-at=8000 \
queue=PFIFO-64 priority=1 max-limit=16000 burst-limit=0 burst-threshold=0 \
burst-time=0s disabled=no

sebenernya gak susah sih bikin N link load balancer
asal PCI slot di PC router linux-nya cukup buat di taro-in N ethernet card
yang saya pake di rumah cuma 2 link load balancer & NAT pake Ubuntu
bisa di kembangin jadi N link gak susah sama sekali sih

Saya gak bisa upload tu catatan ke forum ini
soalnya gede banget ini cuplikan load balancer-nya ..

/sbin/ip link set lo up
/sbin/ip link set eth0 up
/sbin/ip link set eth1 up
/sbin/ip link set eth2 up

/sbin/ip route flush table adsl
/sbin/ip route flush table rtrwnet
/sbin/ip route flush table internet

/sbin/ip addr add 127.0.0.1/8 brd 127.0.0.255 dev lo

/sbin/ip addr add 192.168.1.222/24 brd 192.168.1.255 dev eth2
# /sbin/ip addr add 10.0.148.48/24 brd 10.0.148.255 dev eth0
/sbin/ip addr add 192.168.0.222/24 brd 192.168.0.255 dev eth1

/sbin/ip route add 127.0.0.0/8 dev lo
/sbin/ip route add 10.5.148.0/24 via 10.0.148.254 dev eth0
/sbin/ip route add 192.168.0.0/24 dev eth1
/sbin/ip route add 44.132.33.0/24 via 192.168.0.10 dev eth1
/sbin/ip route add 192.168.11.0/24 via 192.168.0.10 dev eth1
/sbin/ip route add 125.160.6.0/24 via 192.168.1.1 dev eth2
/sbin/ip route add 202.159.32.0/24 via 192.168.1.1 dev eth2

/sbin/ip rule add prio 10 table main
/sbin/ip rule add prio 20 table adsl
/sbin/ip rule add prio 30 table rtrwnet
/sbin/ip rule add prio 40 table internet

/sbin/ip route del default table main
/sbin/ip route del default table adsl
/sbin/ip route del default table rtrwnet
/sbin/ip route del default table internet

/sbin/ip rule add prio 20 from 192.168.1.0/24 table adsl
/sbin/ip route add default via 192.168.1.1 dev eth2 src 192.168.1.222 proto static table adsl
/sbin/ip route append prohibit default table adsl metric 1 proto static

/sbin/ip rule add prio 30 from 10.0.148.0/24 table rtrwnet
/sbin/ip route add default via 10.0.148.254 dev eth0 src 10.0.148.48 proto static table rtrwnet
/sbin/ip route append prohibit default table rtrwnet metric 5 proto static

# Set up load balancing gateways
/sbin/ip rule add prio 40 table internet
/sbin/ip route add default proto static table internet \
nexthop via 192.168.1.1 dev eth2 weight 1 \
nexthop via 10.0.148.254 dev eth0 weight 10

# Setup routing to ISPs
/sbin/ip route add 202.138.236.0/24 proto static table internet \
nexthop via 192.168.1.1 dev eth2 weight 10 \
nexthop via 10.0.148.254 dev eth0 weight 1

Yang akan dilakukan :

1. Menggunakan semua jalur gateway yang tersedia dengan teknik load-balancing.
2. Menjadikan salah satunya sebagai back-up dengan teknik fail-over.

OK, mari saja kita mulai eksperimennya :

1. IP address untuk akses ke LAN :
> /ip address add address=192.168.0.1/28 interface=LAN
IP address untuk akses ke jalur DSL :
> /ip address add address=10.32.57.253/29 interface=DSL
IP address untuk akses ke jalur Wireless :
> /ip address add address=10.9.8.2/29 interface=WIRELESS
Tentukan gateway dengan rasionya masing-masing :
> /ip route add gateway=10.32.57.254,10.9.8.1,10.9.8.1
2. Pada kasus untuk teknik fail-over. Diasumsikan jalur utama melalui Wireless dengan jalur DSL sebagai back-up apabila jalur utama tidak dapat dilalui. Untuk mengecek apakah jalur utama dapat dilalui atau tidak, digunakan command ping.
> /ip firewall mangle add chain=prerouting src-address=192.168.0.0/28 action=mark-routing new-routing-mark=SUBNET1-RM
> /ip route add gateway=10.9.8.1 routing-mark=SUBNET1-RM check-gateway=ping
> /ip route add gateway=10.32.57.254
3. Good Luck!!

*** Welcome to pfSense 1.2-RC3-pfSense on pfsense ***

LAN* -> fxp0 -> NONE

OPT1(OPT1) -> fxp1 -> NONE
OPT2(OPT2) -> fxp2 -> NONE
WAN* -> fxp3 -> NONE
OPT3(OPT3) -> fxp4 -> NONE

pfSense console setup
***********************
0) Logout (SSH only)
1) Assign Interfaces
2) Set LAN IP address
3) Reset webConfigurator password
4) Reset to factory defaults
5) Reboot system
6) Halt system
7) Ping host 8) Shell
9) PFtop
10) Filter Logs
11) Restart webConfigurator
12) pfSense PHP shell
13) Upgrade from console

Enter an option:

Selanjutnya proses yg dilakukan adalah :

1. Melakukan setting LAN utk masuk ke WEB Admin dgn cara pilihan No. 1 (Assign Interfaces)

VLAN Capable interfaces:

fxp0 00:50:8b:9a:da:9a (up)
fxp1 00:d0:b7:15:56:fa
fxp2 00:a0:c9:b3:a2:4d
fxp3 00:d0:b7:15:54:05 (up)
fxp4 00:d0:b7:15:66:ec

Enter the parent interface name for the new VLAN (or nothing if finished): fxp0
Enter the VLAN tag (1-4094): 1

Kemudian isi NIC yg terdeteksi/tertulis berikutnya spt di atas, misalnya VLAN : fpx1 atau VLAN=wl01. Atau biarkan dgn value kosong dan tekan enter.
Selanjutnya setting LAN

Enter the LAN interface name or ‘a’ for auto-detection: fxp0

Enter the WAN interface name or ‘a’ for auto-detection: ^

Utk setting WAN dpt kita lewati dulu karena dpt di setting melalui Web Console kalau LANnya sdh selesai di setting. Utk itu kita hanya biarkan dgn value kosong dan tekan enter.

2. Setting LAN IP Address. Pilih 2)Set LAN IP Address

Enter the new LAN IP address: 10.1.2.1

Subnet masks are entered as bit counts (as in CIDR notation) in pfSense.
e.g. 255.255.255.0 = 24
255.255.0.0 = 16
255.0.0.0 = 8

Enter the new LAN subnet bit count: 24

Do you want to enable the DHCP server on LAN [y|n]? n

IP Address = 10.1.2.1,Subnet Mask= 24 (255.255.255.0) dan utk saya DHCP tdk di aktifkan.

Dr pengalaman saya biasanya kita akan bingung network card yg mana yg dikenali sbg LAN krn terdapat lebih dr satu NIC. Utk itu saya melakukan testing dgn mengkoneksikan secara bergantian NIC yg ada dan melakukan ping ke jaringan LAN. Pilih pd CLI console no 8 (Shell) dan lakukan ping ke PC lain di LAN. Setelah di ketahui beri tanda pada NIC tersebut.

3. Selanjutnya kita bisa setting melalui Web Console dgn mengakses alamat http://10.1.2.1 .

Username : admin

Password : pfsense (default)

4. Setting WAN’s Address utk ISP

Selanjutnya klik Interfaces -> WAN utk setting IP Address ISP 1

IP Address : 202.155.73.42/28

Gateway : 202.155.73.41

Klik Save

Selanjutnya klik Interfaces -> OPT1 utk setting IP Address ISP 2 (Speedy)

Option Enable OPT1 : ON

IP Address : 192.168.1.100

Gateway : 192.168.1.1

Klik Save

5. Setting DNS

Klik System -> General Setup

DNS1 : 202.155.0.20 (NS Indosat)

DNS2 : 202.134.0.155 (NS Telkom Speedy)

6. Setting Route DNS Path

Klik System – Static Route -> +
WAN : Indosat

Interfaces : WAN

Destination Network : 202.155.0.20/32

Gateway : 202.155.73.41

OPT1 :Telkom Speedy

Interfaces : OPT1

Destination Network : 202.134.0.155/32

Gateway : 192.168.1.1

Hasilnya spt berikut :Route DNS Path

Klik tombol Apply Changes

7. Setting Load Balancer

Klik Services -> Load Balancer ->+
Name : Balancer

Type : Gateway

Behavior : Load Balancing

Monitor IP : Other -> misalnya isi dgn DNS : 202.155.0.20

Interfaces Name : WAN

Klik Add to poll

Lanjutkan mengisi monitor IP ISP ke 2

Monitor IP : Other -> 202.134.0.155

Interfaces Name : OPT1

Klik Add to poll

Klik Save

TIPS :

Utk memaksimalkan kerja, Monitor IP sebaiknya dicari IP Address router di seberang ISP sana dr posisi router di kantor yg tercepat dan terdekat dan tdk harus dgn IP DNS. Dapat di ketahui dgn melakukn trace route ke DNS ISP

Hasilnya spt gbr berikut

LoadBalancer

8. Setting Firewall Rules

Klik Firewall -> Rules

Selanjutnya lakukan konfigurasi sbb :

A. Setting LAN

Action : Pass

Interface : LAN

Protokol : TCP

Source : Type = LAN Subnet

Destination : Type = any

Gateway : Balancer

Klik Save & Apply Changes

LANRules

B. Setting WAN -> Link Indosat

Action : Pass

Interface : WAN

Protokol : TCP

Source : Type = LAN Subnet

Destination : Type = WAN Address

Gateway : 202.155.73.41

Klik Save & Apply Changes

WANRules

B. Setting OPT1 -> Link Speedy

Action : Pass

Interface : OPT1

Protokol : TCP

Source : Type = LAN Subnet

Destination : Type = OPT1 Address

Gateway : 192.168.1.1

Klik Save & Apply Changes

Dokumentasi ini hanya menjelaskan setting dasar dr Load Balancing di pfsense. Banyak lagi yg bisa kita lakukan dgn fungsi firewall, routing, aliasing, nat, incoming balancing, bandwith management. Ini bisa di gali informasinya pd website www.pfsense.org.

Pra Syarat:

1. kernel sudah dikompile support pf
2. ada 3 buah lancard, 2 untuk koneksi wan dan 1 untuk koneksi lan
3. dua line koneksi ISP atau Speedy

Lakukan compile kernel agar support pf firewall dan builtin dalam kerne merujuk ke http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-pf.html.
# cd /usr/src/sys/i386/conf
# cp GENERIC ROUTER
# ee ROUTER

#——– Tambahkan baris berikut pada konfigurasi kernel anda ——–#
###—untuk support PF—-###
device pf
device pflog
device pfsync
###—untuk support altq cbq jika diperlukan nanti —#
options ALTQ
options ALTQ_CBQ
options ALTQ_RED
options ALTQ_HFSC
options ALTQ_PRIO
options ALTQ_NOPCC

Save konfigurasi kernel tersebut.
Setelah mengedit konfigurasi kernel lalu saya mengcompile kernel ulang.
# cd /usr/src/sys/i386/conf
# config ROUTER
# cd ../compile/ROUTER
# make cleandepend; make depend; make; make install

Setelah tahap instalasi kernel baru selesai, saya perlu mengonfigurasi rc.conf untuk keperluan pf berjalan ketika boot:
# ee /etc/rc.conf

###—tambahkan ini —###
pf_enable=”YES” # Enable PF (load module if required)
pf_rules=”/etc/pf.conf” # rules definition file for pf
pf_flags=”” # additional flags for pfctl startup
pflog_enable=”YES” # start pflogd( 8)
pflog_logfile=”/var/log/pflog”# where pflogd should store the logfile
pflog_flags=”” # additional flags for pflogd startup
gateway_enable=”YES” # Enable as LAN gateway
router_flags”=”-q”
router= “sbin/routed”
router_enable=”YES”
defaultrouter=”10.0.0.1″ #masukan salah satu gateway koneksi isp anda

Save hasil edit rc.conf tersebut.
Langkah selanjutnya membuat konfigurasi pf.conf untuk pool loadbalancing. Dalam percobaan ini saya menggunakan konfigurasi http://www.openbsd.org/faq/pf/pools.html#outexample.

# ee /etc/pf.conf

#—– Isi konfigurasi pf —–#
lan_net = “192.168.1.0/24″
int_if = “rl2″
ext_if1 = “rl0″
ext_if2 = “rl1″
ext_gw1 = “10.0.0.1″
ext_gw2 = “10.0.0.2″

# nat outgoing connections on each internet interface
nat on $ext_if1 from $lan_net to any -> ($ext_if1)
nat on $ext_if2 from $lan_net to any -> ($ext_if2)

# default deny
block in from any to any
block out from any to any

# pass all outgoing packets on internal interface
pass out on $int_if from any to $lan_net
# pass in quick any packets destined for the gateway itself
pass in quick on $int_if from $lan_net to $int_if
# load balance outgoing tcp traffic from internal network.
pass in on $int_if route-to \
{ ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } round-robin \
# load balance outgoing udp and icmp traffic from internal network
pass in on $int_if route-to \
{ ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } round-robin \
proto { udp, icmp } from $lan_net to any keep state

# general “pass out” rules for external interfaces
pass out on $ext_if1 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if1 proto { udp, icmp } from any to any keep state
pass out on $ext_if2 proto tcp from any to any flags S/SA modulate state
pass out on $ext_if2 proto { udp, icmp } from any to any keep state

# route packets from any IPs on $ext_if1 to $ext_gw1 and the same for
# $ext_if2 and $ext_gw2
pass out on $ext_if1 route-to ($ext_if2 $ext_gw2) from $ext_if2 to any
pass out on $ext_if2 route-to ($ext_if1 $ext_gw1) from $ext_if1 to any
#—selesai—#

Save konfigurasi pf tersebut.
# reboot

selesai sudah tahap pembuatan router load balancing dua koneksi internet.

Saran: Untuk kenyamanan anda silahkan custumize port-port yang diperlukan untuk dilewatkan atau diblok.
Periksa kembali dokumentasi squid dan pf jika anda ingin menjalankan transparent proxy.

Network
http://boedot.wordpress.com/2007/12/12/multi-load-balancing-dgn-pfsense/
http://www.kaskus.us/archive/index.php/t-782374-p-7.html — install squid di pfsense
http://id.infobsd.org/2008/04/install-squid-transparent-on-openbsd-42.html

Linux
http://www.awali.org/forum/viewthread.php?forum_id=5&thread_id=280 — distro linux mirip xp
http://sindos.wordpress.com
http://vixta.org/ — distro linux mirip Vista

Network
http://boedot.wordpress.com/2007/12/12/multi-load-balancing-dgn-pfsense/
http://www.kaskus.us/archive/index.php/t-782374-p-7.html — install squid di pfsense
http://id.infobsd.org/2008/04/install-squid-transparent-on-openbsd-42.html

Film etc

http://yudymardianto.wordpress.com

wifi & antena

http://pe2er.nl/biquad/index.htm
http://pe2er.nl/biquadusb/index.htm