помогите настроить NAT

[Алекс]

Уже вторые сутки ковыряюсь с Фрёй...
понемногу продвигается дело.
установить 6.3
имеем 3 сетевухи
одна внешняя xl0
и 2 внутренних xl1(192.168.0.6) и xl2(192.168.1.1)

необходимо сделать так, чтобы в инет ходили с обоих подсетей.
на деле так.
установил ipfw, пересобрал ядро.
с сервака пингуются все сегменты..и инет, и 192.168.1.X и 192.168.0.X
сервак так же пингуется из сети.
а вот в инет не пускает не из одной подсети

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[Fastman]

Код: Выделить всё

natd_enable="YES"
natd_interface="xl0"

Код: Выделить всё

${fwcmd} add divert natd all from any to any via xl0

[Алекс]

одна из подсетей порезана на вланы....чтобы не пересекались группы между собой.
одна подсеть полностью цельная.

в догонку конфиги

rc.conf

Код: Выделить всё

# -- sysinstall generated deltas -- # Wed Mar 29 16:46:14 2006
# Created: Wed Mar 29 16:46:14 2006
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
defaultrouter="роутерПрова"
hostname="Покажу если надо"
ifconfig_xl0="inet ВнешнийIP  netmask 255.255.255.248"
ifconfig_xl1="inet 192.168.0.6  netmask 255.255.255.0"
ifconfig_xl2="inet 192.168.1.1  netmask 255.255.255.240"
ifconfig_xl2_alias0="inet 192.168.1.17  netmask 255.255.255.240"
ifconfig_xl2_alias1="inet 192.168.1.33  netmask 255.255.255.240"
ifconfig_xl2_alias2="inet 192.168.1.49  netmask 255.255.255.240"
ifconfig_xl2_alias3="inet 192.168.1.65  netmask 255.255.255.240"
ifconfig_xl2_alias4="inet 192.168.1.81  netmask 255.255.255.240"
ifconfig_xl2_alias5="inet 192.168.1.97  netmask 255.255.255.240"
ifconfig_xl2_alias6="inet 192.168.1.113  netmask 255.255.255.240"
ifconfig_xl2_alias7="inet 192.168.1.129  netmask 255.255.255.224"
ifconfig_xl2_alias8="inet 192.168.1.161  netmask 255.255.255.240"
ifconfig_xl2_alias9="inet 192.168.1.177  netmask 255.255.255.248"
ifconfig_xl2_alias10="inet 192.168.1.185  netmask 255.255.255.248"
ifconfig_xl2_alias11="inet 192.168.1.193  netmask 255.255.255.192"
postfix_enable="YES"
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
gateway_enable="YES"
firewall_enable="YES"
firewall_script="/etc/rc.firewall.relay"
natd_enable="YES"
natd_interface="xl0"
natd_flags="-s -m -f /etc/natd.conf"
named_enable="YES"
sshd_enable="YES"
apache_enable="YES"
httpd_flags="-DSSL"
mysql_enable="YES"
courier_imap_pop3d_enable="YES"
courier_authdaemond_enable="YES"

rc.firewall.relay

Код: Выделить всё

#!/bin/sh -
#
ipfw -q -f flush
fwcmd="/sbin/ipfw -q add"
#

############################################################################
#                                  DENY                                    #                                                        
############################################################################                                                        

${fwcmd} 010 pass all from any to any via lo0

${fwcmd} 200 divert natd all from any to ВнешнийIP in via xl0

# Deny all inbound traffic from non-routable reserved address spaces
${fwcmd} 300 deny all from 192.168.0.0/16  to any in via xl0  #RFC 1918 private IP
${fwcmd} 301 deny all from 172.16.0.0/12   to any in via xl0  #RFC 1918 private IP
${fwcmd} 302 deny all from 10.0.0.0/8      to any in via xl0  #RFC 1918 private IP
${fwcmd} 303 deny all from 127.0.0.0/8     to any in via xl0  #loopback
${fwcmd} 304 deny all from 0.0.0.0/8       to any in via xl0  #loopback
${fwcmd} 305 deny all from 169.254.0.0/16  to any in via xl0  #DHCP auto-config
${fwcmd} 306 deny all from 192.0.2.0/24    to any in via xl0  #reserved for docs
${fwcmd} 307 deny all from 204.152.64.0/23 to any in via xl0  #Sun cluster
${fwcmd} 308 deny all from 224.0.0.0/3     to any in via xl0  #Class D & E multicast

# Deny ident
${fwcmd} 315 deny tcp from any to any 113 in via xl0

# Deny all Netbios service. 137=name, 138=datagram, 139=session
# Netbios is MS/Windows sharing services.
# Block MS/Windows hosts2 name server requests 81
${fwcmd} 320 deny tcp from any to any 137 in via xl0
${fwcmd} 321 deny tcp from any to any 138 in via xl0
${fwcmd} 322 deny tcp from any to any 139 in via xl0
${fwcmd} 323 deny tcp from any to any 81  in via xl0

# Deny any late arriving packets
${fwcmd} 330 deny all from any to any frag in via xl0

${fwcmd} 501 allow tcp from any to me 22 via xl0

${fwcmd} 502 allow tcp from 192.168.0.10 to any via xl1
${fwcmd} 503 reset tcp from any to me 22 via xl1

# COUNT access LAN Local users from Internet and Count users traffic

${fwcmd} 1000 count ip from any to 192.168.0.10 in via xl0
${fwcmd} 1001 count ip from 192.168.0.10 to any out via xl0

${fwcmd} 1003 count ip from any to 192.168.0.2 in via xl0
${fwcmd} 1004 count ip from 192.168.0.2 to any out via xl0

##------------ Company1
${fwcmd} 1020 count ip from any to 192.168.1.0/28 in via xl0
${fwcmd} 1040 count ip from 192.168.1.0/28 to any out via xl0

##------------Company2
${fwcmd} 1060 count ip from any to 192.168.1.16/28 in via xl0
${fwcmd} 1080 count ip from 192.168.1.16/28 to any out via xl0

##------------Company3
${fwcmd} 1100 count ip from any to 192.168.1.32/28 in via xl0
${fwcmd} 1120 count ip from 192.168.1.32/28 to any out via xl0

##------------Company3
${fwcmd} 1140 count ip from any to 192.168.1.48/28 in via xl0
${fwcmd} 1160 count ip from 192.168.1.48/28 to any out via xl0

##------------
${fwcmd} 1180 count ip from any to 192.168.1.64/28 in via xl0
${fwcmd} 1200 count ip from 192.168.1.64/28 to any out via xl0

##------------Company4
${fwcmd} 1220 count ip from any to 192.168.1.80/28 in via xl0
${fwcmd} 1240 count ip from 192.168.1.80/28 to any out via xl0

##------------Company5
${fwcmd} 1260 count ip from any to 192.168.1.96/28 in via xl0
${fwcmd} 1280 count ip from 192.168.1.96/28 to any out via xl0

##------------Company6
${fwcmd} 1300 count ip from any to 192.168.1.112/28 in via xl0
${fwcmd} 1320 count ip from 192.168.1.112/28 to any out via xl0

##------------Company7
${fwcmd} 1360 count ip from any to 192.168.1.128/27 in via xl0

##------------192.168.1.130
${fwcmd} 1362 count ip from any to 192.168.1.130 in via xl0

##------------192.168.1.131
${fwcmd} 1363 count ip from any to 192.168.1.131 in via xl0

##------------192.168.1.132
${fwcmd} 1364 count ip from any to 192.168.1.132 in via xl0

##------------192.168.1.133
${fwcmd} 1365 count ip from any to 192.168.1.133 in via xl0

##------------192.168.1.134
${fwcmd} 1366 count ip from any to 192.168.1.134 in via xl0

##------------192.168.1.135
${fwcmd} 1367 count ip from any to 192.168.1.135 in via xl0

##------------192.168.1.136
${fwcmd} 1368 count ip from any to 192.168.1.136 in via xl0

##------------192.168.1.137
${fwcmd} 1369 count ip from any to 192.168.1.137 in via xl0

##------------192.168.1.138
${fwcmd} 1370 count ip from any to 192.168.1.138 in via xl0

##------------192.168.1.139
${fwcmd} 1371 count ip from any to 192.168.1.139 in via xl0

##------------192.168.1.140
${fwcmd} 1372 count ip from any to 192.168.1.140 in via xl0

##------------192.168.1.141
${fwcmd} 1373 count ip from any to 192.168.1.141 in via xl0

##------------192.168.1.142
${fwcmd} 1374 count ip from any to 192.168.1.142 in via xl0

##------------192.168.1.143
${fwcmd} 1375 count ip from any to 192.168.1.143 in via xl0

##------------192.168.1.144
${fwcmd} 1376 count ip from any to 192.168.1.144 in via xl0

##------------192.168.1.145
${fwcmd} 1377 count ip from any to 192.168.1.145 in via xl0

##------------192.168.1.146
${fwcmd} 1378 count ip from any to 192.168.1.146 in via xl0

##------------192.168.1.147
${fwcmd} 1379 count ip from any to 192.168.1.147 in via xl0

##------------192.168.1.148
${fwcmd} 1380 count ip from any to 192.168.1.148 in via xl0

##------------192.168.1.149
${fwcmd} 1381 count ip from any to 192.168.1.149 in via xl0

##------------192.168.1.150
${fwcmd} 1382 count ip from any to 192.168.1.150 in via xl0

##------------192.168.1.151
${fwcmd} 1383 count ip from any to 192.168.1.151 in via xl0

##------------192.168.1.152
${fwcmd} 1384 count ip from any to 192.168.1.152 in via xl0

##------------192.168.1.153
${fwcmd} 1385 count ip from any to 192.168.1.153 in via xl0

##------------192.168.1.154
${fwcmd} 1386 count ip from any to 192.168.1.154 in via xl0

##------------192.168.1.155
${fwcmd} 1387 count ip from any to 192.168.1.155 in via xl0

##------------192.168.1.156
${fwcmd} 1388 count ip from any to 192.168.1.156 in via xl0

##------------192.168.1.157
${fwcmd} 1389 count ip from any to 192.168.1.157 in via xl0

##------------192.168.1.158
${fwcmd} 1390 count ip from any to 192.168.1.158 in via xl0

${fwcmd} 1400 count ip from 192.168.1.128/27 to any out via xl0
##===============================================================================

##------------Company11
${fwcmd} 1420 count ip from any to 192.168.1.160/28 in via xl0
${fwcmd} 1440 count ip from 192.168.1.160/28 to any out via xl0

##------------Company12
${fwcmd} 1460 count ip from any to 192.168.1.176/29 in via xl0
${fwcmd} 1480 count ip from 192.168.1.176/29 to any out via xl0

##------------Company13
${fwcmd} 1500 count ip from any to 192.168.1.184/29 in via xl0
${fwcmd} 1520 count ip from 192.168.1.184/29 to any out via xl0

##======================= Company33 =================================================
${fwcmd} 1600 count ip from any to 192.168.1.192/26 in via xl0

${fwcmd} 1601 count ip from any to 192.168.1.194 in via xl0
${fwcmd} 1602 count ip from any to 192.168.1.195 in via xl0
${fwcmd} 1603 count ip from any to 192.168.1.196 in via xl0
${fwcmd} 1604 count ip from any to 192.168.1.197 in via xl0
${fwcmd} 1605 count ip from any to 192.168.1.198 in via xl0
${fwcmd} 1606 count ip from any to 192.168.1.199 in via xl0
${fwcmd} 1607 count ip from any to 192.168.1.200 in via xl0
${fwcmd} 1608 count ip from any to 192.168.1.201 in via xl0
${fwcmd} 1609 count ip from any to 192.168.1.202 in via xl0
${fwcmd} 1610 count ip from any to 192.168.1.203 in via xl0
${fwcmd} 1611 count ip from any to 192.168.1.204 in via xl0
${fwcmd} 1612 count ip from any to 192.168.1.205 in via xl0
${fwcmd} 1613 count ip from any to 192.168.1.206 in via xl0
${fwcmd} 1614 count ip from any to 192.168.1.207 in via xl0
${fwcmd} 1615 count ip from any to 192.168.1.208 in via xl0
${fwcmd} 1616 count ip from any to 192.168.1.209 in via xl0
${fwcmd} 1617 count ip from any to 192.168.1.210 in via xl0
${fwcmd} 1618 count ip from any to 192.168.1.211 in via xl0
${fwcmd} 1619 count ip from any to 192.168.1.212 in via xl0
${fwcmd} 1620 count ip from any to 192.168.1.213 in via xl0
${fwcmd} 1621 count ip from any to 192.168.1.214 in via xl0
${fwcmd} 1622 count ip from any to 192.168.1.215 in via xl0
${fwcmd} 1623 count ip from any to 192.168.1.216 in via xl0
${fwcmd} 1624 count ip from any to 192.168.1.217 in via xl0
${fwcmd} 1625 count ip from any to 192.168.1.218 in via xl0
${fwcmd} 1626 count ip from any to 192.168.1.219 in via xl0
${fwcmd} 1627 count ip from any to 192.168.1.220 in via xl0
${fwcmd} 1628 count ip from any to 192.168.1.221 in via xl0
${fwcmd} 1629 count ip from any to 192.168.1.222 in via xl0
${fwcmd} 1630 count ip from any to 192.168.1.223 in via xl0
${fwcmd} 1631 count ip from any to 192.168.1.224 in via xl0
${fwcmd} 1632 count ip from any to 192.168.1.225 in via xl0
${fwcmd} 1633 count ip from any to 192.168.1.226 in via xl0
${fwcmd} 1634 count ip from any to 192.168.1.227 in via xl0
${fwcmd} 1635 count ip from any to 192.168.1.228 in via xl0
${fwcmd} 1636 count ip from any to 192.168.1.229 in via xl0
${fwcmd} 1637 count ip from any to 192.168.1.230 in via xl0
${fwcmd} 1638 count ip from any to 192.168.1.231 in via xl0
${fwcmd} 1639 count ip from any to 192.168.1.232 in via xl0
${fwcmd} 1640 count ip from any to 192.168.1.233 in via xl0
${fwcmd} 1641 count ip from any to 192.168.1.234 in via xl0
${fwcmd} 1642 count ip from any to 192.168.1.235 in via xl0
${fwcmd} 1643 count ip from any to 192.168.1.236 in via xl0
${fwcmd} 1644 count ip from any to 192.168.1.237 in via xl0
${fwcmd} 1645 count ip from any to 192.168.1.238 in via xl0
${fwcmd} 1646 count ip from any to 192.168.1.239 in via xl0
${fwcmd} 1647 count ip from any to 192.168.1.240 in via xl0
${fwcmd} 1648 count ip from any to 192.168.1.241 in via xl0
${fwcmd} 1649 count ip from any to 192.168.1.242 in via xl0
${fwcmd} 1650 count ip from any to 192.168.1.243 in via xl0
${fwcmd} 1651 count ip from any to 192.168.1.244 in via xl0
${fwcmd} 1652 count ip from any to 192.168.1.245 in via xl0
${fwcmd} 1653 count ip from any to 192.168.1.246 in via xl0
${fwcmd} 1654 count ip from any to 192.168.1.247 in via xl0
${fwcmd} 1655 count ip from any to 192.168.1.248 in via xl0
${fwcmd} 1656 count ip from any to 192.168.1.249 in via xl0
${fwcmd} 1657 count ip from any to 192.168.1.250 in via xl0
${fwcmd} 1658 count ip from any to 192.168.1.251 in via xl0
${fwcmd} 1659 count ip from any to 192.168.1.252 in via xl0
${fwcmd} 1660 count ip from any to 192.168.1.253 in via xl0
${fwcmd} 1661 count ip from any to 192.168.1.254 in via xl0

${fwcmd} 1700 count ip from 192.168.1.192/26 to any out via xl0

##=================================================================================

${fwcmd} 2000 divert natd ip from 192.168.1.192/26,192.168.0.10,192.168.0.40,192.168.1.5,192.168.1.0/28,192.168.1.16/28,192.168.1.32/28,
192.168.1.48/28,192.168.1.80/28,192.168.1.112/28,192.168.1.128/27,192.168.1.160/28,192.168.1.176/29,
192.168.1.184/29 to any out via xl0

${fwcmd} 2500 pass all from any to 192.168.1.192/26,192.168.0.10,192.168.0.40,192.168.1.5,192.168.1.0/28,192.168.1.16/28,192.168.1.32/28,
192.168.1.48/28,192.168.1.80/28,192.168.1.112/28,192.168.1.128/27,192.168.1.160/28,192.168.1.176/29,
192.168.1.184/29 in via xl0

${fwcmd} 2501 allow all from any to any via xl1

${fwcmd} 2502 allow all from any to any via xl2

${fwcmd} 3500 allow all from any to any via xl0

[terminus]

Код: Выделить всё

${fwcmd} 2500 pass all from any to 192.168.1.192/26,192.168.0.10,192.168.0.40,192.168.1.5,192.168.1.0/28,192.168.1.16/28,192.168.1.32/28,192.168.1.48/28,192.168.1.80/28,192.168.1.112/28,192.168.1.128/27,192.168.1.160/28,192.168.1.176/29,192.168.1.184/29 in via xl0

--->

Код: Выделить всё

${fwcmd} 2500 pass all from any to me in via xl0

Читать 2 раза
http://nuclight.livejournal.com/124348.html

[Алекс]

Код: Выделить всё

natd_enable="YES"
natd_interface="xl0"

всё убрал лишнее...всё равно не пропускает

Код: Выделить всё

${fwcmd} add divert natd all from any to any via xl0

Код: Выделить всё

#!/bin/sh -
#
ipfw -q -f flush
fwcmd="/sbin/ipfw -q add"
#

############################################################################
#                                  DENY                                    #                                                        
############################################################################                                                        

${fwcmd} 010 pass all from any to any via lo0

${fwcmd} 200 add divert natd all from any to any via xl0

[Алекс]

Код: Выделить всё

${fwcmd} 2500 pass all from any to 192.168.1.192/26,192.168.0.10,192.168.0.40,192.168.1.5,192.168.1.0/28,192.168.1.16/28,192.168.1.32/28,192.168.1.48/28,192.168.1.80/28,192.168.1.112/28,192.168.1.128/27,192.168.1.160/28,192.168.1.176/29,192.168.1.184/29 in via xl0

--->

Код: Выделить всё

${fwcmd} 2500 pass all from any to me in via xl0

Читать 2 раза
http://nuclight.livejournal.com/124348.html

а можно на пальцах
я прввда за двое суток начитался всего ..у чайник перестаёт варить..

[Алекс]

кстати, на 6.0 до меня, пока сервак не умер это работало...
конфиг у меня тот же.

Код: Выделить всё

${fwcmd} 2500 pass all from any to 192.168.1.192/26,192.168.0.10,192.168.0.40,192.168.1.5,192.168.1.0/28,192.168.1.16/28,192.168.1.32/28,
192.168.1.48/28,192.168.1.80/28,192.168.1.112/28,192.168.1.128/27,192.168.1.160/28,192.168.1.176/29,
192.168.1.184/29 in via xl0

как быть

[paradox]

порежте свои трехетажные маты
и сделайте по человечески

[Алекс]

порежте свои трехетажные маты
и сделайте по человечески

порезал..
жду помощи

[paradox]

имелось ввиду
порежте диверты
и сделайте один
плюс удалите на время все count
они вам щас без надобности

и вам проще будет разобраться

[Алекс]

к тем конфигам что прикладывал,
закоментировал

Код: Выделить всё

#natd_flags="-s -m -f /etc/natd.conf"

стало лучше..
с сервака во все 3 подсети (инет и 2 лана) пингуется...
инет же идёт только с одной подсети...
со второй подсети инет не пашет и сервак не пингуется..
правильно ли я понимаю, что косяк именно в правилах фаервола?

[paradox]

хватит заниматься "угадайкой"
сделайте по нормальному
в институте учились?
азам проектированию учили?
возьмите карандаш
бумагу
и разрисуйте свою топологию
что куда
как
и зачем идет
где проходит и что происходит
и набросайте по вашим мыслям фаервол


а вы заниметесь комбинаторикой