ядро собрано с параметрами:
Код: Выделить всё
options ROUTETABLES=2
#netgraph(4) system
options NETGRAPH
options NETGRAPH_PPPOE
options NETGRAPH_SOCKET
options NETGRAPH_ETHER
options NETGRAPH_TEE
#firewall
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=200
options IPFIREWALL_FORWARD
options IPDIVERT
options DUMMYNET
Код: Выделить всё
#!/bin/sh
fwcmd="/sbin/ipfw"
ext_if=Сетевая карта, смотрит в сторону инета
int_if=Сетевая карта, смотрит в сторону локалки
ext_ip=Внешний айпи выданный провайдером
${fwcmd} -f flush
no comments ;)
${fwcmd} add 90 allow ip from 127.0.0.1 to 127.0.0.1
###########################################################
# global counter
###########################################################
Здесь чтобы неотправлял почту через другие почтовые сервера, полезно, когда поселиться вирус и начингает спамить в НАТ.
${fwcmd} add 900 reset log tcp from 10.0.0.0/8 to any 25 out xmit ${ext_if}
###########################################################
# denying external connection to proxy
###########################################################
${fwcmd} add 1000 deny log tcp from any to me 3128,1080 in via ${ext_if}
${fwcmd} add 1010 skipto 1040 ip from 10.209.109.0/24 to 10.209.109.1
${fwcmd} add 1020 skipto 1040 ip from 10.209.109.1 to 10.209.109.0/24
${fwcmd} add 1030 deny log tcp from any to me 3128,1080
${fwcmd} add 1031 deny log udp from any to me 3128,1080
${fwcmd} add 1032 deny tcp from 10.209.109.0/24 to any 1080,2080
# allowing our ftp, http
${fwcmd} add 2000 skipto 3600 tcp from 10.209.109.0/24 to me 80,21
# denying some packets
${fwcmd} add 3000 deny log ip from 10.209.109.0/24 to any in recv ${ext_if}
${fwcmd} add 3040 deny log ip from 224.0.0.0/8 to any in recv ${ext_if}
${fwcmd} add 3050 deny ip from any to any frag
${fwcmd} add 3060 deny icmp from any to any in via ${ext_if} icmptype 5,9,13,14,15,16,17
###########################################################
# Allow incoming connections
###########################################################
${fwcmd} add 3500 allow tcp from any to me ssh,pop3s,pop3,http,ftp,1,11,15,79,111 limit dst-addr 30 via ${ext_if}
${fwcmd} add 3510 allow tcp from any to me smtp limit dst-addr 15 via ${ext_if}
${fwcmd} add 3520 allow tcp from me ssh,pop3s,pop3,http,smtp,ftp to any via ${ext_if}
# natd
${fwcmd} add 4000 divert natd ip from any to ${ext_ip} in recv ${ext_if}
###########################################################
# transparent proxy
###########################################################
${fwcmd} add 6000 skipto 6500 tcp from 10.209.109.1 to any
${fwcmd} add 6001 skipto 6500 tcp from any to me
${fwcmd} add 6100 fwd 127.0.0.1,3128 tcp from 10.209.109.0/24 to any 80,81,82,88,3128,8080,8101,21,443 out xmit ${ext_if}
# check-state
${fwcmd} add 6500 check-state
# Запретить подключения ко мне
${fwcmd} add 6510 deny tcp from any to me 113,135,137,138,139,445 in via ${ext_if}
${fwcmd} add 6520 deny udp from any to me 113,135,137,138,139,445 in via ${ext_if}
${fwcmd} add 6550 deny log tcp from any to me 1-1023 in via ${ext_if}
${fwcmd} add 6560 deny log udp from any to me 1-1023 in via ${ext_if}
${fwcmd} add 6570 deny log tcp from any to me 3306 in via ${ext_if} # MySQL
${fwcmd} add 6580 skipto 6600 ip from 10.209.109.0/24 to any in via ${int_if}
${fwcmd} add 6582 skipto 6600 ip from 0.0.0.0 to 255.255.255.255 in via ${int_if}
${fwcmd} add 6585 deny ip from 192.168.0.0/16 to any in via ${int_if}
${fwcmd} add 6590 deny ip from any to any in via ${int_if}
###########################################################
# natd разрешаем только те айпи, которым необходимо ходить на нат
###########################################################
${fwcmd} add 8000 skipto 9000 ip from 10.209.109.1 to any
#Остальным запрещаем ходить на NAT
${fwcmd} add 8900 skipto 10000 ip from 10.209.109.0/24 to any
${fwcmd} add 9000 divert natd ip from 10.209.109.0/24 to any out xmit ${ext_if}
# denying packets from local net to external
${fwcmd} add 10000 deny ip from 10.0.0.0/8 to any out xmit ${ext_if}
${fwcmd} add 10010 deny ip from 192.168.0.0/16 to any out xmit ${ext_if}
##########################################################
# allowing everything else
##########################################################
${fwcmd} add 65000 allow ip from any to any
