Возникла проблема при переезде с pf на ipfw.
Собственно не работает redirect_port.
Правила свел к минимуму, пробовал различные варианты из статей, man ipfw и т.п.
Т.е. в принципе работать должно, пакетов, подходящих под правило deny нет. Но видимо что-то не так, поэтому прошу помочь разобраться. Спасибо.
Конфигурация следующаю:
Код: Выделить всё
[root@ns1 /usr/local/etc/rc.d]# uname -srm
FreeBSD 9.1-STABLE amd64Код: Выделить всё
# sysctl -a | grep one.pass
net.inet.ip.fw.one_pass: 1Код: Выделить всё
[root@ns1 /usr/src/sys/amd64/conf]# awk '(NR>32 && NR<48) {print}' SERVER_IPFW
# IPFW Support
options IPFIREWALL
options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPFIREWALL_FORWARD
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100
options IPFIREWALL_NAT
options DUMMYNET
options LIBALIAS
options ROUTETABLES=2
options MROUTING
# POLLING
options DEVICE_POLLING
options HZ="1000"Код: Выделить всё
[root@ns1 ~]# grep ifconfig /etc/rc.conf
ifconfig_em0="DHCP -rxcsum -tso"
ifconfig_msk1="inet 192.168.248.1 netmask 255.255.255.240 promisc -rxcsum -tso"
ifconfig_msk0="inet 192.168.248.16 netmask 255.255.255.240 -rxcsum -tso"Код: Выделить всё
[root@ns1 ~]# cat /etc/ipfw.conf
#!/bin/sh
ovpn_if="tap0"
inet_if="ng0"
beeline_if="em0"
local_if="msk1"
wi_if="wlan0"
xbox_if="msk0"
fwcmd="/sbin/ipfw -f"
${fwcmd} -f flush
# Tables
${fwcmd} table 0 add 192.168.248.0/28 # local_if:network
${fwcmd} table 0 add 172.30.248.0/24 # wi_if:network
${fwcmd} table 0 add 192.168.2.0/30 # xbox_if:network
${fwcmd} table 1 add 192.168.0.0/18 # ovpn_if:network
# Loopback
${fwcmd} add pass all from any to any via lo0
${fwcmd} add deny all from any to 127.0.0.1/8
${fwcmd} add deny all from 127.0.0.1/8 to any
${fwcmd} add pass tcp from any to any established
# L2TP
${fwcmd} add pass { tcp or udp } from any 1701 to any 1701 via ${beeline_if} keep-state
# IPTV
${fwcmd} add pass igmp from any to any
${fwcmd} add pass udp from any to 224.0.0.0/4
${fwcmd} add pass udp from 224.0.0.0/4 to any
#NAT
${fwcmd} nat 1 config log if ${inet_if} same_ports reset deny_in redirect_port tcp 192.168.248.4:5900 5900
${fwcmd} add nat 1 all from any to not table\(1\) via ${inet_if}
${fwcmd} nat 2 config log if ${beeline_if} same_ports reset deny_in
${fwcmd} add nat 2 all from any to any via ${beeline_if}
${fwcmd} nat 3 config log if ${ovpn_if} same_ports reset deny_in redirect_port tcp 192.168.248.4:5900 5900
${fwcmd} add nat 3 all from any to any via ${ovpn_if}
# Local
${fwcmd} add pass all from any to any via ${wi_if}
${fwcmd} add pass all from any to any via ${xbox_if}
${fwcmd} add pass all from any to any via ${ovpn_if}
${fwcmd} add pass all from any to any via ${local_if}
# Drop
${fwcmd} add deny log logamount 100 all from any to anyКод: Выделить всё
[root@ns1 ~]# ipfw -a list
00100 216 13132 allow ip from any to any via lo0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny ip from 127.0.0.0/8 to any
00400 9657 1380653 allow tcp from any to any established
00500 10077 1791067 allow { tcp or udp } from any 1701 to any dst-port 1701 via em0 keep-state
00600 27 768 allow igmp from any to any
00700 58953 79000388 allow udp from any to 224.0.0.0/4
00800 0 0 allow udp from 224.0.0.0/4 to any
00900 483 39712 nat 1 ip from any to not table(1) via ng0
01000 55 5948 nat 2 ip from any to any via em0
01100 6681 494553 nat 3 ip from any to any via tap0
01200 4 946 allow ip from any to any via wlan0
01300 0 0 allow ip from any to any via msk0
01400 0 0 allow ip from any to any via tap0
01500 6790 1347922 allow ip from any to any via msk1
01600 0 0 deny log logamount 100 ip from any to any
65535 942 394652 allow ip from any to any