bonding+dhcp

Есть сервер с несколькими сетевухами. При старте стевухи в режиме bonding падает внешняя сеть.
eth0 - смотрит в интернеты
eth1 - смотрит в локалку
bond0 (eth2,eth3) - встроенные сетевухи, которые смотрят на комп с такой же мамой как и сервак, но под Win7
Комп висящий на bond0 при старте винды сбрасывает IP у eth0 и права у /dev/null на rwxr--r--
Мамы на которых стоят сетевушки: GA-890FXA-UD5
Под виндой они тоже сконфигурированы как 802.3ad

Забить на bond не предлагать - без него работало когда-то.
Сделать bridge на bond0-eth1 - тоже, точнее чем это будет лучше? Ну не будут пакеты NATиться..
Забавно но bond прироста скорости не даёт - делал для интереса тест на посылку UDP - пользует половину канала.
Вдогонку кто знает как теперь переименовывать сетевушки по новым правилам udev ? Читал вроде все официальные мануалы, но без примера не понятно. (Забавно, что eth2,eth3 при присвоении MAC в bond0 режиме одной сетевухе, вторая устанавливает себе такой же..)

fulcrum log # cat /etc/conf.d/net

# This blank configuration will automatically use DHCP for any net.*
# scripts in /etc/init.d.  To create a more complete configuration,
# please review /etc/conf.d/net.example and save your configuration
# in /etc/conf.d/net (this file :]!).
preup() {
        # Adjusting the bonding mode / MII monitor
        # Possible modes are : 0, 1, 2, 3, 4, 5, 6,
        #     OR
        #   balance-rr, active-backup, balance-xor, broadcast,
        #   802.3ad, balance-tlb, balance-alb
        # MII monitor time interval typically: 100 milliseconds

        if [[ ${IFACE} == "bond0" ]] ; then
            #BOND_MODE="balance-alb"
            BOND_MODE="802.3ad"
            BOND_MIIMON="100"
            echo ${BOND_MODE} >/sys/class/net/bond0/bonding/mode
            echo ${BOND_MIIMON}  >/sys/class/net/bond0/bonding/miimon
            einfo "Bonding mode is set to ${BOND_MODE} on ${IFACE}"
            einfo "MII monitor interval is set to ${BOND_MIIMON} ms on ${IFACE}"
        else
            einfo "Doing nothing on ${IFACE}"
        fi
        
        iptables-restore < /etc/iptables.up.rules
        return 0
}

modules="dhcpcd"
#config_eth0="null"
#config_eth1="null"

interfaces="bond0"

config_eth1="192.168.1.3 netmask 255.255.255.0 broadcast 192.168.1.255"
dns_domain_eth0="sky"

mac_eth0="00:a0:c9:e3:53:aa"

config_bond0="192.168.2.2 netmask 255.255.255.0 broadcast 192.168.2.255"
slaves_bond0="eth2 eth3"
dns_domain_bond0="sky"

config_eth0=""
ifup_eth0="/root/iptables-rc.bond"

fulcrum log # cat /etc/resolvconf.conf

# Configuration for resolvconf(8)
# See resolvconf.conf(5) for details

resolv_conf=/etc/resolv.conf
# If you run a local name server, you should uncomment the below line and
# configure your subscribers configuration files below.
name_servers=127.0.0.1
fulcrum log # 

fulcrum log # cat /etc/resolv.conf.head

nameserver 127.0.0.1
#domain sky

fulcrum log # cat /etc/resolv.conf.tail

domain netbynet.ru
nameserver 212.1.224.6
nameserver 212.1.230.111
fulcrum log # 

fulcrum log # cat /etc/resolv.conf

# Generated by dhcpcd from eth0
nameserver 127.0.0.1
#domain sky
domain netbynet.ru
nameserver 212.1.224.6
nameserver 212.1.244.6
domain netbynet.ru
nameserver 212.1.224.6
nameserver 212.1.230.111
fulcrum log # 

fulcrum log # cat /etc/dnsmasq.conf

# Configuration file for dnsmasq.
#
# Format is one option per line, legal options are the same
# as the long options legal on the command line. See
# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.

# The following two options make you a better netizen, since they
# tell dnsmasq to filter out queries which the public DNS cannot
# answer, and which load the servers (especially the root servers)
# uneccessarily. If you have a dial-on-demand link they also stop
# these requests from bringing up the link uneccessarily.

# Never forward plain names (without a dot or domain part)
#domain-needed
# Never forward addresses in the non-routed address spaces.
bogus-priv

# If you want dnsmasq to listen for DHCP and DNS requests only on
# specified interfaces (and the loopback) give the name of the
# interface (eg eth0) here.
# Repeat the line for more than one interface.

interface=bond0
interface=eth1

dhcp-range=192.168.1.11,192.168.1.250,1d
dhcp-range=192.168.2.11,192.168.2.250,1d


dhcp-host=00:16:36:7b:d9:0d,neko,192.168.1.4,1d

dhcp-host=00:14:85:b4:e2:e4,alexF,192.168.1.6,1d

dhcp-host=00:e0:4c:10:0c:6e,blackbird,192.168.2.5,1d

dhcp-host=00:26:6c:88:8d:86,redbook,192.168.1.7,1d
dhcp-host=00:15:f2:15:f2:67,WPA,192.168.1.10,1d

dhcp-host=00:1c:f0:d6:d1:67,WPA2,192.168.1.50,1d

dhcp-host=00:0e:2e:72:37:e1,adam,192.168.1.14,1d

# Set the NTP time server address to be the same machine as
# is running dnsmasq
dhcp-option=42,0.0.0.0

# Set the NIS domain name to "welly"
dhcp-option=40,sky

# Set the "all subnets are local" flag
dhcp-option=27,1

# Send RFC-3397 DNS domain search DHCP option. WARNING: Your DHCP client
# probably doesn't support this......
#dhcp-option=119,eng.apple.com,marketing.apple.com
dhcp-option=119,sky
# Send RFC-3442 classless static routes (note the netmask encoding)
#dhcp-option=121,192.168.1.0/24,1.2.3.4,10.0.0.0/8,5.6.7.8

# Send encapsulated vendor-class specific options. The vendor-class
# is sent as DHCP option 60, and all the options marked with the
# vendor class are send encapsulated in DHCP option 43. The meaning of
# the options is defined by the vendor-class. This example sets the
# mtftp address to 0.0.0.0 for PXEClients
dhcp-option=vendor:PXEClient,1,0.0.0.0

fulcrum log # cat ~/iptables-rc.bond

iptables -F
iptables -t nat -F

#Setup default policies to handle unmatched traffic
 iptables -P INPUT ACCEPT
 iptables -P OUTPUT ACCEPT
 iptables -P FORWARD DROP

#Copy and paste these examples ...
 export WAN=eth0
 export LAN=eth1
 export LANB=bond0

#Then we lock our services so they only work from the LAN
 iptables -A INPUT -i lo -j ACCEPT
# iptables -A INPUT -i ${LAN} -j LOG
 iptables -A INPUT -i ${LAN} -j ACCEPT
 iptables -A INPUT -i ${LANB} -j ACCEPT
 
# iptables -I INPUT 1 -i ${LANB} -j LOG
# iptables -I INPUT 1 -i ${LANB} -j ACCEPT
# iptables -I INPUT 1 -i ${LAN} -j ACCEPT
# iptables -I INPUT 1 -i lo -j ACCEPT
 
## iptables -A INPUT -p UDP ! --dport bootps -i ${LAN} -j REJECT
## iptables -A INPUT -p UDP ! --dport domain -i ${LAN} -j REJECT
## iptables -A INPUT -p UDP ! --dport distcc -i ${LAN} -j REJECT
## iptables -A INPUT -p UDP ! --dport 4000   -i ${LAN} -j REJECT
# iptables -A INPUT -p UDP ! --dport distcc -i ${LAN} -j REJECT

## iptables -A INPUT -p UDP ! --dport bootps -i ${LANB} -j REJECT
## iptables -A INPUT -p UDP ! --dport domain -i ${LANB} -j REJECT
## iptables -A INPUT -p UDP ! --dport distcc -i ${LANB} -j REJECT
## iptables -A INPUT -p UDP ! --dport 4000   -i ${LANB} -j REJECT
# iptables -A INPUT -p UDP ! --dport distcc -i ${LANB} -j REJECT

#(Optional) Allow access to our ssh server from the WAN
# iptables -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT
# Next strings added by John -->>
iptables -A INPUT -p TCP --dport 137:139 -i ${WAN} -j ACCEPT
iptables -A INPUT -p UDP --dport 137:139 -i ${WAN} -j ACCEPT
iptables -A INPUT -p TCP --dport 445 -i ${WAN} -j ACCEPT

iptables -A INPUT -p TCP --dport 20:21 -i ${WAN} -j ACCEPT
iptables -A INPUT -p UDP --dport 20:21 -i ${WAN} -j ACCEPT

iptables -A INPUT -p TCP --dport 2049:2049 -i ${WAN} -j ACCEPT
iptables -A INPUT -p UDP --dport 2049:2049 -i ${WAN} -j ACCEPT
# <<----

#Drop TCP / UDP packets to privileged ports
# iptables -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
# iptables -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP

#Finally we add the rules for NAT
## iptables -I FORWARD -i ${LAN} -d 192.168.1.0/255.255.255.0 -j DROP
## iptables -I FORWARD -i ${LANB} -d 192.168.1.0/255.255.255.0 -j DROP 
# iptables -I FORWARD -i ${LAN} -d 192.168.2.0/255.255.255.0 -j DROP
# iptables -A FORWARD -i ${LAN} -s 192.168.1.0/255.255.255.0 -j LOG 
 iptables -A FORWARD -i ${LAN} -s 192.168.1.0/255.255.255.0 -j ACCEPT
 iptables -A FORWARD -i ${LANB} -s 192.168.2.0/255.255.255.0 -j ACCEPT
 iptables -A FORWARD -s 192.168.1.0/255.255.255.0 -d 192.168.2.0/255.255.255.0 -j ACCEPT
 iptables -A FORWARD -s 192.168.2.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -j ACCEPT
 iptables -A FORWARD -i ${LAN} -o ${LANB} -j ACCEPT
 iptables -A FORWARD -i ${LANB} -o ${LAN} -j ACCEPT
# iptables -A FORWARD -i ${LAN} -s 192.168.2.0/255.255.255.0 -j ACCEPT

 iptables -A FORWARD -i ${WAN} -d 192.168.1.0/255.255.255.0 -j ACCEPT
 iptables -A FORWARD -i ${WAN} -d 192.168.2.0/255.255.255.0 -j ACCEPT

 iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE
#Tell the kernel that ip forwarding is OK
 echo 1 > /proc/sys/net/ipv4/ip_forward
 for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done

#This is so when we boot we don't have to run the rules by hand
/etc/init.d/iptables save
iptables-save > /etc/iptables.up.rules