Настроил сейчас FreeBSD 9.1-RELEASE, стоит squid 3.2 + ядерный нат.
В логах сквида а именно в файле access.log пишет вот что:
1377979075.067 1 121.56.223.2 TCP_DENIED/403 3498 GET http://www.163.com/ - HIER_NONE/- text/html
1377987973.006 1 121.56.216.92 TCP_DENIED/403 3499 GET http://www.163.com/ - HIER_NONE/- text/html
1378011312.654 2 1.180.120.22 TCP_DENIED/403 3498 GET http://www.163.com/ - HIER_NONE/- text/html
все Ip принадлежат Китаю
Вопрос:
1) Тоесть эти люди сейчас сидят через мой скфид?
2) Можно ли как то на фрюхе отгородиться от некоторых стран, т.е. запретить доступ из какой то страны?
Мой ipfw
Код: Выделить всё
# ipfw show
00100 0 0 allow ip from any to any via lo0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny ip from 127.0.0.0/8 to any
00400 0 0 deny ip from any to 172.16.0.0/12 in via em0
00500 0 0 deny ip from any to 0.0.0.0/8 in via em0
00600 0 0 deny ip from any to 169.254.0.0/16 in via em0
00700 9 587 deny ip from any to 240.0.0.0/4 in via em0
00800 0 0 deny icmp from any to any frag
00900 0 0 deny log logamount 100 icmp from any to 255.255.255.255 in via em0
01000 0 0 deny log logamount 100 icmp from any to 255.255.255.255 out via em0
01100 38380 3505866 fwd 127.0.0.1,3128 tcp from 192.168.8.0/24 to any dst-port 80 via em0
01200 61 5149 fwd 127.0.0.1,3128 tcp from 192.168.8.0/24 to any dst-port 8080 via em0
01300 0 0 fwd 127.0.0.1,3128 tcp from 192.168.8.0/24 to any dst-port 8081 via em0
01400 178447 122463289 nat 1 ip from any to any via em0
01500 0 0 allow gre from any to any
01600 0 0 deny ip from 172.16.0.0/12 to any out via em0
01700 0 0 deny ip from 0.0.0.0/8 to any out via em0
01800 0 0 deny ip from 169.254.0.0/16 to any out via em0
01900 0 0 deny ip from 224.0.0.0/4 to any out via em0
02000 0 0 deny ip from 240.0.0.0/4 to any out via em0
02100 367472 324842810 allow tcp from any to any established
02200 0 0 allow ip from me to any out xmit em0
02300 0 0 allow udp from any 53 to any via em0
02400 0 0 allow udp from any to any dst-port 53 via em0
02500 0 0 allow icmp from any to any icmptypes 0,8,11
02600 0 0 allow udp from any 53 to any via rl0
02700 0 0 allow udp from any to any dst-port 53 via rl0
02800 2 104 allow tcp from any to any dst-port 2348
02900 0 0 allow tcp from any 2348 to any
03000 0 0 allow tcp from any to any dst-port 21
03100 0 0 allow tcp from any 21 to any
03200 3856 197964 allow tcp from any to any via em1
03300 2416 271611 allow udp from any to any via em1
03400 91 8819 allow icmp from any to any via em1
03500 56 1792 deny ip from any to any
65535 10 965 allow ip from any to any
