система
Код: Выделить всё
FreeBSD 6.3-RELEASE-p4 FreeBSD 6.3-RELEASE-p4 #0: Tue Oct 28 18:05:22 EET 2008 root@ :/usr/obj/usr/src/sys/GEN-DR-EDS-reserv2 amd64
Код: Выделить всё
#pf
device pf
device pflog
device pfsync
#ALTQ for pf
options ALTQ
options ALTQ_CBQ # Class Bases Queuing (CBQ)
options ALTQ_RED # Random Early Detection (RED)
options ALTQ_RIO # RED In/Out
options ALTQ_HFSC # Hierarchical Packet Scheduler (HFSC)
options ALTQ_PRIQ # Priority Queuing (PRIQ)
options ALTQ_NOPCC # Required for SMP build
Код: Выделить всё
#Defining macros
int_if="re0"
ext_if_trifle="em0"
ext_if_ipclub="sk0"
int_net_0="192.168.0.0/24"
int_net_33="192.168.33.0/24"
int_net_10_0="10.0.0.0/24"
kiev_net="192.168.100.0/24"
harkov_net="192.168.110.0/24"
odessa_net="192.168.120.0/24"
interio="192.168.11.1/29"
tach="192.168.11.8/30"
trifle_net="111.x.trf.208/29"
ipclub_net="111.y.ipc.248/29"
trifle_ip="111.z.trf.78"
ipclub_ip="111.j.ipc.251"
trifle_gw="111.z.trf.77"
ipclub_gw="111.j.ipc.249"
services="{ smtp www imaps pop3s pptp 20001 20002 30001 }"
tinc="44444"
# Defining tables
table <private_net> { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 224.0.0.0/4, 240.0.0.0/4 }
table <filial_real_ip> { xxx.xxx.xxx.xxx, yyy.yyy.yyy.yyy, zzz.zzz.zzz.zzz, jjj.jjj.jjj.jjj }
table <nat_to_ipclub> { 192.168.0.6, 192.168.0.10, 192.168.0.17, 192.168.0.18, 192.168.0.88, 192.168.33.10, 192.168.33.11, 192.168.33.33, 192.168.33.100, 192.168.0.100, 192.168.0.176, 192.168.0.192, 192.168.0.193, 192.168.0.194, 192.168.0.195, 192.168.33.200, 192.168.33.201, 192.168.0.202, 192.168.0.249, 192.168.0.253, 192.168.0.199, 192.168.0.6, 192.168.0.70, 192.168.0.146, 192.168.0.111 }
table <nat_to_trifle> { 192.168.0.58, 192.168.0.52, 192.168.0.227, 192.168.0.229 }
table <eds_local> { $int_net_0, $int_net_33, $int_net_10_0, $kiev_net, $harkov_net, $odessa_net, $interio, $tach }
table <bug> { 192.168.0.203, 192.168.0.204, 192.168.0.210 }
# SET Skipping ifaces
set skip on lo0
set skip on $int_if
#set skip on tun0
#set skip on ng0
#set skip on ng1
#set skip on ng2
#set skip on ng3
#set skip on ng4
#set skip on ng5
#set skip on ng6
#set skip on ng7
#set skip on ng8
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in on $ext_if_ipclub
scrub in on $ext_if_trifle
scrub out on $ext_if_ipclub random-id max-mss 1440
scrub out on $ext_if_trifle random-id max-mss 1440
# queues
# NAT and RDR
# ICQ for all out
nat pass on $ext_if_ipclub proto tcp from { $int_net_0, $int_net_33 } to any port 5190 -> $ipclub_ip
# NAT to our ext www
nat on $ext_if_ipclub from <eds_local> to xxx.xxx.xxx.xxx -> $ipclub_ip
#NAT to ipclub
nat on $ext_if_ipclub from <nat_to_ipclub> to any -> $ipclub_ip
# NAT of buhs for Bestzvit
nat on $ext_if_ipclub from <bug> to any -> $ipclub_ip
#NAT to trifle
nat on $ext_if_trifle from <nat_to_trifle> to any -> $trifle_ip
#rdr for dron's torrent
rdr pass on $ext_if_ipclub proto tcp from any to $ipclub_ip port 31370 -> 192.168.0.88 port 31370
#rdr for teslenko's emule
rdr on $ext_if_trifle proto tcp from any to $trifle_ip port 4662 tag TESL_EMULE_TCP -> 192.168.0.58 port 4662
#rdr for VoIP gate
rdr pass on $ext_if_ipclub proto tcp from any to $ipclub_ip port 5060 -> 192.168.0.6 port 5060
rdr pass on $ext_if_ipclub proto udp from any to $ipclub_ip port 5060 -> 192.168.0.6 port 5060
# FILTERING
# policy blocking all
block all
# loopback
pass in quick on lo0 all
pass out quick on lo0 all
# re0 local iface
pass in quick on re0 all
pass out quick on re0 all
# tinc filial vpn iface
pass in quick log on tun0 all
pass out quick log on tun0 all
# ng0 mpd users vpn
pass in quick on ng0 all
pass out quick on ng0 all
# ng1 mpd users vpn
pass in quick on ng1 all
pass out quick on ng1 all
# ng2 mpd users vpn
pass in quick on ng2 all
pass out quick on ng2 all
# ng3 mpd users vpn
pass in quick on ng3 all
pass out quick on ng3 all
# ng4 mpd users vpn
pass in quick on ng4 all
pass out quick on ng4 all
# ng5 mpd users vpn
pass in quick on ng5 all
pass out quick on ng5 all
# ng6 mpd users vpn
pass in quick on ng6 all
pass out quick on ng6 all
# ng7 mpd users vpn
pass in quick on ng7 all
pass out quick on ng7 all
# ng8 mpd users vpn
pass in quick on ng8 all
pass out quick on ng8 all
# ng9 mpd users vpn
pass in quick on ng9 all
pass out quick on ng9 all
# pass ssh from everywhere
pass in quick proto tcp from any to any port ssh
pass in quick on $ext_if_trifle reply-to($ext_if_trifle $trifle_gw) proto tcp to { $trifle_ip, $trifle_net } port ssh
pass in quick on $ext_if_ipclub reply-to($ext_if_ipclub $ipclub_gw) proto tcp to $ipclub_ip port ssh
pass out quick proto tcp from any port ssh to any
# pass icmp pings
#pass inet proto icmp all icmp-type echoreq code 0 keep state
#pass inet proto icmp all icmp-type unreach code 0 keep state
pass in on $ext_if_ipclub reply-to($ext_if_ipclub $ipclub_gw) inet proto icmp all icmp-type echoreq code 0 keep state
pass in on $ext_if_ipclub reply-to($ext_if_ipclub $ipclub_gw) inet proto icmp all icmp-type unreach code 0 keep state
pass in on $ext_if_trifle reply-to($ext_if_trifle $trifle_gw) inet proto icmp all icmp-type echoreq code 0 keep state
pass in on $ext_if_trifle reply-to($ext_if_trifle $trifle_gw) inet proto icmp all icmp-type unreach code 0 keep state
#
pass in quick reply-to($ext_if_trifle $trifle_gw) tagged TESL_EMULE_TCP keep state
# pass all out from ext ifaces
pass out on $ext_if_ipclub from $ipclub_net to any keep state
pass out on $ext_if_trifle from { $trifle_net, $trifle_ip } to any keep state
#pass out on $ext_if_trifle from $trifle_ip to any keep state
# block private networks on ext ifaces
#block quick on $ext_if_ipclub from any to <private_net>
#block quick on $ext_if_ipclub from <private_net> to any
#block quick on $ext_if_trifle from any to <private_net>
#block quick on $ext_if_trifle from <private_net> to any
# route trifle users to trifle
pass out route-to($ext_if_trifle $trifle_gw) from <nat_to_trifle> to !<eds-local>
pass out route-to($ext_if_trifle $trifle_gw) from $trifle_ip
#pass out route-to($ext_if_ipclub $ipclub_gw) from $ipclub_ip
# pass filials and shops to tinc
pass in on $ext_if_ipclub reply-to($ext_if_ipclub $ipclub_gw) proto tcp from <filial_real_ip> to $ipclub_ip port $tinc keep state
pass in on $ext_if_trifle reply-to($ext_if_trifle $trifle_gw) proto tcp from <filial_real_ip> to $trifle_ip port $tinc keep state
# pass services traf from ext
pass in on $ext_if_ipclub reply-to($ext_if_ipclub $ipclub_gw) proto tcp from any to $ipclub_ip port $services keep state
pass in on $ext_if_trifle reply-to($ext_if_trifle $trifle_gw) proto tcp from any to { $trifle_ip, $trifle_net } port $services keep state
# pass gre proto for pptp
pass in reply-to($ext_if_ipclub $ipclub_gw) proto gre from any to $ext_if_ipclub keep state
pass in reply-to($ext_if_trifle $trifle_gw) proto gre from any to $ext_if_trifle keep state"sk0" - первый канал, дефолт на него
"em0" - второй канал
Задача такова:
снаружи по обеми каналам должен отвечать ssh и разрешенные сервисы - в принципе реализовано
из локалки часть ip натятся на один канал. часть на второй - реализовано, но опять-же есть вопросы, о них позже...
далее из локалки и vpn интерфейсов все должно быть доступно...
Вобщем имеем на данный момент такие вопросы:
- Когда филиальный vpn висит на первом канале канале (используется tinc, переключение каналов реализуется путем указания демону ticncd какой ip слушать, филиалы ломятся по обеим ip и где отвечает, туда и цепляется) все нормально, соединение происходит, обмен по vpn через iface tinc (tun0) идет без проблем... Когда переключаю tinc на второй канал, то филиалы успешно коннектятся, но обмена через tun0 нет... пакет уходит от меня, приходит на филиал, с филиала улетает мне ответ, но тут я его уже не вижу... в чем затык не пойму... если правило
Код: Выделить всё
# FILTERING
# policy blocking all
block allКод: Выделить всё
pass allКод: Выделить всё
# tinc filial vpn iface
pass in quick log on tun0 all
pass out quick log on tun0 all- далее ng0-9 интерфейсы vpn на mpd для подключения некоторых сотрудников к сети...
вроде живет, но был какой-то затык... если выплывет, обновлю...
- вопрос по нату на второй канал...
Код: Выделить всё
#NAT to trifle собственно сам нат
nat on $ext_if_trifle from <nat_to_trifle> to any -> $trifle_ip
и заворачивание трафа...
pass out route-to($ext_if_trifle $trifle_gw) from <nat_to_trifle> to !<eds-local>
pass out route-to($ext_if_trifle $trifle_gw) from $trifle_ip
- далее
правила блокировки приватных сетей на внешних интерфейсах
Код: Выделить всё
# block private networks on ext ifaces
#block quick on $ext_if_ipclub from any to <private_net>
#block quick on $ext_if_ipclub from <private_net> to any
#block quick on $ext_if_trifle from any to <private_net>
#block quick on $ext_if_trifle from <private_net> to any
ну и идеи как это все оптимизировать или еще как улучшить и защитить приветствуются
