Большая просьба помочь разобраться в следующем вопросе:
Дано:
FreeBSD 9.0
Локальная сеть 192.168.5.0/24
Подключение к провайдеру интернет услуг посредством PPPoE по Ethernet кабелю.
Необходимо раздать в локальной сети интернет, пользователи получают IP адреса автоматом.Также нужно настроить пере направления на устройство одной организации (на видео регистратор).
Удалось только дать всем пользователям локальной сети интернет. настроить автоматическую раздачу IP адресов.
Но Настроить пере направления на видео регистратор не получилось.И ещё очень странно но интернет на машинах локальной сети работает, а на самом сервере нет(думаю из за того, что при создании туннеля, dns сервера в файле resolv.conf автоматически замещаются).
Мои конфиги:
Ядро
machine i386
cpu I686_CPU
ident MASTERCOM
#########################################
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100
options IPFIREWALL_FORWARD
options IPDIVERT
options DUMMYNET
options HZ="1000"
#########################################
makeoptions DEBUG=-g # Build kernel with gdb(1) debug symbols
options SCHED_ULE # ULE scheduler
options PREEMPTION # Enable kernel thread preemption
options INET # InterNETworking
#options INET6 # IPv6 communications protocols
options SCTP # Stream Control Transmission Protocol
options FFS # Berkeley Fast Filesystem
options SOFTUPDATES # Enable FFS soft updates support
options UFS_ACL # Support for access control lists
options UFS_DIRHASH # Improve performance on big directories
options UFS_GJOURNAL # Enable gjournal-based UFS journaling
options MD_ROOT # MD is a potential root device
#options NFSCL # New Network Filesystem Client
#options NFSD # New Network Filesystem Server
#options NFSLOCKD # Network Lock Manager
#options NFS_ROOT # NFS usable as /, requires NFSCL
options MSDOSFS # MSDOS Filesystem
options CD9660 # ISO 9660 Filesystem
options PROCFS # Process filesystem (requires PSEUDOFS)
options PSEUDOFS # Pseudo-filesystem framework
options GEOM_PART_GPT # GUID Partition Tables.
options GEOM_LABEL # Provides labelization
options COMPAT_FREEBSD4 # Compatible with FreeBSD4
options COMPAT_FREEBSD5 # Compatible with FreeBSD5
options COMPAT_FREEBSD6 # Compatible with FreeBSD6
options COMPAT_FREEBSD7 # Compatible with FreeBSD7
options SCSI_DELAY=5000 # Delay (in ms) before probing SCSI
options KTRACE # ktrace(1) support
options STACK # stack(9) support
options SYSVSHM # SYSV-style shared memory
options SYSVMSG # SYSV-style message queues
options SYSVSEM # SYSV-style semaphores
options _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options PRINTF_BUFR_SIZE=128 # Prevent printf output being interspersed.
options KBD_INSTALL_CDEV # install a CDEV entry in /dev
options HWPMC_HOOKS # Necessary kernel hooks for hwpmc(4)
options AUDIT # Security event auditing
options MAC # TrustedBSD MAC Framework
#options KDTRACE_HOOKS # Kernel DTrace hooks
options INCLUDE_CONFIG_FILE # Include this file in kernel
options KDB # Kernel debugger related code
options KDB_TRACE # Print a stack trace for a panic
device apic # I/O APIC
# CPU frequency control
device cpufreq
# Bus support.
device acpi
device eisa
device pci
# ATA controllers
device ahci # AHCI-compatible SATA controllers
device ata # Legacy ATA/SATA controllers
device atadisk
device atapicd
options ATA_CAM # Handle legacy controllers with CAM
options ATA_STATIC_ID # Static device numbering
# ATA/SCSI peripherals
device scbus # SCSI bus (required for ATA/SCSI)
device ch # SCSI media changers
device da # Direct Access (disks)
device sa # Sequential Access (tape etc)
device cd # CD
device pass # Passthrough device (direct ATA/SCSI access)
device ses # SCSI Environmental Services (and SAF-TE)
# atkbdc0 controls both the keyboard and the PS/2 mouse
device atkbdc # AT keyboard controller
device atkbd # AT keyboard
device psm # PS/2 mouse
device kbdmux # keyboard multiplexer
device vga # VGA video card driver
device splash # Splash screen and screen saver support
# syscons is the default console driver, resembling an SCO console
device sc
options SC_PIXEL_MODE # add support for the raster text mode
device agp # support several AGP chipsets
# Add suspend/resume support for the i8254.
device pmtimer
device puc # Multi I/O cards and multi-channel UARTs
# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device miibus # MII bus support
device re # RealTek 8139C+/8169/8169S/8110S
device rl # RealTek 8129/8139
device vr # VIA Rhine, Rhine II
# Pseudo devices.
device loop # Network loopback
device random # Entropy device
device ether # Ethernet support
device vlan # 802.1Q VLAN support
device tun # Packet tunnel.
device pty # BSD-style compatibility pseudo ttys
device md # Memory "disks"
device gif # IPv6 and IPv4 tunneling
device faith # IPv6-to-IPv4 relaying (translation)
device firmware # firmware assist module
# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
# Note that 'bpf' is required for DHCP.
device bpf # Berkeley packet filter
# USB support
options USB_DEBUG # enable debug msgs
device uhci # UHCI PCI->USB interface
device ohci # OHCI PCI->USB interface
device ehci # EHCI PCI->USB interface (USB 2.0)
device usb # USB Bus (required)
device uhid # "Human Interface Devices"
rc.conf
ppp.confhostname="net.mastercom.net"
keymap="ru.koi8-r.kbd"
#######################Ifaces#################
network_interfaces="lo0 rl0 vr0"
ifconfig_lo0="inet 127.0.0.1"
ifconfig_rl0="DHCP media 100baseTX"
ifconfig_vr0="inet 192.168.5.250 netmask 255.255.255.0 media 100baseTX"
#######################Firewall################
firewall_enable="YES"
firewall_script="/root/firewall.sh"
#######################PPPoE###################
ppp_nat="NO"
ppp_enable="YES"
ppp_mode="ddial"
ppp_profile="pppoe"
###############################################
gateway_enable="YES"
sshd_enable="YES"
#ntpd_enable="YES"
#powerd_enable="NO"
sendmail_enable="NO"
#####################SAMBA#####################
samba_enable="YES"
nmbd_enable="YES"
smbd_enable="YES"
#####################DHCP######################
dhcpd_enable="YES"
dhcpd_flags="-q"
dhcpd_ifaces="vr0"
#####################natd#####################
natd_enable="YES"
natd_interface="tun0"
natd_flags="-dynamic -f /etc/natd.conf"
##############################################
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
natd.confdefault:
set log Phase tun command
pppoe:
set device PPPoE:rl0
set authname XXXXXXXXXXXX
set authkey XXXXXXXXXXXXXX
set speed sync
set mtu 1492
set mru 1492
set ctsrts off
set timeout 0
set redial 0 0
#Link Quality Request
enable lqr
set lqrperiod 10
enable lqr echo
enable echo
set dial
set login
#enable dns
add default HISADDR
firewall.shredirect_port tcp 192.168.5.146:8080 8080
dhcpd.conf#!/bin/sh
############################
#FreeBDS 9.0 firewall script
############################
fw="/sbin/ipfw -q add"
inif="vr0"
extif="tun0"
inip="192.168.5.250"
extip="XXX.XXX.XXX.XXX"
innet="192.168.5.0/24"
skip="skipto 1000"
ks="keep-state"
good_tcpo="22,25,37,43,53,80,443,110,119"
reg1="192.168.5.146"
reg2="192.168.5.147"
##########reset##########################################
/sbin/ipfw -q -f flush
/sbin/ipfw -q -f pipe flush
/sbin/ipfw -q -f queue flush
##########allow rules####################################
$fw 002 allow all from any to any via vr0
$fw 003 allow all from any to any via lo0
$fw 100 divert natd all from any to any in via $extif
$fw 200 check-state
$fw 300 $skip udp from any 53 to $innet
$fw 320 $skip udp from $innet to any 53
$fw 360 $skip tcp from any to any 80 out via $extif setup $ks
$fw 380 $skip tcp from any to any 443 out via $extif setup $ks
$fw 400 $skip tcp from me to any out via $extif setup $ks uid root
$fw 420 $skip tcp from any to any 22 out via $extif setup $ks
$fw 440 allow icmp from any to any out via $extif $ks
Правила перенаправления
$fw 460 allow tcp from any 8080 to 192.168.5.146 8080 in via $extif
$fw 480 allow tcp from any 8080 to 192.168.5.146 8080 out via $inif
$fw 500 deny ip from any to 192.168.0.0/16 in via $extif
$fw 520 deny ip from any to 172.16.0.0/12 in via $extif
$fw 530 deny ip from any to 10.0.0.0/8 in via $extif
$fw 540 deny ip from any to 127.0.0.0/8 in via $extif
$fw 550 deny ip from any to 0.0.0.0/8 in via $extif
$fw 560 deny ip from any to 169.254.0.0/16 in via $extif
$fw 570 deny ip from any to 192.0.2.0/24 in via $extif
$fw 580 deny ip from any to 204.152.64.0/23 in via $extif
$fw 590 deny ip from any to 224.0.0.0/3 in via $extif
$fw 600 deny icmp from any to any in via $extif
$fw 620 deny tcp from any to any 113 in via $extif
$fw 640 deny tcp from any to any 137 in via $extif
$fw 650 deny tcp from any to any 138 in via $extif
$fw 660 deny tcp from any to any 139 in via $extif
$fw 670 deny tcp from any to any 81 in via $extif
$fw 700 deny all from any to any frag in via $extif
$fw 800 deny tcp from any to any established in via $extif
$fw 900 deny log ip from any to any
$fw 1000 divert natd ip from any to any out via $extif
$fw 1100 allow ip from any to any
$fw 65534 deny log all from any to any
НЕ РАБОТАЕТ ПЕРЕНАПРАВЛЕНИoption domain-name "XXXXXXXXXXXX";
ВОТ С ЭТИМИ DNS адресами интернет работает
option domain-name-servers 212.96.120.5, 212.96.96.38;
default-lease-time 14400;
max-lease-time 14400;
ddns-update-style interim;
authoritative;
log-facility local7;
subnet 192.168.5.0 netmask 255.255.255.0 {
range 192.168.5.200 192.168.5.240;
option routers 192.168.5.250;
}
resolve.conf
# Generated by resolvconf
search ETTH
nameserver 77.39.126.38
nameserver 77.39.126.37
nameserver 46.61.192.15
НЕ РАБОТАЕТ ИНТЕРНЕТ НА САМОМ ШЛЮЗЕ ))))
Кстати когда место машины с фрёй стоя обычный dir 300 то перенаправления я ставил на hhht порт 8080 и всё работало.
А как здесь перенаправить на hhtp порт , также из доступных это TCP 37780 , есть ещё UDP
ПОМОГИТЕ ПОЖАЛУЙСТА!!!
