Модератор: terminus
Код: Выделить всё
oif="nve0"
onet="190.*.*.252"
omask="255.255.255.252"
oip="190.*.*.254"
iif="ste0"
inet="172.16.0.0"
imask="255.255.0.0"
iip="172.16.100.100"
${fwcmd} add check_state
${fwcmd} add pipe 1 tcp from ${oip} to any via ${oif}
${fwcmd} add pipe 1 udp from ${oip} to any via ${oif}
${fwcmd} add pipe 1 ip from ${oip} to any via ${oif}
${fwcmd} pipe 1 config bw 100Mbit/s
# VPN PPTP
${fwcmd} add allow tcp from ${iip} 1723 to any keep-state
${fwcmd} add allow tcp from any to ${iip} 1723
${fwcmd} add allow gre from any to any
${fwcmd} add pipe 3040 all from not ${inet}:${imask} to 192.168.14.2
${fwcmd} add pipe 3041 all from 192.168.14.2 to not ${inet}:${imask}
${fwcmd} pipe 3040 config bw 250KBit/s
${fwcmd} pipe 3041 config bw 150KBit/s
# SSH
${fwcmd} add allow tcp from any to me 22
${fwcmd} add allow tcp from me 22 to any established
# DNS
${fwcmd} add allow udp from any to any domain
${fwcmd} add allow udp from any domain to any
# HTTP
${fwcmd} add allow tcp from any to 172.16.0.221 80 in via ${oif} setup
# NATD Rules
setup_loopback
#${fwcmd} add deny tcp from ${inet}:${imask} to any http,https via ${oif}
${fwcmd} add deny tcp from any to any 135,136,137,138,139 via ${oif}
${fwcmd} add divert natd all from any to ${oip} via ${oif}
case ${natd_enable} in
[Yy][Ee][Ss])
if [ -n "${natd_interface}" ]; then
${fwcmd} add divert natd all from ${inet}:${imask} to any via ${natd_interface}
fi
;;
esac
# FTP
${fwcmd} add allow all from any to 172.16.0.221 50000-50100 in via ${oif} setup
${fwcmd} add allow tcp from any to me 20,21
${fwcmd} add allow tcp from me 20,21 to any established
${fwcmd} add pass ICMP from any to any # Razreshit ping
${fwcmd} add deny icmp from any to any frag # Zapretit fragmentirovanie paketi
${fwcmd} add deny tcp from any to me 135,136,137,138,139 via ${oif}
${fwcmd} add pass tcp from any to any setup
${fwcmd} add pass tcp from any to any established
${fwcmd} add deny all from any to me
${fwcmd} add deny all from any to any
;;Код: Выделить всё
pass all from any to any
divert natd all from any to any via ng0Код: Выделить всё
pass all from сетьтунеелей to сеть тунелейКод: Выделить всё
deny all from локалкасеть to any via ng0Код: Выделить всё
# ipfw show
00100 0 0 pipe 1 tcp from 190.*.*.254 to any via nve0
00100 0 0 allow ip from any to any via lo0
00200 0 0 pipe 1 udp from 190.*.*.254 to any via nve0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 pipe 1 ip from 190.*.*.254 to any via nve0
00300 0 0 deny ip from 127.0.0.0/8 to any
00400 74 4808 allow tcp from any to me dst-port 22
00500 56 23648 allow tcp from me 22 to any established
00600 0 0 allow tcp from any to any
00700 0 0 divert 8668 ip from any to 190.*.*.254 via nve0
00800 0 0 divert 8668 ip from 172.16.0.0/16 to any via nve0
00900 48 4075 deny ip from any to any
65535 794151 77571663 deny ip from any to anyКод: Выделить всё
VPN_net="192.168.14.0"
VPN_mask="255.255.255.0"Код: Выделить всё
${fwcmd} add allow tcp from ${VPN_net}:${VPN_mask} to anyне понялparadox писал(а):рисуй схему
тьфу сначла divert потом алловhizel писал(а):после divert-ов allow надо давать, divert только преобразует адреса, но не пускает
Код: Выделить всё
00800 allow log logamount 100 tcp from any to any dst-port 80
00900 allow log logamount 100 tcp from any 80 to any establishedКод: Выделить всё
00800 allow log logamount 100 tcp from any to ${srvip} dst-port 80
00900 allow log logamount 100 tcp from ${srvip} 80 to any established