Код: Выделить всё
#!/bin/sh
ipfw="/sbin/ipfw"
out_ip="1.1.1.1"
out_if="xl0"
in_net="192.168.1.0/24"
in_ip="192.168.1.100"
in_if="vr0"
in_net2="192.168.2.0/24"
in_ip2="192.168.2.55"
in_ip2="vr1"
nating="192.168.1.111,192.168.1.53,192.168.1.64,192.168.1.67,192.168.1.52"
${ipfw} -f flush
${ipfw} add check-state
${ipfw} add pass all from any to any via lo0
${ipfw} add deny all from any to 127.0.0.0/8
${ipfw} add deny ip from 127.0.0.0/8 to any
${ipfw} add deny ip from any to 172.16.0.0/12 in recv ${out_if}
${ipfw} add deny ip from 172.16.0.0/12 to any in recv ${out_if}
${ipfw} add deny ip from any to 10.0.0.0/8 in recv ${out_if}
${ipfw} add deny ip from 10.0.0.0/8 to any in recv ${out_if}
${ipfw} add deny ip from any to 169.254.0.0/16 in recv ${out_if}
${ipfw} add deny ip from 169.254.0.0/16 to any in recv ${out_if}
${ipfw} add deny log icmp from any to 255.255.255.255 in via ${out_if}
${ipfw} add deny log icmp from any to 255.255.255.255 out via ${out_if}
#NAT
${ipfw} nat 1 config ip ${out_ip} log same_ports
${ipfw} add nat 1 log ip from ${nating} to any out via ${out_if}
${ipfw} add nat 1 log ip from any to ${out_ip}
${ipfw} add pass all from ${in_net} to me via ${in_if}
${ipfw} add pass all from me to ${in_net} via ${in_if}
${ipfw} add pass all from ${nating} to any setup
${ipfw} add pass all from ${in_net} to any 22 setup
${ipfw} add allow ip from any to any via vr0
${ipfw} add allow ip from any to any via vr1
${ipfw} add pass tcp from any to any established
${ipfw} add pass tcp from ${out_ip} to any via ${out_if}
${ipfw} add pass udp from ${out_ip} to any 53 keep-state
${ipfw} add pass udp from ${out_ip} to any 123 keep-state
${ipfw} add pass icmp from any to any icmptypes 0,3,8,11
${ipfw} add deny ip from any to anyКод: Выделить всё
firewall_enable="YES"
firewall_type="/etc/rc.firewall"
firewall_nat_enable="YES"
firewall_nat_interface="xl0"
dummynet_enable="YES"
