Jui-Nan Lin’s Blog

http://proj.sunet.se/E2E/freebsd.txt
http://proj.sunet.se/E2E/tcptune.html

kern.ipc.maxsockbuf=8388608
net.inet.tcp.sendspace=3217968
net.inet.tcp.recvspace=3217968
net.inet.tcp.rfc1323=1


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Tcp1323Opts=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpWindowSize=[wmax]

設好以後, FTP 的 throughput 提高到 50%, 雖不滿意但可以接受啦…
(原本只能跑到 15%, 還會讓機器 hang 住…)

參考

http://taosecurity.blogspot.com/2005/01/ipsec-tunnels-with-freebsd-although.html。

1. 修改 Kernel，加上
   

   options FAST_IPSEC
device crypto


   並且重開機。

2. 安裝 security/ipsec-tools。
3. 設定 /usr/local/etc/racoon/racoon.conf:
   

   path pre_shared_key "/usr/local/etc/racoon/psk.txt";
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}

   listen
   {
   isakmp (MY_IP) [500];
   }
   timer
   {
   # These value can be changed per remote node.
   counter 5; # maximum trying count to send.
   interval 20 sec; # maximum interval to resend.
   persend 1; # the number of packets per send.

   # maximum time to wait for completing each phase.
   phase1 30 sec;
   phase2 15 sec;
   }
   remote [500]
   {
   #exchange_mode main,aggressive;
   exchange_mode aggressive,main;
   doi ipsec_doi;
   situation identity_only;

   my_identifier user_fqdn “sakane@kame.net”;
   peers_identifier user_fqdn “sakane@kame.net”;
   #certificate_type x509 “mycert” “mypriv”;

   nonce_size 16;
   lifetime time 1 min; # sec,min,hour

   proposal {
   encryption_algorithm 3des;
   hash_algorithm sha1;
   authentication_method pre_shared_key;
   dh_group 2;
   }
   }

4. 設定 /usr/local/share/psk.txt:
5. 設定 /etc/ipsec.conf:
   flush;
   spdflush;spdadd any -P out ipsec
   esp/tunnel/-/require; spdadd any -P in ipsec
   esp/tunnel/-/require;

   spdadd / any -P out ipsec
   esp/tunnel/-/require;

   spdadd / any -P in ipsec
   esp/tunnel/-/require;

6. /usr/local/etc/rc.d/racoon.sh start; /etc/rc.d/ipsec start;

P.S.
racoon 的範例設定檔在 /usr/local/share/examples/ipsec-tools 裡面。

從 http://anp.ath.cx/sshit/sshit.pl 改進的，現在不會 fork 一堆出來了。
這個版本是用 tail -F 讀 /var/log/auth.log，跟 sshit.pl 的作法不同。

Link: http://www.csie.nctu.edu.tw/~jnlin/script/chkfw_select_pf.txt

你必須要在 /etc/pf.conf 加上:

table <$PF_TABLE> persist
block on $extdev from <$PF_TABLE> to any

才會真正 block 有惡意者的 IP。