Есть шлюз на фре, используется IPFW+SQUID для раздачи инета юзерам. На одной из машин в локалке установлен VPN-клиент, связывающийся с внешним VPN-сервером (используют нестандартный порт 1194). Пытаюсь перебросить порт, но клиент упорно не хочет соединяться с сервером. Вот мой основной конфиг (без правил переброса vpn):
Код: Выделить всё
#!/bin/sh
IPFW="/sbin/ipfw"
EXT="fxp0"
EXT_IP="xxx.xxx.xxx.xxx"
INT="rl0"
INT_IP="192.168.0.1"
LAN="192.168.0.0"
LAN_MSK="24"
${IPFW} -f flush
${IPFW} -f pipe flush
${IPFW} -f queue flush
${IPFW} add check-state
${IPFW} add allow ip from any to any via lo0
${IPFW} add deny ip from any to 127.0.0.0/8
${IPFW} add deny ip from 127.0.0.0/8 to any
${IPFW} add deny ip from any to 10.0.0.0/8 in via ${EXT}
${IPFW} add deny ip from any to 172.16.0.0/12 in via ${EXT}
${IPFW} add deny ip from any to 192.168.0.0/16 in via ${EXT}
${IPFW} add deny ip from any to 0.0.0.0/8 in via ${EXT}
${IPFW} add deny ip from any to 169.254.0.0/16 in via ${EXT}
${IPFW} add deny ip from any to 240.0.0.0/4 in via ${EXT}
${IPFW} add deny icmp from any to any frag
${IPFW} add deny log icmp from any to 255.255.255.255 in via ${EXT}
${IPFW} add deny log icmp from any to 255.255.255.255 out via ${EXT}
${IPFW} add fwd 127.0.0.1,8080 tcp from ${LAN}/${LAN_MSK} to any 80,443,21 via ${EXT}
${IPFW} add divert natd ip from ${LAN}/${LAN_MSK} to any out via ${EXT}
${IPFW} add divert natd ip from any to ${EXT_IP} in via ${EXT}
${IPFW} add deny ip from 10.0.0.0/8 to any out via ${EXT}
${IPFW} add deny ip from 172.16.0.0/12 to any out via ${EXT}
${IPFW} add deny ip from 192.168.0.0/16 to any out via ${EXT}
${IPFW} add deny ip from 0.0.0.0/8 to any out via ${EXT}
${IPFW} add deny ip from 169.254.0.0/16 to any out via ${EXT}
${IPFW} add deny ip from 224.0.0.0/4 to any out via ${EXT}
${IPFW} add deny ip from 240.0.0.0/4 to any out via ${EXT}
${IPFW} add allow tcp from any to any established
${IPFW} add allow udp from any 53 to any via ${EXT}
${IPFW} add allow udp from any to any 53 via ${EXT}
${IPFW} add allow udp from any to any 123 via ${EXT}
${IPFW} add allow icmp from any to any icmptypes 0,8,11
#${IPFW} add allow tcp from any to ${EXT_IP} 80 via ${EXT}
#${IPFW} add allow tcp from any to ${EXT_IP} 25 via ${EXT}
${IPFW} add allow tcp from any to ${EXT_IP} 22 via ${EXT}
#${IPFW} add allow tcp from any to ${EXT_IP} 143 via ${EXT}
#${IPFW} add allow tcp from any to ${EXT_IP} 110 via ${EXT}
${IPFW} add allow tcp from ${LAN}/${LAN_MSK} to any 5190 in via ${EXT} setup
${IPFW} add allow ip from ${EXT_IP} to 85.115.192.0/19 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 212.112.96.0/19 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 195.38.160.0/19 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 91.207.96.0/24 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 91.207.97.0/24 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 194.176.111.0/24 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 85.26.220.0/22 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 212.2.224.0/19 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 81.20.16.0/20 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 212.42.96.0/19 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 77.95.56.0/21 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 94.143.192.0/21 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 212.241.0.0/19 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 213.145.128.0/19 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 85.113.0.0/19 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 89.237.192.0/18 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 77.235.0.0/19 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 92.245.96.0/19 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 194.152.36.0/24 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 194.152.37.0/24 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 91.205.48.0/22 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 95.215.244.0/22 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 217.29.16.0/20 out xmit ${EXT}
${IPFW} add allow ip from ${EXT_IP} to 81.88.192.0/20 out xmit ${EXT}
${IPFW} add allow tcp from any to any via ${INT}
${IPFW} add allow udp from any to any via ${INT}
${IPFW} add allow icmp from any to any via ${INT}
${IPFW} add deny ip from any to anyПытался дополнить его следующими правилами:
Код: Выделить всё
${IPFW} add allow all from any to any 1194 via ${EXT}Код: Выделить всё
${IPFW} add allow ip from ${EXT_IP} to zzz.zzz.zzz.zzz out xmit ${EXT}
${IPFW} add allow ip from zzz.zzz.zzz.zzz to ${EXT_IP} in xmit ${EXT}Код: Выделить всё
${IPFW} add allow all from ${LAN}/${LAN_MSK} to any 1194 in via ${EXT} setup
${IPFW} add allow all from any to ${LAN}/${LAN_MSK} 1194 in via ${EXT} setupЧто я сделал не так?
