Модератор: terminus
Код: Выделить всё
${fwcmd} add allow all from any to any MAC 00:17:31:a9:e9:9b 00:0c:42:1c:09:bd
${fwcmd} add allow all from any to any MAC 00:0c:42:1c:09:bd 00:17:31:a9:e9:9b
Код: Выделить всё
${fwcmd} add allow ip from $mylan to any 80 keep-stateКод: Выделить всё
${fwcmd} add allow ip from $mylan to any 80 via rl0 keep-state
Код: Выделить всё
sysctl -a | grep layer2Код: Выделить всё
sysctl -a | grep layer2Код: Выделить всё
ipfw add 65532 allow ip from any to any layer2 via rl0
ipfw add 65533 allow ip from any to any layer2Код: Выделить всё
${fwcmd} add deny log all from any to any layer2
Код: Выделить всё
layer2 via rl0Код: Выделить всё
case O_VIA:
{
char const *s;
ipfw_insn_if *cmdif = (ipfw_insn_if *)cmd;
if (cmd->opcode == O_XMIT)
s = "xmit";
else if (cmd->opcode == O_RECV)
s = "recv";
else /* if (cmd->opcode == O_VIA) */
s = "via";
if (cmdif->name[0] == '\0')
printf(" %s %s", s,
inet_ntoa(cmdif->p.ip)); /* inet_ntoa() - по-этому должен, хоть убей */
else
printf(" %s %s", s, cmdif->name);
break;
}
Код: Выделить всё
sysctl -a | grep etherКод: Выделить всё
fwcmd="/sbin/ipfw"
mylan="192.168.1.203, 192.168.1.201, 192.168.1.202, 192.168.1.204"
${fwcmd} -f flush
${fwcmd} add check-state
${fwcmd} add allow ip from any to any
${fwcmd} add allow all from any to any layer2 mac-type arp
${fwcmd} add allow all from any to any MAC 00:17:31:a9:e9:9b 00:0c:42:1c:09:bd
${fwcmd} add allow all from any to any MAC 00:0c:42:1c:09:bd 00:17:31:a9:e9:9b
${fwcmd} add allow all from any to any MAC 00:0e:2e:a9:6f:9e 00:0c:42:1c:09:bd
${fwcmd} add allow all from any to any MAC 00:0c:42:1c:09:bd 00:0e:2e:a9:6f:9e
${fwcmd} add allow all from any to any MAC 00:0c:t6:e4:4c:6h 00:0c:42:1c:09:bd
${fwcmd} add allow all from any to any MAC 00:0c:42:1c:09:bd 00:14:t6:e4:4c:6h
${fwcmd} add allow all from any to any MAC 00:0e:2w:a9:2e:4r 00:0c:42:1c:09:bd
${fwcmd} add allow all from any to any MAC 00:0c:42:1c:09:bd 00:0e:2w:a9:2e:4r
${fwcmd} add allow all from any to any MAC 00:14:t6:e4:4c:6h 00:0e:2e:a9:6f:9e
${fwcmd} add allow all from any to any MAC 00:0e:2e:a9:6f:9e 00:14:t6:e4:4c:6h
${fwcmd} add deny all from any to 127.0.0.0/8
${fwcmd} add deny all from 127.0.0.0/8 to any
${fwcmd} add deny all from any to 240.0.0.0/4
${fwcmd} add deny icmp from any to any frag
${fwcmd} add deny log icmp from any to 255.255.255.255
${fwcmd} add deny ip from 169.254.0.0/16 to any
${fwcmd} add allow tcp from any to any established
${fwcmd} add allow all from 192.168.1.2 to any 80 keep-state
${fwcmd} add allow udp from 192.168.1.2 to any 53 keep-state
${fwcmd} add allow udp from any to any 123 keep-state
${fwcmd} add allow tcp from $mylan to any 21
${fwcmd} add allow tcp from any 20 to $mylan
${fwcmd} add allow icmp from any to any icmptypes 0,8,11
${fwcmd} add allow tcp from $mylan to me 22 keep-state
${fwcmd} add allow tcp from $mylan to any 110,143,25,995 keep-state
${fwcmd} add allow tcp from $mylan to any 5190 keep-state
#${cmd} add allow icmp from 192.168.1.2 to any via bridge0 keep-state - вот такое уже не пашет
${fwcmd} add deny log all from any to any layer2
${fwcmd} add deny all from any to any
hizel писал(а):Код: Выделить всё
sysctl -a | grep ether
Код: Выделить всё
[root@lamer /usr/home/putin]# sysctl -a | grep ether
kern.random.sys.harvest.ethernet: 1
net.link.ether.inet.log_arp_permanent_modify: 1
net.link.ether.inet.log_arp_movements: 1
net.link.ether.inet.log_arp_wrong_iface: 1
net.link.ether.inet.proxyall: 0
net.link.ether.inet.useloopback: 1
net.link.ether.inet.maxtries: 5
net.link.ether.inet.max_age: 1200
net.link.ether.ipfw: 1
[root@lamer /usr/home/putin]#
Код: Выделить всё
${cmd} add allow log icmp from 192.168.1.2 to any via bridge0 keep-stateа эту опцию включали в sysctl ?net.link.bridge.pfil_member Set to 1 to enable filtering on the incoming
and outgoing member interfaces, set to 0 to
disable it.
Код: Выделить всё
[root@lamer /usr/home/putin]# sysctl -a | grep bridge
net.link.bridge.ipfw: 1
net.link.bridge.log_stp: 0
net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 1
net.link.bridge.pfil_bridge: 1
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_onlyip: 0
а мне так нравится..lissyara писал(а):путин на хосте ламер...
интересно...
Код: Выделить всё
[root@lamer /usr/home/putin]# sysctl -a | grep bridge
net.link.bridge.ipfw: 1
net.link.bridge.log_stp: 0
net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 1
net.link.bridge.pfil_bridge: 1
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_onlyip: 0Код: Выделить всё
net.link.bridge.ipfw: 1
net.link.bridge.log_stp: 0
net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 0
net.link.bridge.pfil_bridge: 0
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_onlyip: 0
Код: Выделить всё
net.link.bridge.pfil_member: 0