На ем работает NAT и Squid.
Мне нужно вырубить нат и по возможности включить его отдельным личностям.
Сетка 192.168.0.1 255.255.255.0
Вот конфиг собственно.
Укажите пальцем неучу что закаментить нада....
Код: Выделить всё
Правила фаервола.
# Macros
ext_if="tun0"
int_if="nfe0"
tcp_services = "{ ftp, ssh, smtp, domain, http, 4899}"
#tcp_services = "{ ssh, smtp, domain, http, pop3 }"
icmp_types = "echoreq"
# Tables
table <rfc1918> const { 127.0.0.0/8, 10.0.0.0/8, 172.168.0.0/12 \
192.168.0.0/16 }
table <dsua03> const { 0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24 \
224.0.0.0/4, 240.0.0.0/4 }
#
# Options
#
#
# Normalization
#
scrub in all
#
# Queueing
#
#DATA-SERVER ReAdmin
#rdr on $ext_if proto { tcp udp } from 194.63.140.22 to 62.80.169.25 port 4899 -> 192.168.0.70
port 4899
#rdr pass on $ext_if proto tcp from 194.63.140.22 to 62.80.169.25 port 4899 -> 192.168.0.70
#
# Translation
#
#nat on $ext_if from 192.168.0.0/16 to 62.149.28.34 port 3306 -> $ext_if
nat on $ext_if from 192.168.0.0/16 to 62.149.28.34 port 3307 -> $ext_if
nat on $ext_if from 192.168.0.0/16 to 62.149.28.10 port 21 -> $ext_if
nat on $ext_if from 192.168.0.0/16 to 62.149.28.10 port 22 -> $ext_if
nat on $ext_if from 192.168.0.0/16 to 62.149.28.10 port 3306 -> $ext_if
#
#
#nat on $ext_if from 192.168.0.0/24 to any port 25 -> $ext_if
#nat on $ext_if from 192.168.0.0/24 to 62.80.160.182 port 25 -> $ext_if
nat on $ext_if from 192.168.0.0/24 to 62.149.9.49 port 21 -> $ext_if
nat on $ext_if from 192.168.0.0/24 to 62.149.9.49 port 22 -> $ext_if
#nat on $ext_if from 192.168.0.0/24 to any port 110 -> $ext_if
#
#
#NAT to ME
nat on $ext_if from 192.168.0.70/32 to any -> $ext_if
nat on $ext_if from 192.168.0.11/32 to any -> $ext_if
#NAT for Client bank
nat on $ext_if from 192.168.0.17/32 to 213.156.66.66 port 10080 -> $ext_if
nat on $ext_if from 192.168.0.17/32 to 193.200.190.17 port 80 -> $ext_if
nat on $ext_if from 192.168.0.99/32 to 213.156.66.66 port 10080 -> $ext_if
nat on $ext_if from 192.168.0.99/32 to 193.41.49.69 port 2031 -> $ext_if
nat on $ext_if from 192.168.0.99/32 to 193.200.190.17 port 80 -> $ext_if
#Port 110 for E-Mail
nat on $ext_if from 192.168.0.0/24 to any port 110 -> $ext_if
#Server time
nat on $ext_if from 192.43.244.18 to 192.168.0.0/24 -> $ext_if
nat on $ext_if from 192.168.0.0/24 to 192.43.244.18 -> $ext_if
#
# Rules
#
# setup a default deny all policy
block drop log all
# pass traffic on the loopback interface in either direction
pass quick on lo0 all
pass quick on ng0 all
#pass in quick on $ext_if proto { tcp udp } from any to 192.168.0.0/24 port 4899 keep state
#MPD4
pass quick on $ext_if from any to 193.201.81.10 keep state
pass quick on $ext_if proto { tcp udp } from any to 192.168.0.0/24 port 4899 keep state
block drop in quick on $ext_if from <rfc1918> to any
block drop in quick on $ext_if from <dsua03> to any
block drop in quick on $ext_if from 83.149.80.111 to any
block drop out quick on $ext_if from any to 83.149.80.111
block drop in quick on $ext_if from 87.255.33.0/24 to any
block drop out quick on $ext_if from any to 87.255.33.0/24
block drop in quick on $ext_if from 195.122.131.0/24 to any
block drop out quick on $ext_if from any to 195.122.131.0/24
block drop in quick on $ext_if from 195.203.36.201 to any
block drop out quick on $ext_if from any to 195.203.36.201
block drop in quick on $ext_if from 212.68.137.188 to any
block drop out quick on $ext_if from any to 212.68.137.188
block drop in quick on $ext_if from 193.203.36.201 to any
block drop out quick on $ext_if from any to 193.203.36.201
block drop in quick on $ext_if from 83.222.11.79 to any
block drop out quick on $ext_if from any to 83.222.11.79
block drop out quick on $ext_if from any to <rfc1918>
block drop out quick on $ext_if from any to <dsua03>
#rADMIN
#pass out quick on $ext_if inet proto tcp from 194.63.140.22 to any keep state
#pass in quick on $int_if inet proto tcp from 192.168.0.253 ext_if keep state
pass in quick on $ext_if inet proto tcp from any to $ext_if \
port $tcp_services flags S/SA keep state
pass in quick on $ext_if inet proto udp from any to $ext_if \
port = domain keep state
pass in quick inet proto icmp all icmp-type $icmp_types keep state
pass in quick on $int_if inet from $int_if:network to any keep state
pass out quick on $int_if inet from any to $int_if:network keep state
pass out on $ext_if proto tcp all flags S/SA modulate state
pass out on $ext_if proto { udp, icmp } all keep state