Есть сервер:
FreeBSD 9.1-RELEASE amd64
apache22-2.2.24
Ядро:
Код: Выделить всё
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=50
options IPFIREWALL_NAT
options LIBALIAS
options ROUTETABLES=2
options HZ="1000"
options IPFIREWALL_FORWARD
options IPDIVERT
options DUMMYNET
options IPFIREWALL_DEFAULT_TO_ACCEPT
Код: Выделить всё
FwCMD="/sbin/ipfw"
LanOut="em0"
LanIn="em1"
IpOut="99.22.22.22"
IpIn="192.168.1.1"
NetIn="192.168.1.0"
${FwCMD} -f flush
${FwCMD} add 100 allow ip from any to any via lo0
${FwCMD} add 200 deny ip from any to 127.0.0.0/8
${FwCMD} add 300 deny ip from 127.0.0.0/8 to any
${FwCMD} add 1040 allow ip from any to any via ${LanIn}
${FwCMD} add 1050 deny ip from any to 192.168.0.0/16 in recv ${LanOut}
${FwCMD} add 1060 deny ip from 192.168.0.0/16 to any in recv ${LanOut}
${FwCMD} add 1070 deny ip from any to 172.16.0.0/12 in recv ${LanOut}
${FwCMD} add 1080 deny ip from 172.16.0.0/12 to any in recv ${LanOut}
${FwCMD} add 1090 deny ip from any to 10.0.0.0/8 in recv ${LanOut}
${FwCMD} add 10100 deny ip from 10.0.0.0/8 to any in recv ${LanOut}
${FwCMD} add 10110 deny ip from any to 169.254.0.0/16 in recv ${LanOut}
${FwCMD} add 10120 deny ip from 169.254.0.0/16 to any in recv ${LanOut}
${FwCMD} add 10130 allow tcp from any to ${IpOut} 22 via ${LanOut}
${FwCMD} add 10130 allow tcp from any to ${IpOut} 80 via ${LanOut}
${FwCMD} nat 1 config log if ${LanOut} reset same_ports deny_in
${FwCMD} add 10140 nat 1 ip from any to any via ${LanOut}
${FwCMD} add 65534 deny all from any to any
Код: Выделить всё
# fetch http://99.22.22.22/DVD1.iso
DVD1.iso 0% of 1279 MB 114 kBps
fetch: DVD1.iso appears to be truncated: 96748/1342013440 bytes
#
Понимаю что надо что-то покрутить, но не знаю что
То ли в ядре, то ли в sysctl а может правило каких добавить....
Направьте на путь истинный плизз
