Код: Выделить всё
FreeBSD srvfrbsd. 7.3-RELEASE FreeBSD 7.3-RELEASE #4: Wed Sep 1 11:21:33 MSD 2010 serg@srvfrbsd.:/usr/obj/usr/src/sys/SRVFBSD i386
Код: Выделить всё
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100
options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPDIVERT
options IPFIREWALL_FORWARD
options DUMMYNET
options HZ=2000
options IPFILTER
options IPFILTER_LOG
device crypto
Код: Выделить всё
keymap="ru.koi8-r"
font8x14="cp866-8x14"
font8x16="cp866b-8x16"
font8x8="cp866-8x8"
scrnmap="koi8-r2cp866"
inetd_enable="YES"
gateway_enable="YES"
sendmail_enable="YES"
named_enable="YES"
natd_enable="YES"
natd_interface="nfe0"
firewall_enable="YES"
firewall_type="firewall"
firewall_quiet="YES"
firewall_logging="YES"
dummynet_enable="YES"
firewall_type="/usr/local/etc/firewall.conf"
ifconfig_vr0="inet 192.168.0.122 netmask 255.255.255.0"
ifconfig_nfe0="inet 80.237.90.133 netmask 255.255.255.248"
defaultrouter="80.237.90.129"
hostname="srvfrbsd."
sshd_enable="YES"
squid_enable="YES"
sendmail_enable="NONE"
Код: Выделить всё
add pipe 1 ip from any to 192.168.0.145/32 in via vr0 # Загоняем этого клиента в 1 трубу
add pipe 1 ip from 192.168.0.145/32 to any out via vr0
pipe 1 config bw 1KBit/s # Задаем скорость 1 трубы
add 100 divert natd ip from any to any via nfe0
add 10010 count ip from any to 80.237.90.133 in recv nfe0
add 10020 count ip from 80.237.90.133 to any out xmit nfe0
add 40000 allow ip from any to any via lo0
add allow udp from any to any
add allow icmp from any to any
add allow tcp from any to any established
add allow ip from any to any frag
add allow tcp from any to any 22 setup
add allow tcp from any 20 to any setup
add allow tcp from any to any 21 setup
add allow tcp from any to any 25 setup
add allow tcp from any to any 110 setup
add allow tcp from any to any 143 setup
add allow tcp from any to me 80 setup
add allow tcp from me to any 80 setup
add allow tcp from me to any 443 setup
add allow tcp from 192.168.0.0/24 to me 3128 setup
add deny tcp from 192.168.0.0/24 to any 80
add allow tcp from any to any 1024-65535 setup
add 65500 deny ip from any to any
Код: Выделить всё
ipfw show
00100 990996 55596308 allow ip from any to any via lo0
00100 660774 1058905713 divert 8668 ip from any to any via nfe0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny ip from 127.0.0.0/8 to any
00400 0 0 pipe 1 ip from any to 192.168.0.145 in via vr0
00500 0 0 pipe 1 ip from 192.168.0.145 to any out via vr0
10010 82535 116718412 count ip from any to 80.237.90.133 in recv nfe0
10020 568505 938094284 count ip from 80.237.90.133 to any out xmit nfe0
40000 0 0 allow ip from any to any via lo0
40100 35518 12190006 allow udp from any to any
40200 5379 434025 allow icmp from any to any
40300 771868 1172417558 allow tcp from any to any established
40400 0 0 allow ip from any to any frag
40500 0 0 allow tcp from any to any dst-port 22 setup
40600 0 0 allow tcp from any 20 to any setup
40700 0 0 allow tcp from any to any dst-port 21 setup
40800 6 288 allow tcp from any to any dst-port 25 setup
40900 2 96 allow tcp from any to any dst-port 110 setup
41000 0 0 allow tcp from any to any dst-port 143 setup
41100 0 0 allow tcp from any to me dst-port 80 setup
41200 615 36900 allow tcp from me to any dst-port 80 setup
41300 12 720 allow tcp from me to any dst-port 443 setup
41400 403 19344 allow tcp from 192.168.0.0/24 to me dst-port 3128 setup
41500 297 14256 deny tcp from 192.168.0.0/24 to any dst-port 80
41600 5934 285820 allow tcp from any to any dst-port 1024-65535 setup
65500 124 13212 deny ip from any to any
65535 5406 4391499 allow ip from any to any
Помогите люди добрые)))
Заранее спасибо всем ответившим