пытаюсь настроить рутер Freebsd8.1, имеется две сетевых(одна смотрит в локалку, другая в нет).подключение к инету настроено через PPPoE(модем скайлинк)
проблема в следующем:не могу зайти по ссш из соседней локальной сети, и разумеется отсутсвует подключение к инет.Подскажите, может не верно что в правилах?
конфиги:
"/etc/ppp/ppp.conf"
Код: Выделить всё
default:
set log Phase tun command
myisp:
set device PPPoE:fxp0
set authname user9010145968
set authkey qrs4KRyJ
enable dns # request DNS info (for resolv.conf)
add default HISADDR # Add a (sticky) default route
Код: Выделить всё
gateway_enable="YES"
sshd_enable="YES"
firewall_enable="YES"
firewall_script="/etc/test"
natd_enable="YES"
natd_interface="fxp0"
natd_flags="-f /etc/natd.conf"
# -- sysinstall generated deltas -- # Wed Feb 16 13:42:51 2011
ifconfig_xl0="inet 10.3.1.7 netmask 255.255.255.0"
mousechar_start="3"
saver="daemon"
font8x8="cp866-8x8"
font8x14="cp866-8x14"
font8x16="cp866b-8x16"
scrnmap="koi8-r2cp866"
keyrate="normal"
keymap="ru.koi8-r"
#defaultrouter="10.3.1.1"
hostname="test"
#логирование
syslogd_enable="NO"
syslog_ng_enable="YES"
ppp_enable="YES"
ppp_mode="ddial"
ppp_profile="myisp"
# -- sysinstall generated deltas -- # Sat Mar 5 14:42:57 2011
ifconfig_fxp0="inet 77.243.243.141 netmask 255.255.255.255"
defaultrouter="77.243.243.141"
hostname="test "
Код: Выделить всё
#!/bin/sh
# ipfw.rule
fw="/sbin/ipfw"; iif="rl0"; oif="vr0"; oifIP="77.243.243.141";tif="gre102";
cInet="10.3.1.0/24{1-100}";
lan="10.3.1.0/24"; blan="10.3.1.255/32";
IPMRA1="194.67.23.0/24{62,100,154,196}"; IPMRA2="194.67.57.0/24{11,121,142,150,206,244}"; IPMRA3="194.186.55.0/24{12,17-36}"
${fw} disable firewall && ${fw} -q flush && /bin/echo '' > /var/log/security
${fw} add 10 pass ip from any to any via lo0; ${fw} add 11 deny ip from any to 127.0.0.0/8;
${fw} add 12 deny ip from 127.0.0.0/8 to any
${fw} add 13 deny ip from any to any frag
#${fw} add 20 pass ip from any to any via ${iif}
#${fw} add 21 pass ip from any to any via ${tif}
${fw} add 31 pass icmp from any to any via ${iif}
${fw} add 32 pass icmp from any to any via ${tif}
#${fw} add 33 pass log esp from any to any
#${fw} add 34 pass log gre from any to any
${fw} add 35 pass udp from any 500 to any
#${fw} add 50 count log ip from ${lan} to any
#${fw} add 51 count ip from any to ${lan}
#${fw} add 52 count log ip from any to ${oifIP}
${fw} add 110 skipto 1000 ip from any to any in recv ${iif}
${fw} add 120 skipto 2000 ip from any to any out xmit ${iif}
${fw} add 130 skipto 3000 ip from any to any in recv ${oif}
${fw} add 140 skipto 4000 ip from any to any out xmit ${oif}
#${fw} add 150 skipto 5000 ip from any to any in recv ${tif}
#${fw} add 160 skipto 6000 ip from any to any out xmit ${tif}
#${fw} add 170 pass log logamount 1000 ip from any to any via gif40
${fw} add 210 deny log logamount 1000 ip from any to any
#===============================================================================
# internal-in;
${fw} add 1000 deny ip from ${lan} to ${IPMRA1} in via ${iif}
${fw} add deny ip from ${lan} to ${IPMRA2} in via ${iif}
${fw} add deny ip from ${lan} to ${IPMRA3} in via ${iif}
${fw} add pass log logamount 1000 tcp from any to 10.1.8.1 limit dst-addr 3
${fw} add 1999 pass ip from any to any in via ${iif}
# internal-out; в LAN
${fw} add 2000 count ip from any to any out via ${iif}
${fw} add 2999 pass ip from any to any out via ${iif}
#===============================================================================
# external-in 3000; Из ISP
# Закрыть приватные сети с инета
${fw} add 3000 deny ip from 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 169.254.0.0/16 to any in recv ${oif}
${fw} add deny ip from any to 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 169.254.0.0/16 in recv ${oif}
${fw} add pass icmp from any to any icmptypes 0,8,3,5,11
${fw} add deny icmp from any to any
#${fw} add pass tcp from any to any 22 in via ${oif}
${fw} add pass tcp from 77.243.0.0/24,85.172.0.0/16 to any 22 in via ${oif}
${fw} add deny tcp from any to any 22 in via ${oif}
${fw} add pass tcp from any to me 22 in via ${oif}
${fw} add 3300 divert natd log ip from any to ${oifIP} in via ${oif}
${fw} add pass all from 85.172.6.122 to 77.243.243.141 in via ${oif}
${fw} add pass all from any to ${cInet}
${fw} add pass esp from 85.172.6.122 to 77.243.243.141 in via ${oif}
${fw} add pass tcp from any to ${oifIP} in via ${oif}
${fw} add pass udp from any 123 to me 123 in via ${oif}
${fw} add pass udp from any 53 to me in via ${oif}
${fw} add 3999 deny log logamount 1000 all from any to any in via ${oif}
# external-out 4000
${fw} add 4000 count ip from any to any out via ${oif}
${fw} add divert natd log logamount 1000 ip from ${cInet} to any out via ${oif}
${fw} add pass esp from any to any out via ${oif}
${fw} add pass all from me to any keep-state out via ${oif}
${fw} add 4999 pass log logamount 1000 all from any to any out keep-state out via ${oif}
#============================================================================================
# gre102-in 5000
#${fw} add 5000 count ip from any to any in via ${tif}
#${fw} add 5990 pass log logamount 1000 ip from any to any in via ${tif}
# gre102-out 6000
#${fw} add 6000 count ip from any to any out via ${tif}
#${fw} add 6990 pass log logamount 1000 ip from any to any out via ${tif}
#==============================================================================================
${fw} add 65500 deny log logamount 1000 all from any to any
${fw} enable firewallКод: Выделить всё
same_ports yes
use_sockets yesКод: Выделить всё
options IPFIREWALL
options IPFIREWALL_FORWARD
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=5
options IPDIVERT
options IPSEC
options IPSEC_DEBUG
device crypto
