Код: Выделить всё
netstat -s |grep drop
6 connections closed (including 0 drops)
3 embryonic connections dropped
9692 dropped due to socket
12 total packets dropped due to no ARP
Код: Выделить всё
######## NETWORK ###########
defaultrouter="10.59.0.1"
pf_enable="YES"
sshd_enable="YES"
pf_rules="/etc/pf.conf"
#apache22_enable="YES"
ifconfig_em1="DHCP"
#ifconfig_em1="inet 10.59.1.1 netmast 255.255.248.0"
ifconfig_em0="inet 192.168.1.1 netmask 255.255.0.0"
gateway_enable="YES"
hostname="serv"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pfsync_enable="NO" # Expose pf state to other hosts for syncing
pfsync_syncdev="" # Interface for pfsync to work through
pfsync_syncpeer="" # IP address of pfsync peer host
pfsync_ifconfig=""
ftpproxy_enable="YES"
ftpproxy_flags="-D 0"
mpd_enable="YES"
#++++++++++++++++++++++++++++#
##############################
# Interfase #
##############################
keymap=ru.cp1251
scrnmap="win2cpp866"
font8x16=cp866-8x16
font8x14=cp866-8x14
font8x8=cp866-8x8
#++++++++++++++++++++++++++++#
##############################
# MySQL #
##############################
#mysql_enable="YES"
#mysql_limits="NO"
#mysql_dbdir="/var/db/mysql"
#mysql_args="--log"
#++++++++++++++++++++++++++++#
#############################
# FTP #
#############################
#pureftpd_enable=YES
#proftpd_enable=YES
#proftpd_flags="-n -d 5"
#+++++++++++++++++++++++++++#
#############################
# Misc Daemon #
#############################
accounting_enable="YES"
threeproxy_enable="YES"
#zeo3_enable=YES
#zeo3_instances=/usr/local/www/Zope3/
#+++++++++++++++++++++++++++#
############################
# rtorrent #
#rtorrent_enable="YES"
#rtorrent_scgi_port="127.0.0.1:5000"
#++++++++++++++++++++++++++#
#radd_enable="YES"
#linux_enable="YES"
#ejabberd_enable="YES"
###########################
# DNS #
#nsd_enable="YES"
#named_enable="YES"
#named_program="/usr/sbin/named"
#named_flags="-u bind -c /etc/namedb/named.conf"
synchronous_dhclient="YES"
#zabbix_agentd_enable="YES"
#zabbix_server_enable="YES"
Код: Выделить всё
########################################
int_if="em0"
ext_if="em1"
virt_if="ng0"
icmp_types="echoreq"
set block-policy return
set skip on lo
set loginterface $ext_if
scrub in
########################################
# show loging
# tcpdump -n -e -ttt -r /var/log/pflog
# real time
# tcpdump -n -e -ttt -i pflog0
# show statistic
# pfctl -s info
########################################
rdr on $virt_if proto { tcp, udp } from any to any port { 3460 23 } -> 192.168.1.4
rdr on $virt_if proto { tcp, udp } from any to any port { 5801 5901 5900 5902 5903 5904 5905 5905 5906 5907 5908 6881 } -> 192.168.1.2
#nat on $virt_if proto { tcp, udp } from 192.168.1.2 to any -> 85.21.245.15
nat inet from $int_if:network to $ext_if:network -> ($ext_if)
#### -> ...
#nat inet from $int_if:network to !(self) -> ($virt_if)
nat inet from $int_if:network to !(self) -> ($virt_if)
rdr-anchor "ftp-proxy/*"
rdr on $int_if proto tcp from any to !(self) port ftp -> 127.0.0.1 port 8021
rdr on $int_if proto { tcp, udp } from any to any port 23051 -> 192.169.1.2
anchor "ftp-proxy/*"
pass quick on $ext_if proto tcp from any port 31322
#block log all
pass on $int_if
pass out
# uncomment this strings for open "ping"
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in proto udp from any to any port 33433 >< 33626 keep state
#pass all
Код: Выделить всё
[adm@serv~]> ifconfig
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC>
ether 00:1b:21:53:7c:f8
inet 192.168.1.1 netmask 0xffff0000 broadcast 192.168.255.255
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
msk0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=c011a<TXCSUM,VLAN_MTU,VLAN_HWTAGGING,TSO4,VLAN_HWTSO,LINKSTATE>
ether 00:15:f2:0d:d2:fa
media: Ethernet autoselect
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC>
ether 00:07:e9:5a:73:f4
media: Ethernet autoselect
status: no carrier
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=3<RXCSUM,TXCSUM>
inet 127.0.0.1 netmask 0xff000000
pflog0: flags=100<PROMISC> metric 0 mtu 33152
pfsync0: flags=0<> metric 0 mtu 1460
syncpeer: 224.0.0.240 maxupd: 128
ng0: flags=8890<POINTOPOINT,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1500
pcap.zip
Код: Выделить всё
curl mosro.comКод: Выделить всё
nslookup lissyara.su 8.8.8.8В сетевухе-то нет ничегоDuoMorph писал(а):Код: Выделить всё
[adm@serv~]> ifconfig em1: status: no carrier
Код: Выделить всё
разберись с проксей.
Код: Выделить всё
@0 scrub in all fragment reassemble
[ Evaluations: 30437 Packets: 23562 Bytes: 94044 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@0 anchor "ftp-proxy/*" all
[ Evaluations: 20781 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@1 pass quick on em1 proto tcp from any port = 31322 to any flags S/SA keep state
[ Evaluations: 20781 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@2 pass on em0 all flags S/SA keep state
[ Evaluations: 20781 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@3 pass out all flags S/SA keep state
[ Evaluations: 20781 Packets: 431 Bytes: 24540 States: 1 ]
[ Inserted: uid 0 pid 1087 ]
@4 pass in inet proto icmp all icmp-type echoreq keep state
[ Evaluations: 20781 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@5 pass in proto udp from any to any port 33433 >< 33626 keep state
[ Evaluations: 18705 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
Код: Выделить всё
[root@serv/home/adm]> pfctl -vvs nat
@0 nat inet from 192.168.0.0/16 to 10.59.0.0/21 -> (em1) round-robin
[ Evaluations: 2126 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@1 nat inet from 192.168.0.0/16 to ! (self:4) -> (ng0) round-robin
[ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@0 rdr on ng0 inet proto tcp from any to any port = 3460 -> 192.168.1.4
[ Evaluations: 18962 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@1 rdr on ng0 inet proto tcp from any to any port = telnet -> 192.168.1.4
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@2 rdr on ng0 inet proto udp from any to any port = 3460 -> 192.168.1.4
[ Evaluations: 2151 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@3 rdr on ng0 inet proto udp from any to any port = telnet -> 192.168.1.4
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@4 rdr on ng0 inet proto tcp from any to any port = 5801 -> 192.168.1.2
[ Evaluations: 2151 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@5 rdr on ng0 inet proto tcp from any to any port = 5901 -> 192.168.1.2
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@6 rdr on ng0 inet proto tcp from any to any port = 5900 -> 192.168.1.2
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@7 rdr on ng0 inet proto tcp from any to any port = 5902 -> 192.168.1.2
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@8 rdr on ng0 inet proto tcp from any to any port = 5903 -> 192.168.1.2
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@9 rdr on ng0 inet proto tcp from any to any port = 5904 -> 192.168.1.2
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@10 rdr on ng0 inet proto tcp from any to any port = 5905 -> 192.168.1.2
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@11 rdr on ng0 inet proto tcp from any to any port = 5905 -> 192.168.1.2
[ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@12 rdr on ng0 inet proto tcp from any to any port = 5906 -> 192.168.1.2
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@13 rdr on ng0 inet proto tcp from any to any port = 5907 -> 192.168.1.2
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@14 rdr on ng0 inet proto tcp from any to any port = 5908 -> 192.168.1.2
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@15 rdr on ng0 inet proto tcp from any to any port = 6881 -> 192.168.1.2
[ Evaluations: 1722 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@16 rdr on ng0 inet proto udp from any to any port = 5801 -> 192.168.1.2
[ Evaluations: 2151 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@17 rdr on ng0 inet proto udp from any to any port = 5901 -> 192.168.1.2
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@18 rdr on ng0 inet proto udp from any to any port = 5900 -> 192.168.1.2
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@19 rdr on ng0 inet proto udp from any to any port = 5902 -> 192.168.1.2
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@20 rdr on ng0 inet proto udp from any to any port = 5903 -> 192.168.1.2
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@21 rdr on ng0 inet proto udp from any to any port = 5904 -> 192.168.1.2
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@22 rdr on ng0 inet proto udp from any to any port = 5905 -> 192.168.1.2
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@23 rdr on ng0 inet proto udp from any to any port = 5905 -> 192.168.1.2
[ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@24 rdr on ng0 inet proto udp from any to any port = 5906 -> 192.168.1.2
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@25 rdr on ng0 inet proto udp from any to any port = 5907 -> 192.168.1.2
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@26 rdr on ng0 inet proto udp from any to any port = 5908 -> 192.168.1.2
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@27 rdr on ng0 inet proto udp from any to any port = 6881 -> 192.168.1.2
[ Evaluations: 421 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@28 rdr-anchor "ftp-proxy/*" all
[ Evaluations: 18965 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@29 rdr on em0 inet proto tcp from any to ! (self:4) port = ftp -> 127.0.0.1 port 8021
[ Evaluations: 18965 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@30 rdr on em0 inet proto tcp from any to any port = 23051 -> 192.169.1.2
[ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]
@31 rdr on em0 inet proto udp from any to any port = 23051 -> 192.169.1.2
[ Evaluations: 0 Packets: 0 Bytes: 0 States: 0 ]
[ Inserted: uid 0 pid 1087 ]