Не работает natd из под firewall

[maniac]

Вроде все настраивал по статьям но как только ставлю в rc.conf firewall_type="open" все работает, как ставлю firewall_type="simple" не работает нат
вот что у меня в rc.conf
-----------------------------------------------------------------------
#Nets settings
ifconfig_xl0="inet 192.168.1.235 netmask 255.255.255.0"
ifconfig_xl1="inet 213.34.12.10 netmask 255.255.255.252"

#NATD
natd_enable="YES"
natd_interface="xl1"
natd_flags=""
gateway_enable="YES"
defaultrouter="213.34.12.9"

inetd_enable="YES"

hostname="vasya.su"

sshd_enable="YES"

#Firewall
firewall_enable="YES"
firewall_logging="YES"
firewall_type="simple"
----------------------------------

и вот полный конфиг фаера
------------------------------------------

#!/bin/sh -

setup_loopback () {
############
# Only in rare cases do you want to change these rules
#
${fwcmd} add 100 pass all from any to any via lo0
${fwcmd} add 200 deny all from any to 127.0.0.0/8
${fwcmd} add 300 deny ip from 127.0.0.0/8 to any
}

if [ -n "${1}" ]; then
firewall_type="${1}"
fi

############
# Set quiet mode if requested

case ${firewall_quiet} in
[Yy][Ee][Ss])
fwcmd="/sbin/ipfw -q"
;;
*)
fwcmd="/sbin/ipfw"
;;
esac

############
# Flush out the list before we begin.
#
${fwcmd} -f flush
${fwcmd} add check-state

############
# Network Address Translation. All packets are passed to natd(8)
# before they encounter your remaining rules. The firewall rules
# will then be run again on each packet after translation by natd
# starting at the rule number following the divert rule.
#
# For ``simple'' firewall type the divert rule should be put to a
# different place to not interfere with address-checking rules.
#
case ${firewall_type} in
[Oo][Pp][Ee][Nn]|[Cc][Ll][Ii][Ee][Nn][Tt])
case ${natd_enable} in
[Yy][Ee][Ss])
if [ -n "${natd_interface}" ]; then
${fwcmd} add 50 divert natd all from any to any via ${natd_interface}
fi
;;
esac
esac

############
# If you just configured ipfw in the kernel as a tool to solve network
# problems or you just want to disallow some particular kinds of traffic
# then you will want to change the default policy to open. You can also
# do this as your only action by setting the firewall_type to ``open''.
#
${fwcmd} add 65000 pass all from any to any


# Prototype setups.
#
case ${firewall_type} in
[Oo][Pp][Ee][Nn])
setup_loopback
${fwcmd} add 65000 pass all from any to any
;;

[Cc][Ll][Ii][Ee][Nn][Tt])
############
# This is a prototype setup that will protect your system somewhat
# against people from outside your own network.
############

# set these to your network and netmask and ip
net="192.168.1.0"
mask="255.255.255.0"
ip="192.168.1.235"

setup_loopback

# Allow any traffic to or from my own net.
${fwcmd} add pass all from ${ip} to ${net}:${mask}
${fwcmd} add pass all from ${net}:${mask} to ${ip}

# Allow TCP through if setup succeeded
${fwcmd} add pass tcp from any to any established

# Allow IP fragments to pass through
${fwcmd} add pass all from any to any frag

# Allow setup of incoming email
${fwcmd} add pass tcp from any to ${ip} 25 setup

# Allow setup of outgoing TCP connections only
${fwcmd} add pass tcp from ${ip} to any setup

# Disallow setup of all other TCP connections
${fwcmd} add deny tcp from any to any setup

# Allow DNS queries out in the world
${fwcmd} add pass udp from ${ip} to any 53 keep-state

# Allow NTP queries out in the world
${fwcmd} add pass udp from ${ip} to any 123 keep-state

# Everything else is denied by default, unless the
# IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
# config file.
;;

[Ss][Ii][Mm][Pp][Ll][Ee])
############
# This is a prototype setup for a simple firewall. Configure this
# machine as a DNS and NTP server, and point all the machines
# on the inside at this machine for those services.
############

# set these to your outside interface network and netmask and ip
oif="xl1"
onet="213.34.12.8"
omask="255.255.255.252"
oip="213.34.12.10"

# set these to your inside interface network and netmask and ip
iif="xl0"
inet="192.168.1.0"
imask="255.255.255.0"
iip="192.168.1.235"

setup_loopback

# Stop spoofing
${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}

# Stop RFC1918 nets on the outside interface
${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}

# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}

# Network Address Translation. This rule is placed here deliberately
# so that it does not interfere with the surrounding address-checking
# rules. If for example one of your internal LAN machines had its IP
# address set to 192.0.2.1 then an incoming packet for it after being
# translated by natd(8) would match the `deny' rule above. Similarly
# an outgoing packet originated from it before being translated would
# match the `deny' rule below.
case ${natd_enable} in
[Yy][Ee][Ss])
if [ -n "${natd_interface}" ]; then
${fwcmd} add divert natd all from any to any via ${natd_interface}
fi
;;
esac

# Stop RFC1918 nets on the outside interface
${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}

# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}

# Allow TCP through if setup succeeded
${fwcmd} add pass tcp from any to any established

# Allow IP fragments to pass through
${fwcmd} add pass all from any to any frag

# Allow setup of incoming email
${fwcmd} add pass tcp from any to ${oip} 25 setup

# Allow access to our DNS
${fwcmd} add pass tcp from any to ${oip} 53 setup
${fwcmd} add pass udp from any to ${oip} 53
${fwcmd} add pass udp from ${oip} 53 to any

# Allow access to our WWW
${fwcmd} add pass tcp from any to ${oip} 80 setup

# Reject&Log all setup of incoming connections from the outside
${fwcmd} add deny log tcp from any to any in via ${oif} setup

# Allow setup of any other TCP connection
${fwcmd} add pass tcp from any to any setup

# Allow DNS queries out in the world
${fwcmd} add pass udp from ${oip} to any 53 keep-state

# Allow NTP queries out in the world
${fwcmd} add pass udp from ${oip} to any 123 keep-state

# Everything else is denied by default, unless the
# IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
# config file.
;;

[Cc][Ll][Oo][Ss][Ee][Dd])
setup_loopback
;;
[Uu][Nn][Kk][Nn][Oo][Ww][Nn])
;;
*)
if [ -r "${firewall_type}" ]; then
${fwcmd} ${firewall_flags} ${firewall_type}
fi
;;
esac

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[Alex Keda]

Код: Выделить всё

ipfw show

и есть такая кнопочка -

Код: Выделить всё

[maniac]

Код: Выделить всё

vasya# ipfw show
00100    0      0 check-state
00100  480  24960 allow ip from any to any via lo0
00200    0      0 deny ip from any to 127.0.0.0/8
00300    0      0 deny ip from 127.0.0.0/8 to any
65000 6413 814437 allow ip from any to any
65100    0      0 deny ip from 192.168.1.0/24 to any in via xl1
65200    0      0 deny ip from 213.34.12.10/30 to any in via xl0
65300    0      0 deny ip from any to 10.0.0.0/8 via xl1
65400    0      0 deny ip from any to 172.16.0.0/12 via xl1
65500    0      0 deny ip from any to 192.168.0.0/16 via xl1
65500    0      0 deny ip from any to 0.0.0.0/8 via xl1
65500    0      0 deny ip from any to 169.254.0.0/16 via xl1
65500    0      0 deny ip from any to 192.0.2.0/24 via xl1
65500    0      0 deny ip from any to 224.0.0.0/4 via xl1
65500    0      0 deny ip from any to 240.0.0.0/4 via xl1
65500    0      0 divert 8668 ip from any to any via xl1
65500    0      0 deny ip from 10.0.0.0/8 to any via xl1
65500    0      0 deny ip from 172.16.0.0/12 to any via xl1
65500    0      0 deny ip from 192.168.0.0/16 to any via xl1
65500    0      0 deny ip from 0.0.0.0/8 to any via xl1
65500    0      0 deny ip from 169.254.0.0/16 to any via xl1
65500    0      0 deny ip from 192.0.2.0/24 to any via xl1
65500    0      0 deny ip from 224.0.0.0/4 to any via xl1
65500    0      0 deny ip from 240.0.0.0/4 to any via xl1
65500    0      0 allow tcp from any to any established
65500    0      0 allow ip from any to any frag
65500    0      0 allow tcp from any to 213.34.12.10 dst-port 25 setup
65500    0      0 allow tcp from any to 213.34.12.10 dst-port 53 setup
65500    0      0 allow udp from any to 213.34.12.10 dst-port 53
65500    0      0 allow udp from 213.34.12.10 53 to any
65500    0      0 allow tcp from any to 213.34.12.10 dst-port 80 setup
65500    0      0 deny log logamount 50 tcp from any to any in via xl1 setup
65500    0      0 allow tcp from any to any setup
65500    0      0 allow udp from 213.34.12.10 to any dst-port 53 keep-state
65500    0      0 allow udp from 213.34.12.10 to any dst-port 123 keep-state
65535    0      0 deny ip from any to any
vasia#

[dikens3]

Не, ну ты сам посмотри где у тебя пакеты ходят. Счётчики то видишь?

До NAT ничего не доходит.

[maniac]

ну вот я чтото и не пойму каг сделать чтобы они ходили?

[dikens3]

ну вот я чтото и не пойму каг сделать чтобы они ходили?

Убери эту строку и посмотри что получится. :-)

[zorg]

и ещё!! а зафиг ставить : firewall_type="simple" ????

[maniac]

и что же ставить заместо type

[zorg]

а зачем там что то ставить???
Я например такую строку вообще не использую!!
Указываю тока путь на файл где описан фаер и всё!