вопрос первый - возможна ли работа такой связки, если сквид не транспарентен?
у меня в одном месте сквид транспарентен - в итоге там трафд считает правильно, netams вообще не считает(ну мне на форуме нетамса так и написали, что считать не будет)
в другом - все клиенты ходят напрямую через сквид, но при этом ни трафд ни нетамс не показывают нормальную статистику(цифры маленькие по сравнению с логами sarg)
вопрос второй, по фаеру
Код: Выделить всё
freebsd# ipfw list
00100 allow ip from any to any via em1
00400 allow ip from any to any via lo0
00450 deny tcp from any to me dst-port 3128 in recv em0
00500 divert 8668 ip from any to any in via em0
00501 divert 199 ip from any to any in via em0
00600 check-state
00700 skipto 3500 tcp from any to 81.1.214.134 dst-port 53 out via em0 setup keep-state
00800 skipto 3500 tcp from any to 80.89.128.5 dst-port 53 out via em0 setup keep-state
00900 skipto 3500 tcp from any to any dst-port 80 out via em0 setup keep-state
01000 skipto 3500 tcp from any to any dst-port 443 out via em0 setup keep-state
01100 skipto 3500 tcp from any to any dst-port 9443 out via em0 setup keep-state
01110 skipto 3500 tcp from any to any dst-port 9080 out via em0 setup keep-state
01200 skipto 3500 tcp from any to any dst-port 25 out via em0 setup keep-state
01300 skipto 3500 tcp from any to any dst-port 110 out via em0 setup keep-state
01310 skipto 3500 tcp from any to any dst-port 587 out via em0 setup keep-state
01320 skipto 3500 tcp from any to any dst-port 995 out via em0 setup keep-state
01400 skipto 3500 tcp from any to any dst-port 5190 out via em0 setup keep-state
01500 skipto 3500 tcp from me to any out via em0 setup uid root keep-state
01600 skipto 3500 icmp from any to any out via em0 keep-state
01700 skipto 3500 tcp from any to any dst-port 37 out via em0 setup keep-state
01800 skipto 3500 tcp from any to any dst-port 22 out via em0 setup keep-state
01900 skipto 3500 tcp from any to any dst-port 43 out via em0 setup keep-state
02000 skipto 3500 udp from any to any dst-port 123 out via em0 keep-state
02003 deny ip from 127.0.0.0/8 to any in via em0
02004 deny ip from 0.0.0.0/8 to any in via em0
02005 deny ip from 169.254.0.0/16 to any in via em0
02006 deny ip from 192.0.2.0/24 to any in via em0
02007 deny ip from 204.152.64.0/23 to any in via em0
02008 deny ip from 224.0.0.0/3 to any in via em0
02100 deny ip from 192.168.0.0/16 to any in via em0
02100 deny ip from any to any frag in via em0
02101 deny ip from 172.16.0.0/12 to any in via em0
02102 deny ip from 10.0.0.0/8 to any in via em0
02300 deny tcp from any to any established in via em0
02400 allow tcp from any to me dst-port 80 in via em0 setup limit src-addr 2
02600 allow tcp from any to me dst-port 22 in via em0 setup limit src-addr 2
02700 allow udp from any to me dst-port 53
02800 allow udp from me to any dst-port 53
02900 deny log logamount 10 ip from any to any in via em0
03000 deny log logamount 10 ip from any to any out via em0
03500 divert 199 ip from any to any out via em0
03501 divert 8668 ip from any to any out via em0
03600 allow ip from any to any
10000 deny log logamount 10 ip from any to any
65535 allow ip from any to any
ssh даже с роутера наружу не выходит
