本文在参照了前人的基础上，总结和实验而来
--------------------------------------------系统安装-----------------------------------
1.系统安装：
在安装时仅选择最小安装即可（mininal）
2.完成安装后：
#sysinstall
选择 ports 和src。 在SRC选项中仅选择 sys, libexec, sbin
-----------------------------------------------内核编译----------------------------------
# cd /usr/src/sys/i386/conf
# cp GENERIC netipfw //netipfw为随意命名的新内核名
编辑netipfw， 修改或增加如下项：
# ee netipfw
``````````````````````````````````````````````````````````````````````````````````````````````````````````
ident kernel-ipfw #修改此选项中的名字为你的新内核文件名
options IPFIREWALL #将 IPFW 作为内核的一部分来启用
options IPFIREWALL_VERBOSE #将启用记录通过 IPFW 的匹配了含 'log'
关键字规则的每一个包的功能
options IPFIREWALL_VERBOSE_LIMIT=10 #限制通过记录的包的个数
options IPFIREWALL_DEFAULT_TO_ACCEPT
#默认地允许所有的包通过防火墙，这项一定要加上，如果内核选项中没有加入 IPFIREWALL_DEFAULT_TO_ACCEPT，或将您的防火墙设置配置为允许所有的进入包， 则所有发到本机或发出的包都会被阻止
options IPFIREWALL_FORWARD #启用转发功能
options DUMMYNET #加载dummynet模块，模拟丢包和延迟的
options IPFILTER #用于启用 “IPFILTER” 防火墙的支持
options IPFILTER_LOG #用于启用 IPF 的日志支持
options IPDIVERT #这一选项启用 NAT 功能
```````````````````````````````````````````````````````````````````````````````````````````````````````````````````
#/ usr/sbin/config netipfw //运行config命令来产生内核源代码。
# cd ../compile/netipfw
# make cleandepend
# make
# make install
# reboot
-------------------------------------调整配置文件------------------------------------
1.增加文件ipf.rules ipnat.rules
# ee /etc/ipf.rules
Pass in all
Pass out all
# ee /ipnat.rules
map rl1 192.168.5.128/24 -> 192.168.37.1 portmap tcp/udp auto
map rl1 192.168.5.128/24 -> 192.168.37.1
//其中rl1为外部网卡
# ee /etc/rc.conf
`````````````````````````````````````````````````````````````````````````````````````````````````
firewall_enable="YES"
ipfilter_enable="YES"
ipf -Fa -f /etc/ipf.rules
ipnat_enable="YES"
ipnat_program="/sbin/ipnat -FC -f"
ipnat_rules="/etc/ipnat.rules"
ipmon_enable="YES"
ipmon_flags="-Ds"
firewall_type="OPEN"
Gateway_enable="yes"
-------------------------------------------延时和掉包设置--------------------------
延时：
# ipfw add 60000 pipe 1 from any to any out
# ipfw add 60001 pipe 2 from any to any out
# ipfw pipe 1 config delay 250ms
# ipfw pipe 2 config delay 250ms
// 规则号要少于默认的63000，不然不会生效
掉包：
# ipfw add 60002 prob 0.05 deny ip from any to any in
----------------------------------------------------------------------------------------------------------------
备注：在重启服务器后，以前所加的规则无效，重新添加的话
先 # ipfw pipe 1 config delay 250ms
后 # ipfw add 60000 pipe 1 from any to any out
如果不这样，会与服务器断开连接
