Есть шлюз на freebsd 7.2-release.
на внутреннем интерфейсе висят несколько подсетей.
Подскажите пожалуйста где я намудрил?!
Вроде все по логике правильно,как я думаю.
rc.firewall:
Код: Выделить всё
#!/bin/sh
FwCMD="/sbin/ipfw"
LanOut="sis0"
LanIn="re0"
IpOut="x.x.x.x"
#NetIn1="10.5.5.0"
NetIn2="192.168.196.0"
NetIn3="192.168.192.0"
NetIn4="192.168.188.0"
NetIn5="192.168.168.0"
NetIn6="192.168.160.0"
NetIn7="192.168.152.0"
NetIn8="192.168.148.0"
NetIn9="192.168.144.0"
NetIn10="192.168.140.0"
NetIn11="192.168.136.0"
NetIn12="192.168.132.0"
NetIn13="192.168.128.0"
NetIn14="192.168.124.0"
NetIn15="192.168.120.0"
NetIn16="192.168.116.0"
NetIn17="192.168.112.0"
NetIn18="192.168.108.0"
NetIn19="192.168.104.0"
NetIn20="192.168.100.0"
${FwCMD} -f flush
${FwCMD} add check-state
${FwCMD} add allow ip from any to any via lo0
${FwCMD} add deny ip from "table(0)" to ${IpOut} 22 via ${LanOut}
${FwCMD} add deny ip from any to 127.0.0.0/8
${FwCMD} add deny ip from 127.0.0.0/8 to any
${FwCMD} add deny ip from any to 10.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 172.16.0.0/12 in via ${LanOut}
${FwCMD} add deny ip from any to 192.168.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 0.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 169.254.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 240.0.0.0/4 in via ${LanOut}
${FwCMD} add deny icmp from any to any frag
${FwCMD} add deny log icmp from any to 255.255.255.255 in via ${LanOut}
${FwCMD} add deny log icmp from any to 255.255.255.255 out via ${LanOut}
${FwCMD} add divert 199 ip from 192.168.0.0/16 to any out xmit ${LanOut}#это для netams
${FwCMD} add divert natd ip from ${NetIn2}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn3}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn4}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn5}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn6}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn7}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn8}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn9}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn10}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn11}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn12}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn13}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn14}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn15}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn16}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn17}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn18}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn19}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn20}/24 to any out via ${LanOut}
${FwCMD} add divert natd ip from any to ${IpOut} in via ${LanOut}
${FwCMD} add divert 199 ip from any to 192.168.0.0/16 in recv ${LanOut}#это для netams
${FwCMD} add deny ip from 10.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 172.16.0.0/12 to any out via ${LanOut}
${FwCMD} add deny ip from 192.168.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 0.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 169.254.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 224.0.0.0/4 to any out via ${LanOut}
${FwCMD} add deny ip from 240.0.0.0/4 to any out via ${LanOut}
${FwCMD} add allow tcp from any to any established
${FwCMD} add allow ip from ${IpOut} to any out xmit ${LanOut}
${FwCMD} add allow udp from any 53 to any via ${LanOut}
${FwCMD} add allow udp from any to any 123 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 21 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 49152-65535 via ${LanOut}
${FwCMD} add allow icmp from any to any icmptypes 0,8,11
${FwCMD} add allow tcp from any to ${IpOut} 80 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 22 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 143 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 110 via ${LanOut}
${FwCMD} add allow tcp from any to any via ${LanIn}
${FwCMD} add allow udp from any to any via ${LanIn}
${FwCMD} add allow icmp from any to any via ${LanIn}
${FwCMD} add deny ip from any to any
man ipfw 
я прям телепат,,,,