Мучаюсь уже с пол дня никак не могу понять в чем причина .. похожая конфигурация работает и очень даже стабильно на других серверах.
Интернет с белым ИП адресом
В локалке есть ПК на который надо перебросить тот или иной порт что приходит на интерфейс FreeBSD
Конфиг фаервола
Код: Выделить всё
unix# cat /etc/rc.firewall
#!/bin/sh
ipfw -q -f flush
eip="Х.Х.Х.Х" # External ip
ilan="192.168.Х.0/24" # Internal lan
cmd="ipfw -q add"
skip="skipto 65000"
skip2="skipto 65500"
#########################
citrix="192.168.Х.250"
#########################
############
eif="rl0"
iif="re0"
############
#########################################################
#$cmd 50 allow gre from any to me in via $eif keep-state
#########################################################
##############################################################################
$cmd 70 fwd 127.0.0.1,3128 tcp from 192.168.Х.0/24 to any 80 via $iif
$cmd 80 fwd 192.168.Х.111,2121 tcp from 192.168.Х.0/24 to any 21 via $iif
##############################################################################
##########################################################
$cmd 100 count ip from any to any via $eif
$cmd 300 allow ip from any to any via lo0
$cmd 310 allow ip from any to any via $iif antispoof
##########################################################
##############################################################
# Allow FTP-20,21 iznutri,izvne
#$cmd 330 pass tcp from any to any 20,21 in via $eif
#$cmd 340 pass tcp from any 20 to any in via $eif
##############################################################
#########################################################################
$cmd 1000 divert natd ip from any to any in via $eif
#Citrix
#$cmd 1011 divert natd tcp from $citrix to any src-port 1494 out via $eif
#$cmd 1012 allow tcp from any to $citrix dst-port 1494 in via $eif
#$cmd 1013 allow tcp from me to any src-port 1494 out via $eif
#CDMS
#$cmd 1014 divert natd tcp from $citrix to any src-port порт out via $eif
#$cmd 1015 allow tcp from any to $citrix dst-port порт in via $eif
#$cmd 1016 allow tcp from me to any src-port порт out via $eif
#CDMS
#$cmd 1017 divert natd tcp from $citrix to any src-port порт1 out via $eif
#$cmd 1018 allow tcp from any to $citrix dst-port порт1 in via $eif
#$cmd 1019 allow tcp from me to any src-port порт1 out via $eif
#CDMS
#$cmd 1020 divert natd tcp from $citrix to any src-port порт2 out via $eif
#$cmd 1021 allow tcp from any to $citrix dst-port порт2 in via $eif
#$cmd 1022 allow tcp from me to any src-port порт2 out via $eif
#skipe
$cmd 1030 divert natd tcp from $ilan to any src-port 2604 out via $eif
$cmd 1031 allow tcp from any to any dst-port 65530
$cmd 1032 allow udp from any to any dst-port 65530
$cmd 1033 allow udp from $ilan to any src-port 2604 out via $eif
$cmd 1050 check-state
##########################################################################
##############################################OPEN################################################
#mail
$cmd 1110 $skip tcp from $ilan to any dst-port 110 out via $eif setup keep-state
$cmd 1111 $skip tcp from $ilan to any dst-port 25 out via $eif setup keep-state
$cmd 1112 $skip tcp from $ilan to any dst-port 143 out via $eif setup keep-state
$cmd 1113 $skip tcp from $ilan to any dst-port 995, 587 out via $eif setup keep-state
#FTP
#$cmd 1114 $skip tcp from $ilan to any dst-port 21 out via $eif setup keep-state
#$cmd 1115 $skip tcp from $ilan to any dst-port 20 out via $eif setup keep-state
#$cmd 1116 $skip tcp from $ilan to any dst-port 1024-65535 out via $eif setup keep-state
#Banck Direct
$cmd 1120 $skip tcp from $ilan to any dst-port 443, 5557 out via $eif setup keep-state
$cmd 1121 $skip tcp from $ilan to 194.0.187.198 dst-port 10002, 10001 out via $eif setup keep-state
#SSH
$cmd 1131 $skip tcp from $ilan to any dst-port 22, 1122 out via $eif setup keep-state
#NOD
$cmd 1144 $skip tcp from $ilan to any dst-port 8081 out via $eif setup keep-state
#ICQ
$cmd 1151 $skip tcp from $ilan to any dst-port 3306 out via $eif setup keep-state
$cmd 1152 $skip tcp from $ilan to any dst-port 443, 5190 out via $eif setup keep-state
#Yahoo
$cmd 1153 $skip tcp from $ilan to any dst-port 5000, 5001, 5050, 1863 out via $eif setup keep-state
$cmd 1154 $skip udp from $ilan to any dst-port 5055 out via $eif setup keep-state
#Radio
$cmd 1160 $skip tcp from $ilan to any dst-port 8000, 9000 out via $eif setup keep-state
$cmd 1161 $skip ip from $ilan to any dst-port 8000, 9000 out via $eif setup keep-state
#TeamViewer
$cmd 1170 $skip udp from $ilan to any dst-port 4233, 4235, 4234 out via $eif setup keep-state
############################################END-OPEN###############################################
#########################################Full-access###############################################
#$cmd 1210 $skip tcp from $dolphin to any out via $eif setup keep-state
#$cmd 1220 $skip udp from $dolphin to any out via $eif keep-state
#$cmd 1230 $skip icmp from $dolphin to any out via $eif keep-state
#$cmd 1330 $skip icmp from $ilan to any out via $eif keep-state
########################################END_Full-access############################################
######################################################################################
#Deny ip inbound traffic from non-roureble reserver address spaces
$cmd 1900 deny ip from 192.168.0.0/16 to any in via $eif #RFC 1918 private IP
$cmd 1901 deny ip from 172.16.0.0/12 to any in via $eif #RFC 1918 private IP
$cmd 1902 deny ip from 10.0.0.0/8 to any in via $eif #RFC 1918 private IP
$cmd 1903 deny ip from 127.0.0.0/8 to any in via $eif #loopback
$cmd 1904 deny ip from 0.0.0.0/8 to any in via $eif #loopback
$cmd 1905 deny ip from 169.254.0.0/16 to any in via $eif #DHCP auto-config
$cmd 1906 deny ip from 192.0.2.0/24 to any in via $eif #reserved for docs
$cmd 1907 deny ip from 204.152.64.0/23 to any in via $eif #Sun cluster
$cmd 1908 deny ip from 224.0.0/3 to any in via $eif #Class D & E multicast
$cmd 1909 deny ip from any to any 3128 in via $eif
######################################################################################
#Deny any late arriving packets
$cmd 2000 deny ip from any to any frag in via $eif
#Deny ACK packets that did not match the dynamic rule table
$cmd 2010 deny ip from any to any established in via $eif
#########outbound connection
$cmd 4000 allow tcp from me to any out via $eif setup keep-state
$cmd 4010 allow udp from me to any out via $eif keep-state
$cmd 4030 allow icmp from me to any out via $eif keep-state
$cmd 4040 allow ip from any to me 53 keep-state
$cmd 4050 allow ip from any to me 21 keep-state
$cmd 4060 allow ip from any to me 49100-49110 keep-state
#########inbound connection
$cmd 6000 allow tcp from any to me dst-port 25 in via $eif setup keep-state
$cmd 6010 allow tcp from any to me dst-port 110 in via $eif setup keep-state
$cmd 6020 allow tcp from any to me dst-port 1122 in via $eif setup keep-state
#$cmd 6040 allow tcp from any to me dst-port 1723 in via $eif setup keep-state
$cmd 6050 allow tcp from any to me dst-port 443 in via $eif setup keep-state
$cmd 6060 allow udp from any to any dst-port 53 in via $eif
$cmd 6061 allow tcp from any to any dst-port 53 in via $eif
$cmd 6062 allow tcp from any to any 53 in via $eif
$cmd 6063 allow udp from any to any 53 in via $eif
$cmd 6070 allow tcp from any to me dst-port 143 in via $eif setup keep-state
#Reject & Log all unauthorized incoming connection from the public Internet
$cmd 64900 deny log logamount 10000 all from any to any in via $eif
#Reject & Log all unauthorized out going connections to the public Internet
$cmd 64910 deny log logamount 10000 all from any to any out via $eif
$cmd 65000 divert natd ip from any to any out via $eif
$cmd 65500 allow ip from any to anyКод: Выделить всё
unix# cat /etc/natd.conf
interface rl0
use_sockets yes
dynamic yes
same_ports yes
redirect_port tcp 192.168.Х.250:порт порт
redirect_port tcp 192.168.Х.250:порт1 порт1
redirect_port tcp 192.168.Х.250:порт2 порт2
Код: Выделить всё
unix# ps ax| grep natd
625 ?? Ss 0:00.40 /sbin/natd -f /etc/natd.conf
1103 p0 S+ 0:00.00 grep natd
Код: Выделить всё
Jul 30 19:21:56 unix kernel: ipfw2 (+ipv6) initialized, divert enabled, nat loadable, rule-based forwarding enabled, default to deny, logging limited to 100 packets/entry by default
Подскажите .. может где то явная ошибка !
