uname -a
Код: Выделить всё
FreeBSD router.localhost.com 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Thu Mar 31 15:19:05 UTC 2011
root@localhost.com:/usr/obj/usr/src/sys/KASE666 i386
kernel KASE666
Код: Выделить всё
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=1000
options IPFIREWALL_FORWARD
options IPDIVERT
options DUMMYNET
/etc/rc.conf
Код: Выделить всё
defaultrouter="100.29.65.1"
hostname="router.localhost.com"
ifconfig_alc0="inet 100.29.65.65 netmask 255.255.255.0"
ifconfig_vr0="inet 192.168.3.111 netmask 255.255.255.0"
cloned_interfaces="tap0 bridge0"
ifconfig_bridge0="addm alc0 addm tap0 up"
gateway_enable="YES"
named_enable="YES"
sshd_enable="YES"
natd_enable="YES"
natd_interface="alc0"
natd_flags="-m -u -s -dynamic -punch_fw 500:499"
dummynet_enable="YES"
static_routes="net1 net2 net3 net4 net5 net6 net7"
route_net1="-net 192.168.27.0/24 192.168.3.27"
route_net2="-net 192.168.21.0/24 192.168.3.21"
route_net3="-net 192.168.22.0/24 192.168.3.22"
route_net4="-net 192.168.23.0/24 192.168.3.23"
route_net5="-net 192.168.24.0/24 192.168.3.24"
route_net6="-net 192.168.25.0/24 192.168.3.25"
route_net7="-net 192.168.26.0/24 192.168.3.26"
firewall_enable="YES"
firewall_script="/etc/kase.fw"
скрипт правил IPFW /etc/kase.fw
Код: Выделить всё
#!/bin/sh
fw="/sbin/ipfw -q"
br="bridge0"
tp="tap0"
intif="vr0"
extif="alc0"
intip="192.168.3.111"
extip="100.29.65.65"
intnet="192.168.3.0/24"
ki="100.29.65.2"
drweb="100.29.65.66"
mail1="10.10.10.10"
proxy_ast="10.10.16.16"
proxy_kust="10.10.16.18"
${fw} -f flush
#HOSTS ALLOW
${fw} table 1 add 100.29.65.66
${fw} table 1 add 100.29.65.67
${fw} table 1 add 10.10.10.11
${fw} table 1 add 10.10.10.15
${fw} table 1 add 10.10.10.25
${fw} table 1 add 10.10.30.0/24
#RULES FIREWALL
${fw} add check-state
${fw} add allow ip from any to any via lo0
${fw} add divert natd all from any to any
${fw} add allow tcp from any to me 22 out via ${extif}
${fw} add allow tcp from me to "table(1)" in via ${extif}
${fw} add allow tcp from any to $ki 8999-9999 out via ${extif}
${fw} add allow tcp from $ki to any in via ${extif}
${fw} add allow tcp from any to $mail1 25,110 out via ${extif}
${fw} add allow tcp from $mail1 to any in via ${extif}
${fw} add allow tcp from any to "table(1)" out via ${extif}
${fw} add allow tcp from "table(1)" to any in via ${extif}
${fw} add allow tcp from any to "table(1)" out via ${br}
${fw} add allow tcp from table\(1\) to any in via ${br}
${fw} add allow tcp from any to table\(1\) out via ${tp}
${fw} add allow tcp from table\(1\) to any in via ${tp}
${fw} add allow all from any to $drweb out via ${extif}
${fw} add allow all from $drweb to any in via ${extif}
#DNS SERVERS ALLOW
${fw} add allow udp from any to me 53 out via ${intif}
${fw} add allow udp from me to any out via ${intif}
${fw} add allow udp from any to me 53 in via ${extif}
#ICMP & LOCAL
${fw} add allow tcp from any to any via ${intif}
${fw} add allow ip from 100.29.65.65 to any out xmit ${extif}
${fw} add allow udp from any to any via ${intif}
${fw} add allow icmp from any to any icmptypes 0,3,8,11 via ${intif}
${fw} add allow icmp from any to any icmptypes 0,3,8,11 via ${extif}
${fw} add allow icmp from any to any icmptypes 0,3,8,11 out via ${br}
${fw} add allow icmp from any to any icmptypes 0,3,8,11 out via ${tp}
${fw} add allow icmp from any to any icmptypes 0,3,8,11 in via ${br}
${fw} add allow icmp from any to any icmptypes 0,3,8,11 in via ${tp}
#DENY CONNECTIONS
#${fw} add deny icmp from any to any in via ${intif}
${fw} add deny all from 172.16.0.0/12 to any in via ${intif}
${fw} add deny all from 169.254.0.0/16 to any in via ${intif}
${fw} add deny all from 192.0.2.0/24 to any in via ${intif}
${fw} add deny all from 204.152.64.0/23 to any in via ${intif}
${fw} add deny all from 224.0.0.0/3 to any in via ${intif}
${fw} add deny tcp from any to any 113 in via ${intif}
${fw} add deny tcp from any to any 137 in via ${intif}
${fw} add deny tcp from any to any 138 in via ${intif}
${fw} add deny tcp from any to any 139 in via ${intif}
${fw} add deny tcp from any to any 81 in via ${intif}
${fw} add deny tcp from any to any 113 in via ${extif}
${fw} add deny tcp from any to any 137 in via ${extif}
#${fw} add deny tcp from any to me 137 in via ${extif}
${fw} add deny tcp from any to any 138 in via ${extif}
${fw} add deny tcp from any to any 139 in via ${extif}
${fw} add deny tcp from any to any 81 in via ${extif}
${fw} add deny tcp from any 137 to any in via ${extif}
${fw} add deny tcp from any 138 to any in via ${extif}
${fw} add deny tcp from any 139 to any in via ${extif}
${fw} add deny tcp from me 137 to any in via ${extif}
${fw} add deny all from any to any frag in via ${intif}
${fw} add deny log logamount 5000 icmp from any to any frag
${fw} add deny log logamount 5000 all from any to any
${fw} add deny log logamount 5000 all from any to any out via ${intif}
${fw} add deny log logamount 5000 all from any to any in via ${extif}
выполняем скрипт в shell
/etc/kase.fw
все правила загружены и нормально отрабатывают
после перезагрузки:
ipfw list
Код: Выделить всё
000100 check-state
000200 allow ip from any to any via lo0
000300 divert 8668 ip from any to any
000400 allow tcp from any to me dst-port 22 out via alc0
001000 allow tcp from table(1) to any in via alc0
001100 allow tcp from any to table(1) out via bridge0
001200 allow tcp from table(1) to any in via bridge0
001300 allow tcp from any to table(1) out via tap0
001400 allow tcp from table(1) to any in via tap0
..........
и т.д. правила между 400 - 1000 пропадают
делаю так:
нумеруем
Код: Выделить всё
${fw} add 10 check-state
${fw} add 20 allow ip from any to any via lo0
${fw} add 30 divert natd all from any to any
${fw} add 40 allow tcp from any to me 22 out via ${extif}
${fw} add 50 allow tcp from me to "table(1)" in via ${extif}
${fw} add 60 allow tcp from any to $ki 8999-9999 out via ${extif}
${fw} add 70 allow tcp from $ki to any in via ${extif}
${fw} add 80 allow tcp from any to $mail1 25,110 out via ${extif}
${fw} add 90 allow tcp from $mail1 to any in via ${extif}
${fw} add 100 allow tcp from any to "table(1)" out via ${extif}
.................
остальные оставляем без изменений!
перегружаюсь
ipfw list
Код: Выделить всё
00010 check-state
00020 allow ip from any to any via lo0
00030 divert 8668 ip from any to any
00040 allow tcp from any to me dst-port 22 out via alc0
00050 allow tcp from me to table(1) in via alc0
00060 allow tcp from any to 100.29.65.2 dst-port 8999-9999 out via alc0
00070 allow tcp from 100.29.65.2 to any in via alc0
00080 allow tcp from any to 10.10.10.10 dst-port 25,110 out via alc0
00090 allow tcp from 10.10.10.10 to any in via alc0
00100 allow tcp from any to table(1) out via alc0
00200 allow tcp from table(1) to any in via alc0
00300 allow tcp from any to table(1) out via bridge0
00400 allow tcp from table(1) to any in via bridge0
01000 allow .......
тут пропадают следующие правила (уже другие, т.е. дело не в ошибках правил
)
еще один тест
нумеруем по порядку
100
200
300
400
500
600
и т.д.
после перезагрузки от 400 до 1000 опять провал
еще вариант
нумерую от 10 до 300 потом от 1000
после ребута все правила на месте
пока так и работает...
просто интересно в чем проблема?
магический диапазон 400-1000?
