LINUX.ORG.RU

помогите с ipfw


0

0

#!/bin/sh

localhost="127.0.0.1" wanip="212.76.10.100" lanip="192.168.77.1" waninntf="rl0" localintf="fxp0" fwcmd="/sbin/ipfw"

$fwcmd -f flush

${fwcmd} add pass all from any to any via lo0 ${fwcmd} add deny all from any to 127.0.0.0/8 ${fwcmd} add deny ip from 127.0.0.0/8 to any

${fwcmd} add pass udp from me to any 123 keep-state

${fwcmd} add divert natd ip from any to any out via ${waninntf} ${fwcmd} add divert natd ip from any to 212.76.10.162 in via ${waninntf}

${fwcmd} add pass tcp from any to any established ${fwcmd} add pass all from any to any out xmit ${wanip} ${fwcmd} add pass tcp from any to any in recv ${wanip} established

${fwcmd} add pass all from 192.168.0.0:255.255.0.0 to 192.168.0.0:255.255.0.0 via ${localintf}

${fwcmd} add pass tcp from any to ${wanip} 22 ${fwcmd} add pass tcp from any to ${lanip} 22

${fwcmd} add pass tcp from any 53 to me ${fwcmd} add pass udp from any 53 to me

${fwcmd} add pass tcp from any to me 53 ${fwcmd} add pass udp from any to me 53

${fwcmd} add pass icmp from any to any in recv ${wanip} icmptypes 0 ${fwcmd} add pass icmp from any to any out xmit ${wanip} icmptypes 8

${fwcmd} add pass icmp from any to any in recv ${wanip} icmptypes 3 ${fwcmd} add pass icmp from any to any in recv ${wanip} icmptypes 11

при таком правиле пользователи не могут выйти в инет как прописать правильно если можно покажите где чего не правильно

anonymous

Re: помогите с ipfw

посмотри вывод ipfw show ( блин забыл уже ) и посмотри counter-ы -увидишь где что проходит . скорее всего порядок правил напутан .
или сделай по аналогии с этим.
http://www.rootshell.be/~alienge/html/ipfw_stateful.html

вот рабочий когда-то пример .
/etc/rc.fire

#!/bin/sh
ipfw="/sbin/ipfw -q"
#/sbin/ipfw -f flush
${ipfw} -f flush
#IPSEC
${ipfw} add 30 pass ip from any to any via gif0
${ipfw} add 31 pass udp from other_real_ip to real_ip isakmp
${ipfw} add 31 pass udp from real_ip to other_real_ip isakmp
${ipfw} add 31 pass esp from other_real_ip to real_ip
${ipfw} add 31 pass esp from real_ip to other_real_ip
${ipfw} add 31 pass ipencap from other_real_ip to real_ip
${ipfw} add 31 pass ipencap from real_ip to other_real_ip


${ipfw} add 60 pass ip from me to any
${ipfw} add 62 pass tcp from another_other_real_ip to me 443 # port 443 because I usualy put ssh on this port
${ipfw} add 63 pass tcp from other_real_ip to me 443
${ipfw} add 70 pass all from any to any via rl1 # rl1 my internal interface
#natd incoming packets

${ipfw} add 80 divert natd ip from any to real_ip
${ipfw} add 90 check-state
${ipfw} add 92 pass tcp from any to me 1024-65535
${ipfw} add 92 pass udp from any to me 1024-65535
${ipfw} add 92 pass icmp from any to me
${ipfw} add 95 pipe 1 tcp from any to 10.0.3.49 # pipe
${ipfw} pipe 1 config bw 4096kbit/s delay 0

#remember state for sessions subject to nat

${ipfw} add 100 skipto 60000 all from 10.0.3.0/24 to any out via rl0 keep-state

${ipfw} add 200 deny log all from any to any

${ipfw} add 60001 divert natd all from 10.0.3.10 to any out via rl0
${ipfw} add 60001 divert natd all from 10.0.3.25 to any out via rl0
${ipfw} add 60010 pass all from any to any

j262 ★★ ()
Вы не можете добавлять комментарии в эту тему. Тема перемещена в архив.