ping из локальной сети

[ikoko]

Здравствуйте, есть сервер на базе FreeBSD 8.1-RELEASE стоит Nodeny, все работает но возникла задача по ВПН из локальной сети подсоединятся к серверу в интернете , но все не как не получается уже добавлял правила в rc.firewall довел до вот такова вида

Код: Выделить всё

#!/bin/sh -
f='/sbin/ipfw'

ifOut='em1'

${f} -f flush

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any

${f} add 65 allow tcp from any to me 1723
${f} add 66 allow tcp from me 1723 to any
${f} add 67 allow gre from any to any

${f} add 70 allow tcp from any to me 42
${f} add 71 allow tcp from me 42 to any

${f} add 80 allow udp from any to me 42
${f} add 81 allow udp from me 42 to any

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 140 deny ip from any to "table(120)"
${f} add 150 deny ip from "table(120)" to any
${f} add 160 skipto 2000 ip from any to me

${f} add 200 skipto 500 ip from any to any via ${ifOut}

${f} add 300 skipto 4500 ip from any to any in

${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any


${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any 
${f} add 2020 allow tcp from any to any 80,443
#${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723

#${f} add 2100 pass tcp pass tcp from any 1723 to any 1024-65535 out xmit ${ifOut}
#${f} add 2110 pass tcp from any 1024-65535 to any 1723 in recv ${ifOut}
#${f} add 2120 pass gre from any to any out xmit ${ifOut}
#${f} add 2130 pass gre from any to any in recv ${ifOut}

${f} add 2100 deny ip from any to any

${f} add 32490 deny ip from any to any

и все равно не хочет конектиться, а также и не пингуется сам сервер впн из локалки, а из сервера пингуется, пожалуйста подскажите какие правила на дописывать для того чтобы пинговалось и впн конектился, бо уже

Код: Выделить всё

pf.conf

set limit states 128000
set optimization aggressive
nat pass on em1 from 192.168.216.0/24 to any -> em1
nat pass on em1 from 192.168.215.0/24 to any -> em1

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[bagas]

Покажите
# ipfw show
и
# netstat -r
И зачем дублировать правило?

Код: Выделить всё

${f} add 2100 deny ip from any to any
${f} add 32490 deny ip from any to any

[dikens3]

ИМХО лучший способ найти проблему, освоить LOG в ipfw.
По моему натить всё таки нужно траффик в инет..

[ikoko]

ipfw show

Код: Выделить всё

00050     2582      178919 allow tcp from any to me dst-port 22
00051     2386      268696 allow tcp from me 22 to any
00065        0           0 allow tcp from any to me dst-port 1723
00066        0           0 allow tcp from me 1723 to any
00067        0           0 allow gre from any to any
00070        0           0 allow tcp from any to me dst-port 42
00071        0           0 allow tcp from me 42 to any
00080        0           0 allow udp from any to me dst-port 42
00081        0           0 allow udp from me 42 to any
00110    55266   166927574 allow ip from any to any via lo0
00120   119029    25006179 skipto 1000 ip from me to any
00130      486       27216 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00140        0           0 deny ip from any to table(120)
00150        0           0 deny ip from table(120) to any
00160   761899   140136912 skipto 2000 ip from any to me
00200 16929344 14391688244 skipto 500 ip from any to any via em1
00300  6541754  1405586402 skipto 4500 ip from any to any in
00400 10401947 12967198936 skipto 450 ip from any to any recv em1
00420     3466      421586 divert 1 ip from any to any
00450 10405420 12967628101 divert 2 ip from any to any
00490 10403451 12964874077 allow ip from any to any
00500 10416919 12989242108 skipto 32500 ip from any to any in
00510  6512708  1402545283 divert 1 ip from any to any
00540  6507456  1402434957 allow ip from any to any
01000    55509    15391710 allow udp from any 53,7723 to any
01010     2633      350545 allow tcp from any to any setup keep-state
01020    76581    12045939 allow udp from any to any keep-state
01100    22347     6500788 allow ip from any to any
02000        0           0 check-state
02010    80921    82904577 allow icmp from any to any
02020     1309      107051 allow tcp from any to any dst-port 80,443
02060    55804     3562695 allow udp from any to any dst-port 53,7723
02100   585824    44279786 deny ip from any to any
05000        0           0 deny ip from not table(0) to any
05001        0           0 skipto 5010 ip from table(127) to table(126)
05002  6536593  1404980234 skipto 5030 ip from any to not table(2)
05003       45        2168 deny ip from any to not table(1)
05004     3447      432454 pipe tablearg ip from table(21) to any
05005        0           0 deny ip from any to any
05010        0           0 pipe tablearg ip from table(127) to any
05030     4625      222000 deny tcp from table(15) to any dst-port 25
05400  6530172  1404615477 pipe tablearg ip from table(11) to any
32000     1793      142534 deny ip from any to any
32490      412       24197 deny ip from any to any
33000        0           0 pipe tablearg ip from table(126) to table(127)
33001 10415740 12988389691 skipto 33010 ip from not table(2) to any
33002        0           0 pipe tablearg ip from any to table(20)
33003        0           0 deny ip from any to any
33400 10415675 12988368044 pipe tablearg ip from any to table(10)
65535       72       22806 allow ip from any to any

netstat -r

Код: Выделить всё

Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            193.161.13.1       UGS     34561 10577756    em1
localhost          link#6             UH          0    27951    lo0
192.168.215.0      link#2             U         296  3161399    em0
192.168.215.1      link#2             UHS         0        0    lo0
192.168.216.0      link#2             U         864 17884082    em0
bender             link#2             UHS         0        0    lo0
193.161.13.0       link#3             U           4      112    em1
193.161.13.13      link#3             UHS         0       42    lo0