переброс порта ipfw

[Spook1680]

Почему не срабатывает переброс на порт?
Нужно с внешнего ip и порта 7000 перебросить на внутрений 7000 на машину с адресом 192.168.21.101

freebsd 7.2
/usr/local/etc/rc.firewall

Код: Выделить всё

#!/bin/sh
fwcmd="/sbin/ipfw"

###
oif="sis0"
onet="xxx.xxx.xx.00/28"
oip="xx.xx.xx.xxx"

###
iif="rl0"
inet="192.168.21.0/24"
iip="192.168.21.1"

###
${fwcmd} -f flush

###
table.sh

###
${fwcmd} add 100 pass all from any to any via lo0
${fwcmd} add 200 deny all from any to 127.0.0.0/8
${fwcmd} add 300 deny ip from 127.0.0.0/8 to any

###
###${fwcmd} add 400 deny ip from 192.168.0.0/16 to any in via ${oif}
${fwcmd} add 410 deny ip from 172.16.0.0/12 to any in via ${oif}
${fwcmd} add 420 deny ip from 10.0.0.0/8 to any in via ${oif}
###
#${fwcmd} add 430 allow tcp from any to any 7000
#${fwcmd} add 440 allow tcp from any 7000 to any
#${fwcmd} add 450 allow udp from any to any 7000
#${fwcmd} add 460 allow udp from any 7000 to any

###
pass () { rule_num=$(($rule_num+100)); $fwcmd add $rule_num pass $*; }
deny () { rule_num=$(($rule_num+100)); $fwcmd add $rule_num deny $*; }

###
rule_num=1000

###
${fwcmd} add 500 divert natd all from table\(1\) to any out via ${oif}
${fwcmd} add 700 divert natd all from any to ${oip} in via ${oif}

###
pass all from ${oip} to any out via ${oif}

###
pass tcp from any to any established

###
pass all from table\(1\) to not ${inet} in via ${iif}
###
pass all from not ${inet} to table\(1\) in via ${oif}
pass all from not ${inet} to table\(1\) out via ${iif}

###ICMP
pass icmp from any to any icmptypes 0,8,11

###
pass all from ${inet} to ${inet} via ${iif}
pass all from 172.31.0.0/24 to ${inet} via ${iif}
###
${fwcmd} add allow tcp from any to xx.xxx.xx.x 7000 in via sis0 setup
${fwcmd} add allow tcp from any to any 7000
${fwcmd} add allow tcp from any 7000 to any
###
${fwcmd} add allow ip from any to me 7000
${fwcmd} add allow ip from any to 192.168.21.101 7000
${fwcmd} add allow ip from 192.168.21.101 7000 to any

/etc/natd.conf

Код: Выделить всё

same_ports yes
use_sockets yes
redirect_port tcp 192.168.21.101:7000 7000

rc.conf

Код: Выделить всё

firewall_enable="YES"
firewall_login="YES"
#firewall_type="open"
firewall_script="/usr/local/etc/rc.firewall"
#firewall_type="/etc/rc.firewall"
#firewall_nat_enable="YES"
#dummynet_enable="YES"

snddetect_enable="YES"
mixer_enable="YES"
bsdstats_enable="YES"
hostname="pcbsd"
ifconfig_rl0="inet 192.168.21.1 netmask 255.255.255.0"
ifconfig_sis0="inet xx.xxx.98.213 netmask 255.255.255.248"
defaultrouter="77.108.98.209"
natd_enable="YES"
natd_interface="sis0"
#natd_flags="redirect_port tcp 192.168.21.101:7000,192.168.21.1:7000"
#natd_program="/sbin/natd"
natd_flags="-f /etc/natd.conf"
#natd_flags=" -m -s -u -punch_fw 5000:5200"
gateway_enable="YES"
apache_enable="YES"
squid_enable="YES"
mysql_enable="YES"
sams_enable="YES"
named_enable="YES"
inetd_enable="YES"

ядро собрано таким образом чо фаэрвол по умолчанию все разрешает.

[root@pcbsd]/usr/local/etc(138)# ipfw -a show
00100 42 4124 allow ip from any to any via lo0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny ip from 127.0.0.0/8 to any
00410 0 0 deny ip from 172.16.0.0/12 to any in via sis0
00420 0 0 deny ip from 10.0.0.0/8 to any in via sis0
00500 1282 158437 divert 8668 ip from table(1) to any out via sis0
00700 2013 794004 divert 8668 ip from any to xx.xxx.xxx.xxx in via sis0
01100 2517 382009 allow ip from 77.108.98.213 to any out via sis0
01200 7076 1817942 allow tcp from any to any established
01300 1165 152839 allow ip from table(1) to not 192.168.21.0/24 in via rl0
01400 690 186386 allow ip from not 192.168.21.0/24 to table(1) in via sis0
01500 690 186386 allow ip from not 192.168.21.0/24 to table(1) out via rl0
01600 0 0 allow icmp from any to any icmptypes 0,8,11
01700 577 51630 allow ip from 192.168.21.0/24 to 192.168.21.0/24 via rl0
01800 0 0 allow ip from 172.31.0.0/24 to 192.168.21.0/24 via rl0
01900 0 0 allow tcp from any to 77.108.98.213 dst-port 7000 in via sis0 setup
02000 0 0 allow tcp from any to any dst-port 7000
02100 0 0 allow tcp from any 7000 to any
02200 0 0 allow ip from any to me dst-port 7000
02300 0 0 allow ip from any to 192.168.21.101 dst-port 7000
02400 0 0 allow ip from 192.168.21.101 7000 to any
65535 14791 1390454 allow ip from any to any
[root@pcbsd]/usr/local/etc(139)#

На проске серваке крутиться squid с авторизацие по логину и паролю
Где может быть ошибка?
переброс по порту срабатывает если только я в rc.conf
оставляю эти строки
firewall_enable="YES"
firewall_login="YES"
firewall_type="open"
###firewall_script="/usr/local/etc/rc.firewall"
firewall_type="/etc/rc.firewall"
Как только запускаю свой скрипт все работает но кроме переброса по порут

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[Alex Keda]

сделайте через rinetd