Priority Queue B/W Link-share Real-time Upper-limit
m1 d m2 m1 d m2 m1 d m2
======== ============== ==== ==== ==== ==== ==== ==== ==== ==== ==== ====
1 qP2P 1% 0 1000 50%
2 qOthersLow 4% 1%
3 qOthersDefault 50% 1%
4 qOthersHigh 20% 8%
5 qGames 10% 4%
6 qACK 5% 2%
7 qVoIP 10% 4%
======== ============== ==== ==== ==== ==== ==== ==== ==== ==== ==== ====
TOTAL 100% 20%

Proto Src Port Dst Port Gateway Queue Sched Description
===== === ==== === ==== ======= =================== ===== ======================
* * * * * * qP2P * catch-all out
TCP * * * 3389 * qACK/qOthersDefault * MSRDP out
TCP * * * 1723 * qACK/qOthersHigh * PPTP out
GRE * * * * * qOthersHigh * PPTPGRE out
UDP * * * 500 * qOthersHigh * IKE out
ESP * * * * * qOthersHigh * IPSEC out
TCP * * * 22 * qACK/qGames * SSH out
UDP * * * 53 * qOthersHigh * DNS out
TCP * * * 53 * qACK/qOthersHigh * DNS out
UDP * * * 123 * qOthersHigh * NTP out
TCP * * * 123 * qACK/qOthersHigh * NTP out
ICMP * * * * * qOthersHigh * ICMP out
IGRP * * * * * qOthersHigh * IGRP out
TCP * * * 80 * qACK/qOthersDefault * HTTP out
TCP * * * 443 * qACK/qOthersDefault * HTTPS out
TCP * * * 25 * qACK/qOthersLow * SMTP out
TCP * * * 143 * qACK/qOthersDefault * IMAP out
TCP * * * 110 * qACK/qOthersLow * POP3 out
TCP * * * 119 * qACK/qOthersLow * NNTP out
===== === ==== === ==== ======= =================== ===== ======================

Name Interface Gateway Monitor IP Description
====== ========= =========== ========== =========================
LAN_GW LAN .0.42 .0.42 LAN static gateway
GW_WAN WAN 10.0.0.10 10.0.0.10 ISP C static gateway
ISPA1 OPT1 11.0.0.10 11.0.0.11 ISP A 1st dynamic gateway
ISPA2 OPT2 11.0.0.10 11.0.0.12 ISP A 2nd dynamic gateway
ISPB OPT3 12.0.0.10 11.0.0.13 ISP B gateway
====== ========= =========== ========== =========================

Name: Servers
Description: server zones
Type: Network(s)
Network CIDR Description
======== ==== ===========
.4.0 24 LAN4
.8.0 24 LAN8
.9.0 24 LAN9
======== ==== ===========

Proto Source Port Destination Port Gateway Queue Sched Description
======= =========== ==== =========== ==== ========== ===== ===== ===============
TCP .8.101 * * 25 ISPA1 * * Rule a)
TCP .9.202 * * 25 ISPA2 * * Rule b)
TCP * * * 25 ISPB * * Rule c)
TCP .0.0/22 * * 5050 ISPA1first * * Rule d)
TCP .4.0/22 * * 5050 ISPA2first * * Rule e)
TCP/UDP Servers * * 53 ISPAfirst * * Rule f)
TCP/UDP * * * 53 ISPBfirst * * Rule g)
TCP/UDP * * * 123 ISPAonly * * Rule h)
TCP * * Vietnam 80 ISPAfirst * * Rule i)
TCP * * * 80 ISPBfirst * * Rule j)
* * * * * AnyLink * * Rule k)
======= =========== ==== =========== ==== ========== ===== ===== ===============

Interface Source Source Dest Dest NAT NAT Static Description
Port Port Addr Port Port
========= ======= ====== ====== ===== ==== ==== ====== =========================
OPT1 .0.0/16 * * * * * NO LAN to Internet via OPT1
OPT2 .0.0/16 * * * * * NO LAN to Internet via OPT2
OPT3 .0.0/16 * * * * * NO LAN to Internet via OPT3
OPT1 10/8 * * * * * NO WAN to Internet via OPT1
OPT2 10/8 * * * * * NO WAN to Internet via OPT2
OPT3 10/8 * * * * * NO WAN to Internet via OPT3
========= ======= ====== ====== ===== ==== ==== ====== =========================

Interface Proto Ext.port range NAT IP Int.port range Description
========= ======= ============== ====== ============== =========================
OPT1 TCP 25 .8.100 25 mail.company1.com
OPT2 TCP 25 .9.100 25 mail.company2.com
========= ======= ============== ====== ============== =========================

Proto Source Port Dest Port Gateway Queue Sched Description
======= ====== ==== ====== ==== ======= ===== ===== ============================
...
TCP * * .8.100 25 * none NAT mail.company1.com
======= ====== ==== ====== ==== ======= ===== ===== ============================

11.0.0.11 11.0.0.12
\ /
ISP C \ ISP A / ISP B
\ /
10.0.0.10 11.0.0.10 12.0.0.10
| / \ |
| | | |
| | | |
| | | |
+------+-----------+-----------+-----------+------+
| 10.0.0.90 11.1.0.91 11.2.0.92 12.0.0.93 |
| WAN OPT1 OPT2 OPT3 |
| |
| G |
| |
| LAN |
| .0.41 |
+------------------------+------------------------+
|
|
+------------------------+------------------------+
| .0.42 |
| WAN |
| |
| F |
| |
| LAN1 LAN2 LAN3 ... LAN9 |
| .1.1 .2.1 .3.1 .9.1 |
+---+--------+--------+-----------------------+---+
| | | |
.1.0/24 .2.0/24 .3.0/24 .9.0/24

route add -net 192.168.0.0/16 192.168.0.42

racoon.conf
path pre_shared_key "/var/etc/psk.txt";
path certificate "/var/etc";
remote 70.71.72.73 {
exchange_mode main;
my_identifier fqdn "1234.mycompany.com.vn";
certificate_type x509 "server1-signed.pem" "server1-key.pem";
peers_certfile "peer1-signed.pem";
peers_identifier address 70.71.72.73;
initial_contact on;
support_proxy on;
proposal_check obey;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method rsasig;
dh_group 2;
lifetime time 604800 secs;
}
lifetime time 604800 secs;
}
sainfo address 192.168.1.0/27 any address 192.168.3.0/27 any {
encryption_algorithm rijndael;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
pfs_group 2;
lifetime time 28800 secs;
}
remote 60.61.62.63 {
exchange_mode main;
my_identifier fqdn "1234.mycompany.com.vn";
certificate_type x509 "server2-signed.pem" "server2-key.pem";
peers_identifier address 60.61.62.63;
initial_contact on;
support_proxy on;
proposal_check obey;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method rsasig;
dh_group 5;
lifetime time 604800 secs;
}
lifetime time 604800 secs;
}
sainfo address 192.168.1.0/27 any address 192.168.2.0/27 any {
encryption_algorithm rijndael;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
pfs_group 5;
lifetime time 28800 secs;
}
SPD
192.168.1.0/24[any] 192.168.1.1[any] any
in none
spid=27 seq=5 pid=30876
refcnt=1
192.168.3.0/27[any] 192.168.1.0/27[any] any
in ipsec
esp/tunnel/70.71.72.73-50.51.52.53/unique#16402
spid=30 seq=4 pid=30876
refcnt=1
192.168.2.0/27[any] 192.168.1.0/27[any] any
in ipsec
esp/tunnel/60.61.62.63-50.51.52.53/unique#16404
spid=32 seq=3 pid=30876
refcnt=1
192.168.1.1[any] 192.168.1.0/24[any] any
out none
spid=28 seq=2 pid=30876
refcnt=1
192.168.1.0/27[any] 192.168.3.0/27[any] any
out ipsec
esp/tunnel/50.51.52.53-70.71.72.73/unique#16401
spid=29 seq=1 pid=30876
refcnt=1
192.168.1.0/27[any] 192.168.2.0/27[any] any
out ipsec
esp/tunnel/50.51.52.53-60.61.62.63/unique#16403
spid=31 seq=0 pid=30876
refcnt=1
SAD
50.51.52.53 70.71.72.73
esp mode=tunnel spi=3661296152(0xda3af218) reqid=16401(0x00004011)
E: rijndael-cbc aa568542 7e3c4a68 47334abf 2a15fc36
A: hmac-md5 47ca65a4 e0698485 9b9041f0 0a0f82fc
seq=0x00000f14 replay=4 flags=0x00000000 state=mature
created: Aug 13 18:42:08 2006 current: Aug 14 00:41:53 2006
diff: 21585(s) hard: 28800(s) soft: 23040(s)
last: Aug 14 00:41:46 2006 hard: 0(s) soft: 0(s)
current: 680448(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3860 hard: 0 soft: 0
sadb_seq=3 pid=30878 refcnt=2
70.71.72.73 50.51.52.53
esp mode=tunnel spi=145706343(0x08af4d67) reqid=16402(0x00004012)
E: rijndael-cbc fcbc7fba 828b27a1 36415592 30c26179
A: hmac-md5 36e837c9 f772708e 5d4884cf 65014749
seq=0x00000ee2 replay=4 flags=0x00000000 state=mature
created: Aug 13 18:42:08 2006 current: Aug 14 00:41:53 2006
diff: 21585(s) hard: 28800(s) soft: 23040(s)
last: Aug 14 00:41:46 2006 hard: 0(s) soft: 0(s)
current: 748767(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 3810 hard: 0 soft: 0
sadb_seq=2 pid=30878 refcnt=1
50.51.52.53 60.61.62.63
esp mode=tunnel spi=45808782(0x02bafc8e) reqid=16403(0x00004013)
E: rijndael-cbc 818a7e9d 2115a45c f2271aff 171cecda
A: hmac-md5 9fc84bf5 8cacf00c 4cf615f4 890d9ffb
seq=0x00000289 replay=4 flags=0x00000000 state=mature
created: Aug 13 21:00:15 2006 current: Aug 14 00:41:53 2006
diff: 13298(s) hard: 28800(s) soft: 23040(s)
last: Aug 14 00:41:36 2006 hard: 0(s) soft: 0(s)
current: 160040(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 649 hard: 0 soft: 0
sadb_seq=1 pid=30878 refcnt=2
60.61.62.63 50.51.52.53
esp mode=tunnel spi=209810343(0x0c8173a7) reqid=16404(0x00004014)
E: rijndael-cbc 82d2908e 88368716 9da0d6b1 b8dac65c
A: hmac-md5 78fa014d 793d9706 1e095ae8 0d8e286f
seq=0x00000213 replay=4 flags=0x00000000 state=mature
created: Aug 13 21:00:15 2006 current: Aug 14 00:41:53 2006
diff: 13298(s) hard: 28800(s) soft: 23040(s)
last: Aug 14 00:41:36 2006 hard: 0(s) soft: 0(s)
current: 82847(bytes) hard: 0(bytes) soft: 0(bytes)
allocated: 531 hard: 0 soft: 0
sadb_seq=0 pid=30878 refcnt=1

System uptime
12:41AM up 167 days, 22:50, 0 users, load averages: 0.00, 0.00, 0.00
Processes
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
root 0 0.0 0.0 0 0 ?? DLs 28Feb06 0:00.00 (swapper)
root 30865 0.0 0.9 1332 968 ?? SN 12:41AM 0:00.00 sh -c ps xauww 2>&1
root 30843 0.0 1.7 2376 1812 ?? S 12:41AM 0:00.05 /usr/local/sbin/mini_httpd -S -E...
root 30842 0.0 1.7 2376 1812 ?? S 12:41AM 0:00.00 /usr/local/sbin/mini_httpd -S -E...
root 30841 0.0 6.3 7388 6820 ?? SN 12:41AM 0:02.23 /usr/local/bin/php status.php
root 59869 0.0 1.4 1880 1568 ?? INs 28Feb06 0:02.27 /usr/local/sbin/dhcpd -cf... xl0
nobody 59864 0.0 0.8 1040 844 ?? SN 28Feb06 0:40.57 /usr/local/sbin/dnsmasq --server=...
root 59818 0.0 2.0 2504 2152 ?? INs 28Feb06 5:09.18 /usr/local/sbin/racoon -d -f ...
root 25043 0.0 0.8 1104 824 ?? IN 28Feb06 0:02.24 /usr/local/bin/msntp -r -P no -l ...
root 25042 0.0 0.9 1332 996 ?? IN 28Feb06 0:00.11 /bin/sh ...
root 252 0.0 0.7 1016 788 ?? SN 28Feb06 0:09.24 /usr/local/bin/ez-ipupdate -c ...
root 166 0.0 0.8 1336 904 ?? I 28Feb06 0:00.22 /bin/sh /etc/rc.initial console
root 157 0.0 0.8 1224 856 ?? Is 28Feb06 0:05.02 /usr/sbin/dropbear -r ... -d...
root 100 0.0 1.5 2292 1644 ?? Ss 28Feb06 12:28.75 /usr/local/sbin/mini_httpd -S -E -c...
root 97 0.0 0.7 1004 736 ?? Ss 28Feb06 14:35.56 /usr/sbin/syslogd -ss
root 88 0.0 1.1 1456 1224 ?? Ss 28Feb06 20:00.48 /sbin/ipmon...
root 77 0.0 1.0 1444 1100 ?? Is 28Feb06 0:10.13 /sbin/dhclient -nw -cf ... fxp0
root 9 0.0 0.0 0 0 ?? DL 28Feb06 1:12.24 (vnlru)
root 8 0.0 0.0 0 0 ?? DL 28Feb06 3:08.83 (syncer)
root 7 0.0 0.0 0 0 ?? DL 28Feb06 57:42.83 (bufdaemon)
root 6 0.0 0.0 0 0 ?? DL 28Feb06 0:10.76 (pagedaemon)
root 5 0.0 0.0 0 0 ?? DL 28Feb06 0:00.00 (usbtask)
root 4 0.0 0.0 0 0 ?? DL 28Feb06 0:01.64 (usb0)
root 3 0.0 0.0 0 0 ?? DL 28Feb06 0:00.00 (taskqueue)
root 2 0.0 0.0 0 0 ?? DL 28Feb06 0:00.00 (cryptoret)
root 1 0.0 0.6 1060 696 ?? ILs 28Feb06 1:05.89 /sbin/init --
root 30866 0.0 0.6 1084 676 ?? RN 12:41AM 0:00.00 ps xauww

Interfaces
fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=40<POLLING>
inet 50.51.52.53 netmask 0xffffff00 broadcast 50.51.52.255
ether 00:a0:49:e1:e2:e4
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=1<RXCSUM>
inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
ether 00:50:50:d8:a8:56
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
xl1: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
options=1<RXCSUM>
ether 00:50:50:d8:b1:8e
media: Ethernet autoselect (none)
status: no carrier
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet 127.0.0.1 netmask 0xff000000
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 50.51.52.1 UGSc 5 70117308 fxp0
50.51.52/24 link#1 UC 1 0 fxp0
50.51.52.1 00:13:11:13:b4:ad UHLW 5 67 fxp0 1199
50.51.52.53 127.0.0.1 UGHS 0 0 lo0
127.0.0.1 127.0.0.1 UH 1 0 lo0
192.168.2.10/32 192.168.1.1 UGSc 1 2 xl0
192.168.1 link#2 UC 3 0 xl0
192.168.1.1 00:50:50:d8:a8:56 UHLW 4 0 lo0
192.168.1.17 00:04:76:36:77:7c UHLW 2 161523 xl0 1141
192.168.3.16/32 192.168.1.1 UGSc 1 9145 xl0

ipfw show
50000 723957 140632208 allow ip from 192.168.1.1 to any
50001 479961 59527905 allow ip from any to 192.168.1.1
50002 8873712 726357103 queue 7 tcp from any 6881-6999 to any in via fxp0
50003 0 0 queue 7 tcp from any to any dst-port 6881-6999 in via fxp0
50004 0 0 queue 5 tcp from any 6881-6999 to any out via fxp0
50005 9107395 818207561 queue 5 tcp from any to any dst-port 6881-6999 out via fxp0
50006 0 0 queue 7 ip from any 412 to any in via fxp0
50007 0 0 queue 7 ip from any to any dst-port 412 in via fxp0
50008 0 0 queue 5 ip from any 412 to any out via fxp0
50009 0 0 queue 5 ip from any to any dst-port 412 out via fxp0
50010 2291 829355 queue 7 ip from any 1044-1045 to any in via fxp0
50011 40411 1926621 queue 7 ip from any to any dst-port 1044-1045 in via fxp0
50012 40659 2961631 queue 5 ip from any 1044-1045 to any out via fxp0
50013 2821 494679 queue 5 ip from any to any dst-port 1044-1045 out via fxp0
50014 3 792 queue 7 ip from any 1214 to any in via fxp0
50015 1091 305412 queue 7 ip from any to any dst-port 1214 in via fxp0
50016 1137 155949 queue 5 ip from any 1214 to any out via fxp0
50017 5 454 queue 5 ip from any to any dst-port 1214 out via fxp0
50018 7 348 queue 7 ip from any 2340 to any in via fxp0
50019 2139 571035 queue 7 ip from any to any dst-port 2340 in via fxp0
50020 2307 411250 queue 5 ip from any 2340 to any out via fxp0
50021 7 1034 queue 5 ip from any to any dst-port 2340 out via fxp0
50022 0 0 queue 7 ip from any 4329 to any in via fxp0
50023 283 104332 queue 7 ip from any to any dst-port 4329 in via fxp0
50024 332 26344 queue 5 ip from any 4329 to any out via fxp0
50025 0 0 queue 5 ip from any to any dst-port 4329 out via fxp0
50026 301708 14926636 queue 7 ip from any 4661-4665 to any in via fxp0
50027 33814 4297927 queue 7 ip from any to any dst-port 4661-4665 in via fxp0
50028 33517 2342698 queue 5 ip from any 4661-4665 to any out via fxp0
50029 309789 26084187 queue 5 ip from any to any dst-port 4661-4665 out via fxp0
50030 354 148622 queue 7 ip from any 5190 to any in via fxp0
50031 0 0 queue 7 ip from any to any dst-port 5190 in via fxp0
50032 0 0 queue 5 ip from any 5190 to any out via fxp0
50033 263 31657 queue 5 ip from any to any dst-port 5190 out via fxp0
50034 2449 116307 queue 7 ip from any 5500-5503 to any in via fxp0
50035 0 0 queue 7 ip from any to any dst-port 5500-5503 in via fxp0
50036 0 0 queue 5 ip from any 5500-5503 to any out via fxp0
50037 2502 167472 queue 5 ip from any to any dst-port 5500-5503 out via fxp0
50038 339938 16902251 queue 7 ip from any 6346 to any in via fxp0
50039 0 0 queue 7 ip from any to any dst-port 6346 in via fxp0
50040 0 0 queue 5 ip from any 6346 to any out via fxp0
50041 352959 37879703 queue 5 ip from any to any dst-port 6346 out via fxp0
50042 3336 346923 queue 7 ip from any 6666-6668 to any in via fxp0
50043 0 0 queue 7 ip from any to any dst-port 6666-6668 in via fxp0
50044 0 0 queue 5 ip from any 6666-6668 to any out via fxp0
50045 3461 198648 queue 5 ip from any to any dst-port 6666-6668 out via fxp0
50046 230 15112 queue 7 ip from any 6699-6701 to any in via fxp0
50047 0 0 queue 7 ip from any to any dst-port 6699-6701 in via fxp0
50048 0 0 queue 5 ip from any 6699-6701 to any out via fxp0
50049 372 49649 queue 5 ip from any to any dst-port 6699-6701 out via fxp0
50050 5 904 queue 7 ip from any 7668 to any in via fxp0
50051 0 0 queue 7 ip from any to any dst-port 7668 in via fxp0
50052 0 0 queue 5 ip from any 7668 to any out via fxp0
50053 5 519 queue 5 ip from any to any dst-port 7668 out via fxp0
50054 0 0 queue 7 ip from any 7788 to any in via fxp0
50055 0 0 queue 7 ip from any to any dst-port 7788 in via fxp0
50056 0 0 queue 5 ip from any 7788 to any out via fxp0
50057 2 182 queue 5 ip from any to any dst-port 7788 out via fxp0
50058 0 0 queue 7 ip from any 8311 to any in via fxp0
50059 0 0 queue 7 ip from any to any dst-port 8311 in via fxp0
50060 0 0 queue 5 ip from any 8311 to any out via fxp0
50061 0 0 queue 5 ip from any to any dst-port 8311 out via fxp0
50062 52795 3242968 queue 7 ip from any 8888-8889 to any in via fxp0
50063 0 0 queue 7 ip from any to any dst-port 8888-8889 in via fxp0
50064 0 0 queue 5 ip from any 8888-8889 to any out via fxp0
50065 53475 4417424 queue 5 ip from any to any dst-port 8888-8889 out via fxp0
50066 0 0 queue 7 ip from any 28864-28865 to any in via fxp0
50067 0 0 queue 7 ip from any to any dst-port 28864-28865 in via fxp0
50068 0 0 queue 5 ip from any 28864-28865 to any out via fxp0
50069 0 0 queue 5 ip from any to any dst-port 28864-28865 out via fxp0
50070 19068605 1060939020 queue 3 tcp from any to any iplen 0-80 tcpflags ack out via fxp0
50071 2339266 198780287 queue 1 ip from any to any iplen 0-100 out via fxp0
50072 426 53888 queue 1 udp from any to any dst-port 53 out via fxp0
50073 0 0 queue 1 ah from any to any out via fxp0
50074 318665 46414984 queue 1 esp from any to any out via fxp0
50075 0 0 queue 1 gre from any to any out via fxp0
50076 208 39438 queue 2 icmp from any to any out via fxp0
50077 5949458 1472340168 queue 4 ip from any to any out via fxp0
50078 30577 2307318 queue 8 icmp from any to any in via fxp0
50079 23943933 975608454 queue 8 ip from any to any iplen 0-100 in via fxp0
50080 0 0 queue 8 ah from any to any in via fxp0
50081 529415 271660772 queue 8 esp from any to any in via fxp0
50082 0 0 queue 8 gre from any to any in via fxp0
50083 2922832 3094296768 queue 6 ip from any to any in via fxp0
65535 74736589 8762863319 allow ip from any to any

ipfstat -nio
@1 pass out quick on lo0 from any to any
@2 pass out quick on xl0 proto udp from 192.168.1.1/32 port = 67 to any port = 68
@3 pass out quick on fxp0 proto udp from any port = 68 to any port = 67
@4 pass out quick on fxp0 proto udp from 50.51.52.53/32 port = 500 to any
@5 pass out quick on fxp0 proto esp from 50.51.52.53/32 to any
@6 pass out quick on fxp0 proto ah from 50.51.52.53/32 to any
@7 pass out quick on xl0 proto udp from 192.168.1.1/32 port = 500 to any
@8 pass out quick on xl0 proto esp from 192.168.1.1/32 to any
@9 pass out quick on xl0 proto ah from 192.168.1.1/32 to any
@10 pass out quick on xl0 from any to any keep state
@11 pass out quick on fxp0 from any to any keep state
@12 block out log quick from any to any
@1 pass in quick on lo0 from any to any
@2 block in log quick from any to any with short
@3 block in log quick from any to any with ipopt
@4 pass in quick on xl0 proto udp from any port = 68 to 255.255.255.255/32 port = 67
@5 pass in quick on xl0 proto udp from any port = 68 to 192.168.1.1/32 port = 67
@6 block in log quick on fxp0 from 192.168.1.0/24 to any
@7 block in log quick on fxp0 proto udp from any port = 67 to 192.168.1.0/24 port = 68
@8 pass in quick on fxp0 proto udp from any port = 67 to any port = 68
@9 skip 3 in on xl0 from 192.168.3.16/32 to any
@10 skip 2 in on xl0 from 192.168.2.10/32 to any
@11 skip 1 in on xl0 from 192.168.1.0/24 to any
@12 block in log quick on xl0 from any to any
@13 block in log quick on fxp0 from 10.0.0.0/8 to any
@14 block in log quick on fxp0 from 127.0.0.0/8 to any
@15 block in log quick on fxp0 from 172.16.0.0/12 to any
@16 block in log quick on fxp0 from 192.168.0.0/16 to any
@17 pass in quick on fxp0 proto udp from any to 50.51.52.53/32 port = 500
@18 pass in quick on fxp0 proto esp from any to 50.51.52.53/32
@19 pass in quick on fxp0 proto ah from any to 50.51.52.53/32
@20 pass in quick on xl0 proto udp from any to 192.168.1.1/32 port = 500
@21 pass in quick on xl0 proto esp from any to 192.168.1.1/32
@22 pass in quick on xl0 proto ah from any to 192.168.1.1/32
@23 skip 1 in proto tcp from any to any flags S/FSRA
@24 block in log quick proto tcp from any to any
@25 block in log quick on xl0 from any to any head 100
@1 pass in quick from 192.168.1.0/24 to 192.168.1.1/32 keep state group 100
@2 block in quick from 192.168.1.64/26 to 192.168.0.0/16 group 100
@3 block in quick from 192.168.1.128/25 to any group 100
@4 pass in quick from 192.168.1.0/24 to any keep state group 100
@26 block in log quick on fxp0 from any to any head 200
@27 block in log quick from any to any

gunzip -c /ramdisk/home/knoppix/generic-pc-xxx.img | dd of=/dev/hda bs=16k

Độ bảo mật (bit) Thuật giải
56 DES
80 Skipjack
96 ?
112 3DES
128 HMAC MD5, AES 128
160 HMAC SHA1
192 AES 192
256 AES 256
Độ bảo mật (bit) Thuật giải
56 DH,RSA,DSA 416
80 DH,RSA,DSA 1024
96 DH,RSA,DSA 1536
112 DH,RSA,DSA 2048
128 DH,RSA,DSA 3072
160 DH,RSA,DSA 4864
192 DH,RSA,DSA 7680
256 DH,RSA,DSA 15360