Имеется:
Код: Выделить всё
[root@gw ~]# uname -a
FreeBSD gw.somedomain.tld 7.0-RELEASE-p5 FreeBSD 7.0-RELEASE-p5 #0: Wed Dec 3 10:33:44 MSK 2008 root@gw.somedomain.tld:/usr/obj/usr/src/sys/GWSPB-2008-12-03 i386
Вообще, мне бы хотелось услышать ваши советы по составлению конфига фаера, как сделать. Сначала что-то разрешать, потом нат, потом deny all? Или как-то иначе... Приведу скрипт, который работает на данный момент на серваке. При этом существует проблема, что нат пускает все.
У меня на серваке 2 канала в инет. Из внешних доступных сервисов: почтовик, ftp, openvpn (2 и один старый), ну и mpd5.
P.S. Простите за поток сознания, болею я...
Код: Выделить всё
#!/bin/sh
ipfw='/sbin/ipfw -q'
#out_if="em1"
#out_mask="255.255.255.252"
#out_ip="xxx.xxx.xxx.xxx"
out_if="em2"
out_mask="255.255.255.252"
out_ip="yyy.yyy.yyy.yyy"
in_if="em0"
in_net="10.10.1.0"
in_mask="255.255.0.0"
in_ip="10.10.1.1"
mpd_vpn="ng*"
vpn="tun0"
vpn_chel="tun3"
boss1="10.10.1.30/32"
boss2="10.10.1.31/32"
sklad_dc="10.10.2.30"
flanker="10.10.1.61/32"
S0000="10.10.1.10/32"
S0070="10.10.1.101/32"
S0070_bank_client="5080,465,110,25"
S0070_uralsib="995,465"
S0095="10.10.1.102/32"
S0095_pressol="9005"
S0050="10.10.1.103/32"
S0050_ports="110,25,1723"
S0050_out_peer="213.182.169.11"
S0068="10.10.1.104/32"
ts1="10.10.1.70/32"
ts2="10.10.1.71/32"
ts3="10.10.1.72/32"
buhg1="10.10.1.51/32"
spb_net="10.10.1.0/24"
spb_whnet="10.10.2.0/24"
${ipfw} flush
${ipfw} add 100 check-state
# Deny access to unrouteable networks
${ipfw} add 200 reject all from any to 10.0.0.0/8 in via ${out_if}
${ipfw} add 300 reject all from any to 172.16.0.0/12 in via ${out_if}
${ipfw} add 400 reject all from any to 192.168.0.0/16 in via ${out_if}
${ipfw} add 500 reject all from any to 0.0.0.0/8 in via ${out_if}
${ipfw} add 600 reject all from any to 169.254.0.0/16 in via ${out_if}
# Multicast
${ipfw} add 700 reject all from any to 224.0.0.0/4 in via ${out_if}
${ipfw} add 800 reject all from any to 240.0.0.0/4 in via ${out_if}
# Deny access from unrouteable networks
${ipfw} add 900 reject all from 10.0.0.0/8 to any in via ${out_if}
${ipfw} add 1000 reject all from 172.16.0.0/12 to any in via ${out_if}
${ipfw} add 1100 reject all from 192.168.0.0/16 to any in via ${out_if}
${ipfw} add 1200 reject all from 0.0.0.0/8 to any in via ${out_if}
${ipfw} add 1300 reject all from 169.254.0.0/16 to any in via ${out_if}
# Multicast
${ipfw} add 1400 reject all from 224.0.0.0/4 to any in via ${out_if}
${ipfw} add 1500 reject all from 240.0.0.0/4 to any in via ${out_if}
# ICMP
${ipfw} add 1600 deny icmp from any to any frag
${ipfw} add 1700 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
#${ipfw} add allow all from any to any
# Правило для сбора статистики
${ipfw} add 1800 tee 10000 all from me to any out via ${out_if}
${ipfw} add 1900 tee 10000 all from any to me in via ${out_if}
# Разрешим весь трафик через локальный интерфейс (для работы системы)
${ipfw} add 2000 allow all from any to any via lo0
#################################################################
# #
# NAT configuration #
# #
#################################################################
# NAT
${ipfw} nat 111 config ip ${out_ip} reset same_ports unreg_only
# Special users (-:
${ipfw} add 2100 nat 111 all from $S0000 to any out via ${out_if}
${ipfw} add 2200 nat 111 all from 10.10.1.211/32 to any out via ${out_if}
# All from flanker
${ipfw} add 2300 nat 111 ip from $flanker to any out via ${out_if}
# ICMP for internal users
${ipfw} add 2400 nat 111 icmp from 10.10.0.0/16 to any out via ${out_if}
# DNS for domain controllers (tcp and udp)
${ipfw} add 2500 nat 111 log udp from $boss1 to any 53 out via ${out_if}
${ipfw} add 2600 nat 111 log tcp from $boss1 to any 53 out via ${out_if}
${ipfw} add 2700 nat 111 log udp from $boss2 to any 53 out via ${out_if}
${ipfw} add 2800 nat 111 log tcp from $boss2 to any 53 out via ${out_if}
${ipfw} add 2900 nat 111 log udp from $sklad_dc to any 53 out via ${out_if}
${ipfw} add 3000 nat 111 log tcp from $sklad_dc to any 53 out via ${out_if}
# Исключения, nat определенных портов и ip для пользовательских программ
# For pressol web site working (Some work for pressol from S0095)
${ipfw} add 3100 nat 111 all from $S0095 to any $S0095_pressol out via ${out_if}
# VTB Rostov bank-client
${ipfw} add 3200 nat 111 tcp from $S0070 to 195.151.17.7 25 out via ${out_if}
${ipfw} add 3300 nat 111 tcp from $S0070 to 195.151.17.2 110 out via ${out_if}
# SMTP.DBO.VTB.RU
${ipfw} add 3400 nat 111 tcp from $S0070 to 193.164.146.13 25 out via ${out_if}
${ipfw} add 3500 nat 111 tcp from $S0070 to 193.164.146.13 110 out via ${out_if}
# For bank client work (Bank client's on s0070.somedomain.tld)
${ipfw} add 3600 nat 111 tcp from $S0070 to any $S0070_bank_client out via ${out_if}
${ipfw} add 3700 nat 111 tcp from $S0070 to 217.195.66.228 $S0070_uralsib out via ${out_if}
# For some stuff from s0050
${ipfw} add 3800 nat 111 log logamount 0 gre from $S0050 to 213.182.169.11 out via ${out_if}
${ipfw} add 3900 nat 111 log logamount 0 tcp from $S0050 to 213.182.169.11 $S0050_ports out via ${out_if}
# Трафик из инета в обратную сторону - надо же как-то его отдавать.
${ipfw} add 4000 nat 111 ip from any to ${out_ip} in via ${out_if}
################### NAT HAPPY END ###################
# temp test
${ipfw} add 4010 deny log logamount 0 all from 77.236.252.198 to ${out_ip} 20,21 in via ${out_if}
# FTP for somepublichost.somedomain.tld
${ipfw} add 4100 allow tcp from any to ${out_ip} 20,21 in via ${out_if}
${ipfw} add 4200 allow tcp from ${out_ip} 20,21 to any out via ${out_if}
# OpenVPN
${ipfw} add 4300 allow all from any to any via ${vpn}
${ipfw} add 4400 allow udp from any to ${out_ip} 1194 in via ${out_if}
${ipfw} add 4500 allow udp from ${out_ip} 1194 to any out via ${out_if}
# VPN Челябинск
${ipfw} add 4600 allow ip from any to any via ${vpn_chel}
${ipfw} add 4700 allow all from any to any 5003
# For mpd
${ipfw} add 4800 allow tcp from any to any via ${mpd_vpn}
${ipfw} add 4900 allow icmp from any to any via ${mpd_vpn}
${ipfw} add 5000 allow log logamount 0 gre from ${out_ip} to any keep-state out via ${out_if}
${ipfw} add 5100 allow log logamount 0 tcp from any to ${out_ip} 1723 keep-state in via ${out_if}
# Forward ftp from users to frox
${ipfw} add 5200 fwd 10.10.1.1,2121 tcp from $ts1 to any 21 out via ${out_if}
${ipfw} add 5300 fwd 10.10.1.1,2121 tcp from $ts2 to any 21 out via ${out_if}
${ipfw} add 5400 fwd 10.10.1.1,2121 tcp from $ts3 to any 21 out via ${out_if}
${ipfw} add 5500 fwd 10.10.1.1,2121 tcp from $buhg1 to any 21 out via ${out_if}
# Для доступа сервера в интернет
${ipfw} add 5600 allow tcp from me to any keep-state out via ${out_if}
${ipfw} add 5700 allow icmp from me to any keep-state out via ${out_if}
# DNS
${ipfw} add 5900 allow udp from me to any 53 out via ${out_if}
${ipfw} add 6000 allow udp from any 53 to me in via ${out_if}
${ipfw} add 6100 allow tcp from me to any 53 out via ${out_if}
${ipfw} add 6200 allow tcp from any 53 to me in via ${out_if}
# NTP
${ipfw} add 6300 allow udp from me 123 to any 123 out via ${out_if}
${ipfw} add 6400 allow udp from any 123 to ${out_ip} 123 in via ${out_if}
# SMTP on em2
${ipfw} add 6500 allow tcp from any to ${out_ip} 25 in via ${out_if}
${ipfw} add 6600 allow tcp from ${out_ip} to any 25 out via ${out_if}
# SMTP on em1
${ipfw} add 6700 fwd 81.3.179.221 all from xxx.xxx.xxx.xxx to any
${ipfw} add 6800 allow tcp from any to xxx.xxx.xxx.xxx 25 in via em1
${ipfw} add 6900 allow tcp from xxx.xxx.xxx.xxx to any 25
# SMTP from flanker and no other via em0
${ipfw} add 7000 allow tcp from $flanker to me 25 in via em0
${ipfw} add 7100 allow tcp from me to $flanker 25 out via em0
${ipfw} add 7200 deny tcp from any to me 25 in via em0
# SSH
${ipfw} add 7300 allow tcp from any to me 5222 setup keep-state
# Saint-Petersburgh warehouse
${ipfw} add 7400 allow all from ${spb_net} to ${spb_whnet} out via em3
${ipfw} add 7500 allow all from ${spb_whnet} to ${spb_net} in via em3
# LAN
${ipfw} add 7600 allow ip from ${spb_net} to any via ${in_if}
${ipfw} add 7700 allow ip from any to ${spb_net} via ${in_if}
# ICMP
${ipfw} add 7800 allow icmp from any to any via ${in_if}
# Deny all another
${ipfw} add 7900 deny log logamount 10000 ip from any to any
