IPFW

paradox · Непрочитанное сообщение **paradox** » 2009-05-24 12:55:30

что бы все у всех работало!
вот какой смысл

а какой смысл от фаера?
защищаться от сферических коней в вакуме?

Хостинг HostFood.ru · **Хостинг HostFood.ru**

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

Alksndr · Непрочитанное сообщение **Alksndr** » 2009-05-25 0:15:31

а какой смысл от фаера?
защищаться от сферических коней в вакуме?

Жгеш! ладно, пошел курить man...

UPS!!! · Непрочитанное сообщение **UPS!!!** » 2009-06-28 1:25:38

По статье:
не логичнее было бы сначала позапрещать все, что можно\нужно запретить, а уже оставшееся
закидывать в НАТ - что б меньше пакетов обрабатывалось?
А то в статье дайверт в нат стоИт в самом начале.

kenny · Непрочитанное сообщение **kenny** » 2009-08-12 10:56:26

Код: Выделить всё

ipfw add allow tcp from 192.168.1.12 to not 192.168.1.0/24 in via em1 setup

Не работает правило, подскажите где я туплю?

sch · Непрочитанное сообщение **sch** » 2009-08-17 16:05:59

kenny писал(а):
Код: Выделить всё
ipfw add allow tcp from 192.168.1.12 to not 192.168.1.0/24 in via em1 setup
Не работает правило, подскажите где я туплю?

вместо in via напиши in recv

kenny · Непрочитанное сообщение **kenny** » 2009-08-17 16:25:22

не помогло

.
идеи еще есть?
Пойду наверное курить ман

terminus

все вроде правильно. вы все свои правила покажите - наверное режится где-то в другом месте.

kenny · Непрочитанное сообщение **kenny** » 2009-08-17 17:00:26

Код: Выделить всё

#!/bin/sh
ipfw -f pipe flush
ipfw -f queue flush
ipfw add allow ip from any to any via lo0
ipfw add allow ip from 192.168.1.0/24 to 192.168.1.0/24 via em1
ipfw add fwd 127.0.0.1,3128 tcp from 192.168.1.0/24 to any 80 via em0
ipfw add divert natd ip from 192.168.1.0/24 to any out via em0
ipfw add divert natd ip from any to 77.108.109.99 in via em0
ipfw add allow all from any to $out in via em0
ipfw add allow all from $out to any out via em0
ipfw add allow all from 192.168.1.0/24 to any in via em1
ipfw add allow all from any to 192.168.1.0/24 in via em0
ipfw add allow all from any to 192.168.1.0/24 out via em1
ipfw add deny log ip from any to any
ipfw add deny ip from any to 10.0.0.0/8 in via em0
ipfw add deny ip from any to 172.16.0.0/12 in via em0
ipfw add deny ip from any to 192.168.0.0/16 in via em0
ipfw add deny ip from any to 0.0.0.0/8 in via em0
ipfw add deny ip from any to 169.254.0.0/16 in via em0
ipfw add deny ip from any to 240.0.0.0/4 in via em0
ipfw add deny icmp from any to any frag
ipfw add allow tcp from any to any established
ipfw add allow ip from $out to any out xmit em0
ipfw add allow udp from any 53 to any via em0
ipfw add allow udp from any to any 53 via em0
ipfw add allow udp from any to any 123 via em0
ipfw add allow tcp from any to $out 21 via em0
ipfw add allow tcp from any to $out 49152-65535 via em0
ipfw add allow icmp from any to any icmptypes 0,8,11
ipfw add allow tcp from any to $out 80 via em0
ipfw add allow tcp from any to $out 22 via em0
ipfw add allow tcp from any to $out 143 via em0
ipfw add allow tcp from any to $out 110 via em0
ipfw add allow tcp from any to any via em1
ipfw add allow udp from any to any via em1
ipfw add allow icmp from any to any via em1
ipfw add deny ip from any to any

$out -- внешний интерфейс. Походу где то намудрил

terminus

очень много всего.
кинуть бы в вас вот этой ссылкой ( http://nuclight.livejournal.com/124348.html ), да боюсь что там слишком много всего будет для первого раза.

у вас в середине стоит

Код: Выделить всё

ipfw add deny log ip from any to any

все что после него - не работает.

к тому же неизвестно как настроен параметр one_pass

Код: Выделить всё

sysctl -a | grep one_pass

kenny · Непрочитанное сообщение **kenny** » 2009-08-17 17:27:57

terminus писал(а):очень много всего.
кинуть бы в вас вот этой ссылкой ( http://nuclight.livejournal.com/124348.html ), да боюсь что там слишком много всего будет для первого раза.

у вас в середине стоит
Код: Выделить всё
ipfw add deny log ip from any to any
все что после него - не работает.

к тому же неизвестно как настроен параметр one_pass
Код: Выделить всё
sysctl -a | grep one_pass

За ссылочку огромное спасибо. да и вообще спасибо большое.

Код: Выделить всё

sysctl -a | grep one_pass
net.inet.ip.fw.one_pass: 1

вот что у меня

harmless · Непрочитанное сообщение **harmless** » 2009-09-10 1:03:41

странности с фаерволлом!

Код: Выделить всё

# разрешаем входящую почту
${FwCMD} add allow tcp from any to ${IpOut} 25 in via ${LanOut} setup

По этому правилу по чему-то не проходят пакеты!

и из-за этих граблей не работает почта!
Хелп

paradox · Непрочитанное сообщение **paradox** » 2009-09-10 1:08:37

да вроде по такому правилу нечего и не ходит если мне не изменяет память

в любом случае нужен
ipfw show что бы народ что то увидел
а не одно правило выдернутое из контекста

harmless · Непрочитанное сообщение **harmless** » 2009-09-10 1:17:35

Код: Выделить всё

00001  1586   191654 allow ip from any to any via lo0
00001    45     2160 allow tcp from any to any dst-port 25 via rl0
00002  9892  2678080 count ip from table(0) to not me
00003   694    40752 count ip from 10.0.0.0/24 to me
00004     0        0 deny ip from any to 127.0.0.0/8
00005     0        0 deny ip from 127.0.0.0/8 to any
00006     8      938 deny ip from 10.0.0.0/24 to any in via rl0
00008    33     1584 deny ip from 10.0.0.31 to any in via vr0
00008     0        0 deny ip from 10.1.0.0/16 to any in via vr0
00008     0        0 deny ip from 10.2.0.0/15 to any in via vr0
00008     0        0 deny ip from 10.4.0.0/14 to any in via vr0
00008     0        0 deny ip from 10.8.0.0/13 to any in via vr0
00008     0        0 deny ip from 10.16.0.0/12 to any in via vr0
00008    18     2242 deny ip from 10.32.0.0/11 to any in via vr0
00008     0        0 deny ip from 10.64.0.0/10 to any in via vr0
00008     0        0 deny ip from 10.128.0.0/9 to any in via vr0
00019     0        0 deny ip from any to 172.16.0.0/12 in via rl0
00021     0        0 deny ip from any to 192.168.0.0/16 in via rl0
00023     0        0 deny ip from any to 0.0.0.0/8 in via rl0
00025     0        0 deny ip from any to 169.254.0.0/16 in via rl0
00027     0        0 deny ip from any to 224.0.0.0/4 in via rl0
00029     0        0 deny ip from any to 240.0.0.0/4 in via rl0
00031     0        0 deny icmp from any to any frag
00032     0        0 deny icmp from any to 255.255.255.255 in via rl0
00034     0        0 deny icmp from any to 255.255.255.255 out via rl0
00036  4938  1338102 nat 1 ip from 10.0.0.0/24 to any out via rl0
00038  9143  9340476 nat 1 ip from any to 10.60.77.51 in via rl0
00040     0        0 deny ip from 10.0.0.0/24 to any out via rl0
00042     0        0 deny ip from 172.16.0.0/12 to any out via rl0
00044     0        0 deny ip from 192.168.0.0/16 to any out via rl0
00046     0        0 deny ip from 0.0.0.0/8 to any out via rl0
00048     0        0 deny ip from 169.254.0.0/16 to any out via rl0
00050     0        0 deny ip from 224.0.0.0/4 to any out via rl0
00052     0        0 deny ip from 240.0.0.0/4 to any out via rl0
00054    72     4072 allow icmp from any to any icmptypes 0,3,4,8,10,11
00100     2      140 queue 100 ip from 10.0.0.1 20,21 to 10.0.0.8,10.0.0.65,10.0.0.66,10.0.0.135,10.0.0.199
00101     2      140 queue 1000 ip from 10.0.0.1 20,21 to 10.0.0.0/24
00102     1       40 queue 101 ip from 10.0.0.8,10.0.0.65,10.0.0.66,10.0.0.135,10.0.0.199 to 10.0.0.1 dst-port 20,21
00103     1       40 queue 1001 ip from 10.0.0.0/24 to 10.0.0.1 dst-port 20,21
00107     0        0 queue 105 ip from 91.192.152.107 20,21 to 10.0.0.8,10.0.0.65,10.0.0.66,10.0.0.135,10.0.0.199
00108     0        0 queue 1005 ip from 91.192.152.107 20,21 to table(0)
00109     0        0 queue 106 ip from 10.0.0.8,10.0.0.65,10.0.0.66,10.0.0.135,10.0.0.199 to 91.192.152.107 dst-port 20,21
00110     0        0 queue 1006 ip from table(0) to 91.192.152.107 dst-port 20,21
00200  4896  6926319 pipe 1 ip from not 10.0.0.0/24 to table(1) out
00201  2704   187032 pipe 2 ip from table(1) to not me in
00202     0        0 pipe 3 ip from not 10.0.0.0/24 to table(2) out
00203     0        0 pipe 4 ip from table(2) to not me in
00204  2406  2225877 pipe 5 ip from not 10.0.0.0/24 to table(4) out
00205  2242  1152008 pipe 6 ip from table(4) to not me in
00206     0        0 pipe 7 ip from not 10.0.0.0/24 to table(5) out
00207     0        0 pipe 8 ip from table(5) to not me in
00208     0        0 pipe 9 ip from not 10.0.0.0/24 to table(6) out
00209     0        0 pipe 10 ip from table(6) to not me in
00210     0        0 pipe 11 ip from not 10.0.0.0/24 to table(3) out
00211     0        0 pipe 12 ip from table(3) to not me in
00300  2330  2111877 queue 23 ip from not 10.0.0.0/24 to 10.0.0.8,10.0.0.65,10.0.0.66,10.0.0.135,10.0.0.199 out
00301  2242  1152008 queue 25 ip from 10.0.0.8,10.0.0.65,10.0.0.66,10.0.0.135,10.0.0.199 to not me in
00400 25604 21187903 allow log logamount 10 tcp from any to any established
00401     0        0 allow udp from any to 10.60.77.51 dst-port 53 in via rl0
00403     0        0 allow udp from 10.60.77.51 53 to any out via rl0
00405   469    95637 allow udp from any 53 to 10.60.77.51 in via rl0
00407   493    39828 allow udp from 10.60.77.51 to any dst-port 53 out via rl0
00409    24     1824 allow udp from any to any dst-port 123 via rl0
00411     1       64 allow tcp from any to 10.60.77.51 dst-port 53 in via rl0 setup
00413     1       64 allow tcp from any to 10.60.77.51 dst-port 80 via rl0 setup
00415     0        0 allow log logamount 10 tcp from any to 10.60.77.51 dst-port 22 in via rl0 setup
00417     0        0 allow log logamount 10 tcp from any to 10.60.77.51 dst-port 25 via rl0 setup
00418     1       64 allow log logamount 10 tcp from any to 10.60.77.51 dst-port 110 via rl0 setup
00418     1       64 allow log logamount 10 tcp from any to 10.60.77.51 dst-port 143 via rl0 setup
00419     0        0 allow tcp from any to 10.60.77.51 dst-port 49152-65535 via rl0 setup
00430     0        0 allow tcp from any to 10.60.77.51 dst-port 20 via rl0 setup
00431     1       64 allow tcp from any to 10.60.77.51 dst-port 21 via rl0 setup
00500     0        0 allow udp from any 26900-27025 to 10.0.0.0/24 in via rl0
00502     0        0 allow udp from any 26900-27025 to 10.0.0.0/24 out via vr0
00503     0        0 allow udp from 10.0.0.0/24 to any dst-port 26900-27025 in via vr0
00504     0        0 allow udp from 10.60.77.51 to any dst-port 26900-27025 out via rl0
00506     0        0 allow tcp from any 26900-27025 to 10.0.0.0/24 in via rl0 setup
00508     0        0 allow tcp from any 26900-27025 to 10.0.0.0/24 out via vr0 setup
00509     0        0 allow tcp from 10.0.0.0/24 to any dst-port 26900-27025 in via vr0 setup
00510     0        0 allow tcp from 10.60.77.51 to any dst-port 26900-27025 out via rl0 setup
00600  1022    49964 deny tcp from any to 10.60.77.51 in via rl0 setup
00700   104     6457 allow ip from 10.0.0.0/24 to 10.0.0.0/24 in via vr0
00701    47     9864 allow ip from 10.0.0.0/24 to 10.0.0.0/24 out via vr0
00702    90     4464 allow ip from 10.60.77.51 to any out xmit rl0
00704    86     4272 allow tcp from table(0) to not 10.0.0.0/24 in via vr0 setup
00800     0        0 allow tcp from 10.0.0.8,10.0.0.65,10.0.0.66,10.0.0.135,10.0.0.199 to not 10.0.0.0/24 in via vr0 setup
00900   327    42581 deny log logamount 10 ip from any to any
65535     0        0 deny ip from any to any

а на сколько я понял на нем далжна висеть почта - но даже телнетом на него не попадаю!

harmless

Все оказалось на много проще

- просто на провайдере закрыли 25 порт в обе стороны!

Gamerman

Странный провайдер у вас

harmless

Gamerman писал(а):Странный провайдер у вас

И не говорите!)

Nickuz · Непрочитанное сообщение **Nickuz** » 2009-09-23 7:55:23

Gamerman писал(а):Странный провайдер у вас

Весьма даже нормальный провайдер. Блюдет защиту от почтовых ботов.

harmless

какой же он нормальный, если на реал IP не дает доступ на почтовики 25 портом!

Gamerman

harmless писал(а):какой же он нормальный, если на реал IP не дает доступ на почтовики 25 портом!

+1.
Даже если это какая-то Домосеть.

Nickuz · Непрочитанное сообщение **Nickuz** » 2009-09-24 10:52:29

Гораздо проще зарезать 25 порт, чем потом выцеплять свои адреса из всяких блэклистов. Косяк только в том, что порт закрыт,а в договоре это не описано.

hizel · Непрочитанное сообщение **hizel** » 2009-09-24 11:33:55

Nickuz писал(а):Гораздо проще зарезать 25 порт, чем потом выцеплять свои адреса из всяких блэклистов. Косяк только в том, что порт закрыт,а в договоре это не описано.

на кол быстро и решительно!

хотя у мя был один клиент, который мой почтовичок хорошо прижал https://mail.vyborg.ru/graph смотреть всплеск в мае, теперь на yahoo.com.tw зобанен, мыслю навечно ^_^

dreamond

народ не устроите ли критику ниже лежащему rc.firewall на предмет откровенных и не очень косяков?
исходные данные:
freeBSD 6 ядро собрано с опциями

Код: Выделить всё

options         IPFIREWALL
options         IPFIREWALL_VERBOSE
 options         IPFIREWALL_VERBOSE_LIMIT=5
options         IPFIREWALL_FORWARD
options         IPDIVERT 
options         IPFIREWALL_DEFAULT_TO_ACCEPT

+ установлен SQUID+SAMS
внешний интерфейс rl0 IP xxx.xxx.xxx.xxx
внутренний интерфейс re0 IP 192.168.0.2
разрешение на весь internet трафик терминалам оплаты с IP 192.168.0.3---04---05
запрет на весь internet трафик ресепшену с IP 192.168.0.51---52---53---54---56---57---58---60---61

содержимое rc.firewall (сразу приношу извинения за то что привел все содержимое- первый раз конфигурирую не хотелось бы сделать глупейший ляп)

Код: Выделить всё

#!/bin/sh -
# Copyright (c) 1996  Poul-Henning Kamp
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#
# $FreeBSD: src/etc/rc.firewall,v 1.47.10.4.2.1 2008/10/02 02:57:24 kensmith Exp $
#

#
# Setup system for ipfw(4) firewall service.
#
#DANNbIE PO VNESHNEI SETI
LanOut="rl0"
IPOut="xxx.xxx.xxx.xxx"
NetOut="29"
MaskOut="255.255.255.248"

#DANNbIE PO VNUTRENNEI SETI
LanIn="re0"
IPIn="192.168.0.2"
NetInIP="192.168.0.0"
NetInMask="24"
MaskIn="255.255.255.0"


#NE VbIVODIT SOOBCHENIA IPFW NA CONSOL
fwcmd="/sbin/ipfw -q"

# Suck in the configuration variables.
if [ -z "${source_rc_confs_defined}" ]; then
        if [ -r /etc/defaults/rc.conf ]; then
                . /etc/defaults/rc.conf
                source_rc_confs
        elif [ -r /etc/rc.conf ]; then
                . /etc/rc.conf
        fi
fi

############
# Define the firewall type in /etc/rc.conf.  Valid values are:
#   open     - will allow anyone in
#   client   - will try to protect just this machine
#   simple   - will try to protect a whole network
#   closed   - totally disables IP services except via lo0 interface
#   UNKNOWN  - disables the loading of firewall rules.
#   filename - will load the rules in the given filename (full path required)
#
# For ``client'' and ``simple'' the entries below should be customized
# appropriately.

############
#
# If you don't know enough about packet filtering, we suggest that you
# take time to read this book:
#
#       Building Internet Firewalls, 2nd Edition
#       Brent Chapman and Elizabeth Zwicky
#
#       O'Reilly & Associates, Inc
#       ISBN 1-56592-871-7
#       http://www.ora.com/
#       http://www.oreilly.com/catalog/fire2/
#
# For a more advanced treatment of Internet Security read:
#
#       Firewalls and Internet Security: Repelling the Wily Hacker, 2nd Edition
#       William R. Cheswick, Steven M. Bellowin, Aviel D. Rubin
#
#       Addison-Wesley / Prentice Hall
#       ISBN 0-201-63466-X
#       http://www.pearsonhighered.com/
#       http://www.pearsonhighered.com/educator/academic/product/0,3110,020163466X,00.html
#

setup_loopback () {
        ############
        # Only in rare cases do you want to change these rules
        #
        ${fwcmd} add 100 pass all from any to any via lo0
        ${fwcmd} add 200 deny all from any to 127.0.0.0/8
        ${fwcmd} add 300 deny ip from 127.0.0.0/8 to any
}

if [ -n "${1}" ]; then
        firewall_type="${1}"
fi

############
# Set quiet mode if requested
#
case ${firewall_quiet} in
[Yy][Ee][Ss])
        fwcmd="/sbin/ipfw -q"
        ;;
*)
        fwcmd="/sbin/ipfw"
        ;;
esac

############
# Flush out the list before we begin.
#
${fwcmd} -f flush

############
# Network Address Translation.  All packets are passed to natd(8)
# before they encounter your remaining rules.  The firewall rules
# will then be run again on each packet after translation by natd
# starting at the rule number following the divert rule.
#
# For ``simple'' firewall type the divert rule should be put to a
# different place to not interfere with address-checking rules.
#
case ${firewall_type} in
[Oo][Pp][Ee][Nn]|[Cc][Ll][Ii][Ee][Nn][Tt])
        case ${natd_enable} in
        [Yy][Ee][Ss])
                if [ -n "${natd_interface}" ]; then
                        ${fwcmd} add 50 divert natd ip4 from any to any via ${natd_interface}
                fi
                ;;
        esac
esac

############
# If you just configured ipfw in the kernel as a tool to solve network
# problems or you just want to disallow some particular kinds of traffic
# then you will want to change the default policy to open.  You can also
# do this as your only action by setting the firewall_type to ``open''.
#
# ${fwcmd} add 65000 pass all from any to any


# Prototype setups.
#
case ${firewall_type} in
[Oo][Pp][Ee][Nn])
        setup_loopback
        ${fwcmd} add 65000 pass all from any to any
        ;;

[Cc][Ll][Ii][Ee][Nn][Tt])
        ############
        # This is a prototype setup that will protect your system somewhat
        # against people from outside your own network.
        #
        # Configuration:
        #  firewall_client_net:         Network address of local network.
        ############

        # set this to your local network
        net="$firewall_client_net"

        setup_loopback

        # Allow any traffic to or from my own net.
        ${fwcmd} add pass all from me to ${net}
        ${fwcmd} add pass all from ${net} to me

        # Allow TCP through if setup succeeded
        ${fwcmd} add pass tcp from any to any established

        # Allow IP fragments to pass through
        ${fwcmd} add pass all from any to any frag

        # Allow setup of incoming email
        ${fwcmd} add pass tcp from any to me 25 setup

        # Allow setup of outgoing TCP connections only
        ${fwcmd} add pass tcp from me to any setup

        # Disallow setup of all other TCP connections
        ${fwcmd} add deny tcp from any to any setup

        # Allow DNS queries out in the world
        ${fwcmd} add pass udp from me to any 53 keep-state

        # Allow NTP queries out in the world
        ${fwcmd} add pass udp from me to any 123 keep-state

        # Everything else is denied by default, unless the
        # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
        # config file.
        ;;

[Ss][Ii][Mm][Pp][Ll][Ee])
        ############
        # This is a prototype setup for a simple firewall.  Configure this
        # machine as a DNS and NTP server, and point all the machines
        # on the inside at this machine for those services.
        #
        # Configuration:
        #  firewall_simple_iif:         Inside network interface.
        #  firewall_simple_inet:        Inside network address.
        #  firewall_simple_oif:         Outside network interface.
        #  firewall_simple_onet:        Outside network address.
        ############

        # set these to your outside interface network
        oif="$firewall_simple_oif"
        onet="$firewall_simple_onet"

        # set these to your inside interface network
        iif="$firewall_simple_iif"
        inet="$firewall_simple_inet"

        setup_loopback

        # Stop spoofing
        ${fwcmd} add deny all from ${inet} to any in via ${oif}
        ${fwcmd} add deny all from ${onet} to any in via ${iif}

        # Stop RFC1918 nets on the outside interface
        ${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
        ${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
        ${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}

        # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
        # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
        # on the outside interface
        ${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
        ${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
        ${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
        ${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
        ${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}

        # Network Address Translation.  This rule is placed here deliberately
        # so that it does not interfere with the surrounding address-checking
        # rules.  If for example one of your internal LAN machines had its IP
        # address set to 192.0.2.1 then an incoming packet for it after being
        # translated by natd(8) would match the `deny' rule above.  Similarly
        # an outgoing packet originated from it before being translated would
        # match the `deny' rule below.
        case ${natd_enable} in
        [Yy][Ee][Ss])
                if [ -n "${natd_interface}" ]; then
                        ${fwcmd} add divert natd all from any to any via ${natd_interface}
                fi
                ;;
        esac

        # Stop RFC1918 nets on the outside interface
        ${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
        ${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
        ${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}

        # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
        # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
        # on the outside interface
        ${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
        ${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
        ${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
        ${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
        ${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}

        # Allow TCP through if setup succeeded
        ${fwcmd} add pass tcp from any to any established

        # Allow IP fragments to pass through
        ${fwcmd} add pass all from any to any frag

        # Allow setup of incoming email
        ${fwcmd} add pass tcp from any to me 25 setup

        # Allow access to our DNS
        ${fwcmd} add pass tcp from any to me 53 setup
        ${fwcmd} add pass udp from any to me 53
        ${fwcmd} add pass udp from me 53 to any

        # Allow access to our WWW
        ${fwcmd} add pass tcp from any to me 80 setup

        # Reject&Log all setup of incoming connections from the outside
        ${fwcmd} add deny log tcp from any to any in via ${oif} setup

        # Allow setup of any other TCP connection
        ${fwcmd} add pass tcp from any to any setup

        # Allow DNS queries out in the world
        ${fwcmd} add pass udp from me to any 53 keep-state

        # Allow NTP queries out in the world
        ${fwcmd} add pass udp from me to any 123 keep-state

        # Everything else is denied by default, unless the
        # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
        # config file.
        ;;

[Cc][Ll][Oo][Ss][Ee][Dd])
        setup_loopback
        ;;
[Uu][Nn][Kk][Nn][Oo][Ww][Nn])
        ;;
*)
        if [ -r "${firewall_type}" ]; then
                ${fwcmd} ${firewall_flags} ${firewall_type}
        fi
        ;;



#SBROS VSEX PRAVIL
${FwCMD} -f flush

#PROVERKA PAKETA NA SOOTVETSTVIE DINAMICHESKIM PRAVILAM
${FwCMD} add check-state

#ZAPUSK VNUTRENNE PETLI + ZAPRET CVIAZI C VNECHNIM MIROM PETLI (lo0)
${FwCMD} add allow ip from any to any via lo0
${FwCMD} add deny ip from any to 127.0.0.0/8
${FwCMD} add deny ip from 127.0.0.0/8 to any

#RUBIM CHASTNbIE SETI_1

${FwCMD} add deny ip from any to 10.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 172.16.0.0/12 in via ${LanOut}
${FwCMD} add deny ip from any to 192.168.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 0.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 10.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 172.16.0.0/12 in via ${LanOut}
${FwCMD} add deny ip from any to 192.168.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 0.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 169.254.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 240.0.0.0/4 in via ${LanOut}
${FwCMD} add deny icmp from any to any frag
${FwCMD} add deny log icmp from any to 255.255.255.255 in via ${LanOut}
${FwCMD} add deny log icmp from any to 255.255.255.255 out via ${LanOut}

# OTPRAVLYAEM VSEH NA FROX
${FwCMD} add fwd ${IpIn},2121 tcp from ${NetIn}/${NetMask} to any 21 via ${LanOut}

# OTPRAVLYAEM VSEH NA SQUID 
${FwCMD} add fwd 127.0.0.1,3128 tcp from ${NetIn}/${NetMask} to any 80 via ${LanOut}

# propuskaem traffik cherez translyaciyu setevyh adresov (NAT)
${FwCMD} add divert natd ip from ${NetIn}/${NetMask} to any out via ${LanOut}
${FwCMD} add divert natd ip from any to ${IpOut} in via ${LanOut}

# rubim traffik k chastnym setyam cherez vneshnii interfeis
${FwCMD} add deny ip from 10.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 172.16.0.0/12 to any out via ${LanOut}
${FwCMD} add deny ip from 192.168.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 0.0.0.0/8 to any out via ${LanOut}

# rubim avtokonfigurenuyu chastnuyu seti
${FwCMD} add deny ip from 169.254.0.0/16 to any out via ${LanOut}


# rubaem multikastovye rassylki
${FwCMD} add deny ip from 240.0.0.0/4 to any out via ${LanOut}


# razreshaem vse ustanovlennye soedineniya
${FwCMD} add allow tcp from any to any established

# razreshaem ves' ishodyaschii traffik
${FwCMD} add allow ip from ${IpOut} to any out xmit ${LanOut}

# razreshaem DNS snaruji
${FwCMD} add allow udp from any 53 to any via ${LanOut}

# razreshaem DNS vhodyaschii snaruji
${FwCMD} add allow udp from any to any 53 via ${LanOut}

# razreshaem UDP (dlya sinhronizacii vremeni - 123 port)
${FwCMD} add allow udp from any to any 123 via ${LanOut}

# EHO-ZAPROS, EHO-OTVET I VREMYA JIZNI PAKETA ISTEKLO
${FwCMD} add allow icmp from any to any icmptypes 0,8,11

# OTKRYVAEM SNARUJI 80 PORT - ESLI U NAS EST' WWW SERVER NA MASHINE
${FwCMD} add allow tcp from any to ${IpOut} 80 via ${LanOut}

# OTKRYVAEM SNARUJI 22 PORT - ESLI NADO BUDET HODIT' NA MASHINU PO SSH
${FwCMD} add allow tcp from any to ${IpOut} 22 via ${LanOut}

# OTKRYVAEM SNARUJI 143 PORT(ESLI NADO SMOTRET' POCHTU SNARUJI PO IMAP)
${FwCMD} add allow tcp from any to ${IpOut} 143 via ${LanOut}

# OTKRYVAEM SNARUJI 110 PORT(ESLI NADO SMOTRET' POCHTU SNARUJI PO POP)
${FwCMD} add allow tcp from any to ${IpOut} 110 via ${LanOut}

# RAZRESHAEM VES TCP TRAFFIK VNUTRI LOKALKI (NA VNUTRENNEM INTERFEISE)
${FwCMD} add allow tcp from any to any via ${LanIn}

# RAZRESHAEM VES UDP TRAFFIK VNUTRI LOKALKI (NA VNUTRENNEM INTERFEISE)
${FwCMD} add allow udp from any to any via ${LanIn}

# RAZRESHAEM VES ICMP TRAFFIK VNUTRI LOKALKI (NA VNUTRENNEM INTERFEISE)
${FwCMD} add allow icmp from any to any via ${LanIn}

# RAZRESHAEM VSE TERMINALAM
${FwCMD} add allow all from 192.168.0.3 to any
${FwCMD} add allow all from any to 192.168.0.3
${FwCMD} add allow all from 192.168.0.4 to any
${FwCMD} add allow all from any to 192.168.0.4
${FwCMD} add allow all from 192.168.0.5 to any
${FwCMD} add allow all from any to 192.168.0.5

#RECEPTION (ZAPRET NA VbIXOD)
${FwCMD} add deny ip from 192.168.0.151 to any
${FwCMD} add deny ip from any to 192.168.0.151
${FwCMD} add deny ip from 192.168.0.152 to any
${FwCMD} add deny ip from any to 192.168.0.152
${FwCMD} add deny ip from 192.168.0.153 to any
${FwCMD} add deny ip from any to 192.168.0.153
${FwCMD} add deny ip from 192.168.0.154 to any
${FwCMD} add deny ip from any to 192.168.0.154
${FwCMD} add deny ip from 192.168.0.156 to any
${FwCMD} add deny ip from any to 192.168.0.156
${FwCMD} add deny ip from 192.168.0.157 to any
${FwCMD} add deny ip from any to 192.168.0.157
${FwCMD} add deny ip from 192.168.0.158 to any
${FwCMD} add deny ip from any to 192.168.0.158
${FwCMD} add deny ip from 192.168.0.160 to any
${FwCMD} add deny ip from any to 192.168.0.160
${FwCMD} add deny ip from 192.168.0.161 to any
${FwCMD} add deny ip from any to 192.168.0.161


# ZAPRECHAEM VSE (ESLI PAKET NE SOVPADAET SRABOTAET ETO PRAVILO)
${FwCMD} add deny ip from any to any

Fakir · Непрочитанное сообщение **Fakir** » 2009-10-17 14:09:39

Вот пытаюсь составить правила для ipfw.

Код: Выделить всё

#!/bin/sh
#=======================
cmd="/sbin/ipfw add "
fw="/sbin/ipfw "
WIF="rl1"
LIF="rl0"
WAN="10.83.14.3"
LAN="192.168.100.0/24"
#=======================
$fw -f flush
$fw nat 123 config ip $WAN log
$fw nat 123 config if rl1 same_ports unreg_only redirect_port tcp 192.168.100.1:28575 28575
$cmd 10 nat 123 ip from $LAN to any keep-state
$cmd 20 nat 123 ip from any to $WAN
$cmd 30 allow tcp from any to any 21 via $WIF
$cmd 500 allow tcp from any to any via $LIF
$cmd 600 allow udp from any to any via $LIF
$cmd 700 allow icmp from any to any via $LIF
$cmd 65534 deny log all from any to any

Но почему то не получается открыть наружу порт фтп, правило 30 не срабатывает.

reLax · Непрочитанное сообщение **reLax** » 2009-10-17 14:14:06

Fakir писал(а):Вот пытаюсь составить правила для ipfw.
Код: Выделить всё
#!/bin/sh
#=======================
cmd="/sbin/ipfw add "
fw="/sbin/ipfw "
WIF="rl1"
LIF="rl0"
WAN="10.83.14.3"
LAN="192.168.100.0/24"
#=======================
$fw -f flush
$fw nat 123 config ip $WAN log
$fw nat 123 config if rl1 same_ports unreg_only redirect_port tcp 192.168.100.1:28575 28575
$cmd 10 nat 123 ip from $LAN to any keep-state
$cmd 20 nat 123 ip from any to $WAN
$cmd 30 allow tcp from any to any 21 via $WIF
$cmd 500 allow tcp from any to any via $LIF
$cmd 600 allow udp from any to any via $LIF
$cmd 700 allow icmp from any to any via $LIF
$cmd 65534 deny log all from any to any
Но почему то не получается открыть наружу порт фтп, правило 30 не срабатывает.

man RFC959
man OSI
21-й порт пассивного FTP - это всего-лишь контрольный порт, потом уже на уровне модели OSI Layer 7, на уровне приложения, протокол в IP-дейтаграмме в поле DATA назначает порт приема-передачи.
ipfw работает на 2-3м уровнях модели OSI. Делай выводы. Открывай порты sysctl net.inet.ip.portrange.first - net.inet.ip.portrange.last. Вот такой вот тупой протокол

Или юзай ftp-proxy

Fakir · Непрочитанное сообщение **Fakir** » 2009-10-17 14:29:57

Хорошо, я пробую открыть 22 порт ssh, но опять же не работает.
В лог пишется что соеденение на этот порт заблокировано.

Код: Выделить всё

Oct 17 15:24:25 server kernel: ipfw: 65534 Deny TCP 10.83.14.3:22 188.40.74.9:46512 out via rl1

forum.lissyara.su

IPFW

Re: IPFW

Услуги хостинговой компании Host-Food.ru

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW

Re: IPFW