Поменял интерфейсы, немного поменялись настройки. Конфиг IPFW на всякий случай поменял на приближённый к статье. Полный вывод всего что есть на данный момент:
Код: Выделить всё
ifconfig
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 00:0c:29:56:ce:38
inet 192.168.1.10 netmask 0xffffff00 broadcast 192.168.1.255
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 00:0c:29:56:ce:42
inet 172.16.168.130 netmask 0xffffff00 broadcast 172.16.168.255
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
Код: Выделить всё
ps -A | grep nat
802 ?? Is 0:00.00 /sbin/natd -f /etc/natd.conf -n em0
Код: Выделить всё
ipfw show
00100 0 0 allow ip from any to any via lo0
00200 0 0 deny ip from any to any not verrevpath in
00300 0 0 deny ip from any to any frag
00400 0 0 allow tcp from 172.16.168.0/24 to 172.16.168.130 dst-port 3128
00500 0 0 allow tcp from 172.16.168.130 3128 to 172.16.168.0/24
00600 566 56037 allow ip from any to any established
00700 10 648 allow ip from 192.168.1.10 to any out xmit em0
00800 9 980 allow udp from any 53 to any via 192.168.1.10
00900 0 0 allow udp from any to any dst-port 123 via em0
01000 160 9600 allow icmp from any to any icmptypes 0,8,11
01100 80 9442 allow ip from 172.16.168.30 to any
01200 0 0 allow ip from any to 172.16.168.30
01300 1 60 allow tcp from any to 192.168.1.10 dst-port 22
01400 0 0 allow tcp from 192.168.1.10 22 to any
01500 4 112 deny log ip from any to any
65535 0 0 deny ip from any to any
Код: Выделить всё
cat /etc/natd.conf
log yes
use_sockets yes
same_ports yes
unregistered_only yes
interface em0
Код: Выделить всё
# Clear Firewall policy
ipfw -f flush
ipfw add allow ip from any to any via lo0
# spuff
ipfw add deny ip from any to any not verrevpath in
# Fragments
ipfw add deny ip from any to any frag
ipfw add allow tcp from ${inet1} to ${lanip} 3128
ipfw add allow tcp from ${lanip} 3128 to ${inet1}
ipfw add divert natd ip from ${inet1} to any out via ${wan}
ipfw add divert natd ip from any to ${wanip} in via ${wan}
ipfw add allow ip from any to any established
ipfw add allow ip from ${wanip} to any out xmit ${wan}
ipfw add allow udp from any 53 to any via ${wanip}
ipfw add allow udp from any to any 123 via ${wan}
ipfw add allow icmp from any to any icmptypes 0,8,11
ipfw add allow ip from any to any via ${em1}
ipfw add allow tcp from any to any via ${em1}
ipfw add allow udp from any to any via ${em1}
ipfw add allow icmp from any to any via ${em1}
ipfw add allow all from ${sint} to any
ipfw add allow all from any to ${sint}
ipfw add allow tcp from any to ${wanip} 22
ipfw add allow tcp from ${wanip} 22 to any
ipfw add deny log all from any to any
Код: Выделить всё
tcpdump -i em0 -n icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em0, link-type EN10MB (Ethernet), capture size 96 bytes
20:32:20.281287 IP 172.16.168.30 > 213.180.204.3: ICMP echo request, id 512, seq 27136, length 40
20:32:25.780673 IP 172.16.168.30 > 213.180.204.3: ICMP echo request, id 512, seq 27392, length 40
20:32:31.281273 IP 172.16.168.30 > 213.180.204.3: ICMP echo request, id 512, seq 27648, length 40
^C
3 packets captured
21 packets received by filter
0 packets dropped by kernel
