Код: Выделить всё
firewall# cat /etc/firewall.conf
fwcmd="ipfw"
######
lanout="fxp0"
lanin="rl0"
NatIP="222.222.222.222"
ipout="22.222.222.222"
ipin="192.168.10.254"
netmask="24"
netin1="192.168.10.0"
netin2="192.168.20.0"
${fwcmd} -f flush
${fwcmd} -f pipe flush
${fwcmd} -f queue flush
${fwcmd} -f table 1 flush
${fwcmd} -f table 2 flush
${fwcmd} -f table 3 flush
${fwcmd} -f table 4 flush
#########
${fwcmd} table 6 add 192.168.20.29
#######
${fwcmd} table 3 add 192.168.10.52
${fwcmd} table 3 add 192.168.10.21
${fwcmd} table 3 add 192.168.10.22
${fwcmd} table 3 add 192.168.10.26
${fwcmd} table 3 add 192.168.10.30
${fwcmd} table 3 add 192.168.10.23
${fwcmd} table 3 add 192.168.10.45
${fwcmd} table 3 add 192.168.10.53
${fwcmd} table 3 add 192.168.10.56
${fwcmd} table 3 add 192.168.10.65
${fwcmd} table 3 add 192.168.10.48
${fwcmd} table 3 add 192.168.10.58
${fwcmd} table 3 add 192.168.10.60
${fwcmd} table 4 add 192.168.10.29
${fwcmd} table 4 add 192.168.10.35
${fwcmd} table 4 add 192.168.10.25
${fwcmd} table 4 add 192.168.10.98
${fwcmd} table 4 add 192.168.10.31
${fwcmd} table 5 add 192.168.10.222
${fwcmd} add pipe 1 ip from any to table\(1\) out via ${lanin}
${fwcmd} pipe 1 config bw 2Mbit/s
${fwcmd} add pipe 2 ip from any to table\(2\) out via ${lanin}
${fwcmd} pipe 2 config bw 1Mbit/s
${fwcmd} add pipe 3 ip from any to table\(3\) out via ${lanin}
${fwcmd} pipe 3 config bw 2Mbit/s
${fwcmd} add pipe 4 ip from any to table\(4\) out via ${lanin}
${fwcmd} pipe 4 config bw 1Mbit/s
${fwcmd} add allow ip from any to any via lo0
${fwcmd} add deny ip from 192.168.10.255 to any
${fwcmd} add deny ip from 91.207.8.242 to any
${fwcmd} add deny log ip from any to 91.207.8.242
${fwcmd} add deny ip from any to 192.168.10.255
${fwcmd} add deny ip from any to 127.0.0.0/8
${fwcmd} add deny ip from 127.0.0.0/8 to any
${fwcmd} add deny ip from any to 10.0.0.0/8 in via ${lanout}
${fwcmd} add deny ip from 192.168.10.1 to 8.255.2.254 in via ${lanout}
${fwcmd} add deny ip from 8.255.2.254 to 192.168.10.1 in via ${lanout}
${fwcmd} add deny ip from any to 172.16.0.0/12 in via ${lanout}
${fwcmd} add deny ip from any to 0.0.0.0/8 in via ${lanout}
${fwcmd} add deny ip from any to 169.254.0.0/16 in via ${lanout}
${fwcmd} add deny ip from any to 240.0.0.0/4 in via ${lanout}
${fwcmd} add deny icmp from any to any frag
${fwcmd} add deny icmp from any to 255.255.255.255 in via ${lanout}
${fwcmd} add deny icmp from any to 255.255.255.255 out via ${lanout}
### NA PROXY
${fwcmd} add fwd 127.0.0.1,3128 tcp from table\(1\) to not 192.168.10.254 80
${fwcmd} add fwd 127.0.0.1,3128 tcp from table\(2\) to not 192.168.10.254 80
${fwcmd} add fwd 127.0.0.1,3128 tcp from table\(3\) to not 192.168.10.254 80
${fwcmd} add fwd 127.0.0.1,3128 tcp from table\(4\) to not 192.168.10.254 80
${fwcmd} add fwd 127.0.0.1,3128 tcp from table\(6\) to not 192.168.10.254 80
### END NA PROXY
### NAT
${fwcmd} nat 123 config ip ${NatIP} log redirect_port tcp 192.168.10.5:25 25 \
redirect_port tcp 192.168.10.58:4661 4661 \
redirect_port udp 192.168.10.58:4661 4661 \
redirect_port tcp 192.168.10.5:2112 2112 \
redirect_port tcp 192.168.10.5:49152-65535 49152-65535 \
redirect_port tcp 192.168.10.1:3389 3390
${fwcmd} add 50 nat 123 ip4 from any to any via ${NatIP}
#${fwcmd} add 60 allow ip4 from any to any
### END NAT
${fwcmd} add allow tcp from table\(3\) to 89.111.176.249 110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from table\(1\) to 89.111.176.249 110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from ${netin1}/${netmask} to 212.114.13.1 110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from ${netin1}/${netmask} to any 443,5190,2041,2042 via ${lanin} keep-state
${fwcmd} add allow tcp from table\(5\) to 192.168.10.254 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.5 25,7060 to any
${fwcmd} add allow tcp from any to 192.168.10.5 25,7060
${fwcmd} add deny ip from 10.0.0.0/8 to any out via ${lanout}
${fwcmd} add deny ip from 172.16.0.0/12 to any out via ${lanout}
${fwcmd} add deny ip from 0.0.0.0/8 to any out via ${lanout}
${fwcmd} add deny ip from 169.254.0.0/16 to any out via ${lanout}
${fwcmd} add deny ip from 224.0.0.0/4 to any out via ${lanout}
${fwcmd} add deny ip from 240.0.0.0/4 to any out via ${lanout}
###################################################################
${fwcmd} add allow tcp from any to any established
${fwcmd} add allow ip from ${ipout} to any out xmit ${lanout}
${fwcmd} add allow udp from any 53 to any via ${lanout}
${fwcmd} add allow icmp from any to any icmptypes 0,8,11
${fwcmd} add allow tcp from 192.168.10.5 to any via ${lanin} keep-state
${fwcmd} add deny log tcp from any 25 to any
${fwcmd} add deny log tcp from any to any 25
##############################
#${fwcmd} add allow tcp from ${netin1}/${netmask} to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from table\(1\) to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.98 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.58 to any via ${lanin} keep-state
#${fwcmd} add allow tcp from 192.168.10.190 to any via ${lanin} keep-state
#######################################################################
${fwcmd} add allow udp from any to any via ${lanin}
${fwcmd} add deny log tcp from any to any
Код: Выделить всё
firewall# ifconfig -a
fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 00:a0:c9:77:28:3d
inet 222.222.222.222 netmask 0xfffffffc broadcast 222.222.222.223
media: Ethernet autoselect (10baseT/UTP <full-duplex>)
status: active
fxp1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=2008<VLAN_MTU,WOL_MAGIC>
ether 00:08:c7:59:5f:3e
inet 192.168.20.254 netmask 0xffffff00 broadcast 192.168.20.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 00:16:e6:4d:24:6b
inet 192.168.10.254 netmask 0xffffff00 broadcast 192.168.10.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> metric 0 mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
inet6 ::1 prefixlen 128
inet 127.0.0.1 netmask 0xff000000
