Проброс порта, IPFW, Kernel NAT, redirect_port

Настройка сетевых служб, маршрутизации, фаерволлов. Проблемы с сетевым оборудованием.
Правила форума
Убедительная просьба юзать теги [code] при оформлении листингов.
Сообщения не оформленные должным образом имеют все шансы быть незамеченными.
Аватара пользователя
ss25
мл. сержант
Сообщения: 81
Зарегистрирован: 2009-06-18 23:34:09

Проброс порта, IPFW, Kernel NAT, redirect_port

Непрочитанное сообщение ss25 » 2010-03-05 1:01:38

в этой http://forum.lissyara.su/viewtopic.php?f=4&t=24292 теме чот не пошло. По просьбе перезагрузка темы.

И так имеем два сервера с статическими белыми адресами и физически подключены в один свитч и к этому же свичу подключен шлюз провайдера через который оба сервера бегают в сеть.

1 Сервер: Виндовс и закрыт с инета файрволом по понятным причинам.
2 Сервер: Пправильная ОС FreeBSD 7.2 и о нем далее.

Код: Выделить всё

FreeBSD genesis 7.2-RELEASE-p6 FreeBSD 7.2-RELEASE-p6 #0: Mon Feb 22 13:23:53 EET 2010     ss25@genesis:/usr/obj/usr/src/sys/SS25  i386
Хочу сделать проброс порта 3389 с сервера 2 на сервер 1 и закрыть этот порт от посторонних и при необходимости через SSH открывать на время работы

Собсно ядро привожу полный листинг

Код: Выделить всё

#
# GENERIC -- Generic kernel configuration file for FreeBSD/i386
#
# For more information on this file, please read the handbook section on
# Kernel Configuration Files:
#
#    http://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/kernelconfig-config.html
#
# The handbook is also available locally in /usr/share/doc/handbook
# if you've installed the doc distribution, otherwise always see the
# FreeBSD World Wide Web server (http://www.FreeBSD.org/) for the
# latest information.
#
# An exhaustive list of options and more detailed explanations of the
# device lines is also present in the ../../conf/NOTES and NOTES files.
# If you are in doubt as to the purpose or necessity of a line, check first
# in NOTES.
#
# $FreeBSD: src/sys/i386/conf/GENERIC,v 1.474.2.17.2.1 2009/04/15 03:14:26 kensmith Exp $

#cpu            I486_CPU
#cpu            I586_CPU
cpu             I686_CPU
ident           SS25

# To statically compile in device wiring instead of /boot/device.hints
#hints          "GENERIC.hints"         # Default places to look for devices.

makeoptions     DEBUG=-g                # Build kernel with gdb(1) debug symbols

options         SCHED_ULE               # ULE scheduler
options         PREEMPTION              # Enable kernel thread preemption
options         INET                    # InterNETworking
#options        INET6                   # IPv6 communications protocols
options         SCTP                    # Stream Control Transmission Protocol
options         FFS                     # Berkeley Fast Filesystem
options         SOFTUPDATES             # Enable FFS soft updates support
options         UFS_ACL                 # Support for access control lists
options         UFS_DIRHASH             # Improve performance on big directories
options         UFS_GJOURNAL            # Enable gjournal-based UFS journaling
options         MD_ROOT                 # MD is a potential root device
#options        NFSCLIENT               # Network Filesystem Client
#options        NFSSERVER               # Network Filesystem Server
#options        NFSLOCKD                # Network Lock Manager
#options        NFS_ROOT                # NFS usable as /, requires NFSCLIENT
options         MSDOSFS                 # MSDOS Filesystem
options         CD9660                  # ISO 9660 Filesystem
options         PROCFS                  # Process filesystem (requires PSEUDOFS)
options         PSEUDOFS                # Pseudo-filesystem framework
options         GEOM_PART_GPT           # GUID Partition Tables.
options         GEOM_LABEL              # Provides labelization
options         COMPAT_43TTY            # BSD 4.3 TTY compat [KEEP THIS!]
options         COMPAT_FREEBSD4         # Compatible with FreeBSD4
options         COMPAT_FREEBSD5         # Compatible with FreeBSD5
options         COMPAT_FREEBSD6         # Compatible with FreeBSD6
#options        SCSI_DELAY=5000         # Delay (in ms) before probing SCSI
options         KTRACE                  # ktrace(1) support
options         STACK                   # stack(9) support
options         SYSVSHM                 # SYSV-style shared memory
options         SYSVMSG                 # SYSV-style message queues
options         SYSVSEM                 # SYSV-style semaphores
options         _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options         KBD_INSTALL_CDEV        # install a CDEV entry in /dev
options         ADAPTIVE_GIANT          # Giant mutex is adaptive.
options         STOP_NMI                # Stop CPUS using NMI instead of IPI
options         AUDIT                   # Security event auditing
#options        KDTRACE_HOOKS           # Kernel DTrace hooks

options         GEOM_MIRROR

options         SUIDDIR

options         SHMMAXPGS=65536
options         SEMMNI=40
options         SEMMNS=240
options         SEMUME=40
options         SEMMNU=120

options         MAXDSIZ=(1024UL*1024*1024)
options         MAXSSIZ=(128UL*1024*1024)
options         DFLDSIZ=(1024UL*1024*1024)

options         IPFIREWALL
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=5
options         IPFIREWALL_FORWARD
options         IPDIVERT
options         DUMMYNET
options         IPFIREWALL_DEFAULT_TO_ACCEPT

options         IPFIREWALL_NAT
options         LIBALIAS
options         ROUTETABLES=2
options         HZ="1000"


options         NETGRAPH
options         NETGRAPH_ETHER
options         NETGRAPH_SOCKET
options         NETGRAPH_TEE
#options         NETGRAPH_MPPC_ENCRYPTION
#options         NETGRAPH_MPPC_COMPRESSION
options         NETGRAPH_BPF
options         NETGRAPH_IFACE
options         NETGRAPH_KSOCKET
options         NETGRAPH_PPP
options         NETGRAPH_PPTPGRE
options         NETGRAPH_TCPMSS
options         NETGRAPH_VJC
options         NETGRAPH_ONE2MANY
options         NETGRAPH_RFC1490
options         NETGRAPH_TEE
options         NETGRAPH_TTY
options         NETGRAPH_UI








# To make an SMP kernel, the next two lines are needed
options         SMP                     # Symmetric MultiProcessor Kernel
device          apic                    # I/O APIC

# CPU frequency control
device          cpufreq

# Bus support.
device          eisa
device          pci

# Floppy drives
#device         fdc

# ATA and ATAPI devices
device          ata
device          atadisk         # ATA disk drives
device          ataraid         # ATA RAID drives
device          atapicd         # ATAPI CDROM drives
device          atapifd         # ATAPI floppy drives
device          atapist         # ATAPI tape drives
options         ATA_STATIC_ID   # Static device numbering

# SCSI Controllers
#device         ahb             # EISA AHA1742 family
#device         ahc             # AHA2940 and onboard AIC7xxx devices
#options        AHC_REG_PRETTY_PRINT    # Print register bitfields in debug
                                        # output.  Adds ~128k to driver.
#device         ahd             # AHA39320/29320 and onboard AIC79xx devices
#options        AHD_REG_PRETTY_PRINT    # Print register bitfields in debug
                                        # output.  Adds ~215k to driver.
#device         amd             # AMD 53C974 (Tekram DC-390(T))
#device         hptiop          # Highpoint RocketRaid 3xxx series
#device         isp             # Qlogic family
#device         ispfw           # Firmware for QLogic HBAs- normally a module
#device         mpt             # LSI-Logic MPT-Fusion
##device                ncr             # NCR/Symbios Logic
#device         sym             # NCR/Symbios Logic (newer chipsets + those of `ncr')
#device         trm             # Tekram DC395U/UW/F DC315U adapters

#device         adv             # Advansys SCSI adapters
#device         adw             # Advansys wide SCSI adapters
#device         aha             # Adaptec 154x SCSI adapters
#device         aic             # Adaptec 15[012]x SCSI adapters, AIC-6[23]60.
#device         bt              # Buslogic/Mylex MultiMaster SCSI adapters

#device         ncv             # NCR 53C500
#device         nsp             # Workbit Ninja SCSI-3
#device         stg             # TMC 18C30/18C50

# SCSI peripherals
#device         scbus           # SCSI bus (required for SCSI)
#device         ch              # SCSI media changers
#device         da              # Direct Access (disks)
#device         sa              # Sequential Access (tape etc)
#device         cd              # CD
#device         pass            # Passthrough device (direct SCSI access)
#device         ses             # SCSI Environmental Services (and SAF-TE)

# RAID controllers interfaced to the SCSI subsystem
#device         amr             # AMI MegaRAID
#device         arcmsr          # Areca SATA II RAID
#device         asr             # DPT SmartRAID V, VI and Adaptec SCSI RAID
#device         ciss            # Compaq Smart RAID 5*
#device         dpt             # DPT Smartcache III, IV - See NOTES for options
#device         hptmv           # Highpoint RocketRAID 182x
#device         hptrr           # Highpoint RocketRAID 17xx, 22xx, 23xx, 25xx
#device         iir             # Intel Integrated RAID
#device         ips             # IBM (Adaptec) ServeRAID
#device         mly             # Mylex AcceleRAID/eXtremeRAID
#device         twa             # 3ware 9000 series PATA/SATA RAID

# RAID controllers
#device         aac             # Adaptec FSA RAID
#device         aacp            # SCSI passthrough for aac (requires CAM)
#device         ida             # Compaq Smart RAID
#device         mfi             # LSI MegaRAID SAS
#device         mlx             # Mylex DAC960 family
#device         pst             # Promise Supertrak SX6000
#device         twe             # 3ware ATA RAID

# atkbdc0 controls both the keyboard and the PS/2 mouse
device          atkbdc          # AT keyboard controller
device          atkbd           # AT keyboard
#device         psm             # PS/2 mouse

device          kbdmux          # keyboard multiplexer

device          vga             # VGA video card driver

device          splash          # Splash screen and screen saver support

# syscons is the default console driver, resembling an SCO console
device          sc

device          agp             # support several AGP chipsets

# Power management support (see NOTES for more options)
#device         apm
# Add suspend/resume support for the i8254.
device          pmtimer

# PCCARD (PCMCIA) support
# PCMCIA and cardbus bridge support
#device         cbb             # cardbus (yenta) bridge
#device         pccard          # PC Card (16-bit) bus
#device         cardbus         # CardBus (32-bit) bus

# Serial (COM) ports
device          sio             # 8250, 16[45]50 based serial ports
device          uart            # Generic UART driver

# Parallel port
#device         ppc
#device         ppbus           # Parallel port bus (required)
#device         lpt             # Printer
#device         plip            # TCP/IP over parallel
#device         ppi             # Parallel port interface device
##device                vpo             # Requires scbus and da

# If you've got a "dumb" serial or parallel PCI card that is
# supported by the puc(4) glue driver, uncomment the following
# line to enable it (connects to sio, uart and/or ppc drivers):
#device         puc

# PCI Ethernet NICs.
#device         de              # DEC/Intel DC21x4x (``Tulip'')
#device         em              # Intel PRO/1000 Gigabit Ethernet Family
#device         igb             # Intel PRO/1000 PCIE Server Gigabit Family
#device         ixgb            # Intel PRO/10GbE Ethernet Card
#device         le              # AMD Am7900 LANCE and Am79C9xx PCnet
#device         txp             # 3Com 3cR990 (``Typhoon'')
#device         vx              # 3Com 3c590, 3c595 (``Vortex'')

# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device          miibus          # MII bus support
#device         age             # Attansic/Atheros L1 Gigabit Ethernet
#device         ale             # Atheros AR8121/AR8113/AR8114 Ethernet
#device         bce             # Broadcom BCM5706/BCM5708 Gigabit Ethernet
#device         bfe             # Broadcom BCM440x 10/100 Ethernet
#device         bge             # Broadcom BCM570xx Gigabit Ethernet
#device         dc              # DEC/Intel 21143 and various workalikes
#device         et              # Agere ET1310 10/100/Gigabit Ethernet
device          fxp             # Intel EtherExpress PRO/100B (82557, 82558)
#device         jme             # JMicron JMC250 Gigabit/JMC260 Fast Ethernet
#device         lge             # Level 1 LXT1001 gigabit Ethernet
#device         msk             # Marvell/SysKonnect Yukon II Gigabit Ethernet
#device         nfe             # nVidia nForce MCP on-board Ethernet
#device         nge             # NatSemi DP83820 gigabit Ethernet
##device                nve             # nVidia nForce MCP on-board Ethernet Networking
#device         pcn             # AMD Am79C97x PCI 10/100 (precedence over 'le')
device          re              # RealTek 8139C+/8169/8169S/8110S
device          rl              # RealTek 8129/8139
#device         sf              # Adaptec AIC-6915 (``Starfire'')
#device         sis             # Silicon Integrated Systems SiS 900/SiS 7016
#device         sk              # SysKonnect SK-984x & SK-982x gigabit Ethernet
#device         ste             # Sundance ST201 (D-Link DFE-550TX)
#device         stge            # Sundance/Tamarack TC9021 gigabit Ethernet
#device         ti              # Alteon Networks Tigon I/II gigabit Ethernet
#device         tl              # Texas Instruments ThunderLAN
#device         tx              # SMC EtherPower II (83c170 ``EPIC'')
#device         vge             # VIA VT612x gigabit Ethernet
#device         vr              # VIA Rhine, Rhine II
#device         wb              # Winbond W89C840F
#device         xl              # 3Com 3c90x (``Boomerang'', ``Cyclone'')

# ISA Ethernet NICs.  pccard NICs included.
#device         cs              # Crystal Semiconductor CS89x0 NIC
# 'device ed' requires 'device miibus'
#device         ed              # NE[12]000, SMC Ultra, 3c503, DS8390 cards
#device         ex              # Intel EtherExpress Pro/10 and Pro/10+
#device         ep              # Etherlink III based cards
#device         fe              # Fujitsu MB8696x based cards
#device         ie              # EtherExpress 8/16, 3C507, StarLAN 10 etc.
#device         sn              # SMC's 9000 series of Ethernet chips
#device         xe              # Xircom pccard Ethernet

# Wireless NIC cards
#device         wlan            # 802.11 support
#device         wlan_wep        # 802.11 WEP support
#device         wlan_ccmp       # 802.11 CCMP support
#device         wlan_tkip       # 802.11 TKIP support
#device         wlan_amrr       # AMRR transmit rate control algorithm
#device         wlan_scan_ap    # 802.11 AP mode scanning
#device         wlan_scan_sta   # 802.11 STA mode scanning
#device         an              # Aironet 4500/4800 802.11 wireless NICs.
#device         ath             # Atheros pci/cardbus NIC's
#device         ath_hal         # Atheros HAL (Hardware Access Layer)
#options                AH_SUPPORT_AR5416       # enable AR5416 tx/rx descriptors
#device         ath_rate_sample # SampleRate tx rate control for ath
#device         awi             # BayStack 660 and others
#device         ral             # Ralink Technology RT2500 wireless NICs.
#device         wi              # WaveLAN/Intersil/Symbol 802.11 wireless NICs.
##device                wl              # Older non 802.11 Wavelan wireless NIC.

# Pseudo devices.
device          loop            # Network loopback
device          random          # Entropy device
device          ether           # Ethernet support
device          sl              # Kernel SLIP
device          ppp             # Kernel PPP
device          tun             # Packet tunnel.
device          pty             # Pseudo-ttys (telnet etc)
device          md              # Memory "disks"
#device         gif             # IPv6 and IPv4 tunneling
#device         faith           # IPv6-to-IPv4 relaying (translation)
device          firmware        # firmware assist module

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
# Note that 'bpf' is required for DHCP.
device          bpf             # Berkeley packet filter

# USB support
device          uhci            # UHCI PCI->USB interface
device          ohci            # OHCI PCI->USB interface
device          ehci            # EHCI PCI->USB interface (USB 2.0)
device          usb             # USB Bus (required)
#device         udbp            # USB Double Bulk Pipe devices
device          ugen            # Generic
device          uhid            # "Human Interface Devices"
device          ukbd            # Keyboard
#device         ulpt            # Printer
#device         umass           # Disks/Mass storage - Requires scbus and da
#device         ums             # Mouse
#device         ural            # Ralink Technology RT2500USB wireless NICs
#device         rum             # Ralink Technology RT2501USB wireless NICs
#device         urio            # Diamond Rio 500 MP3 player
#device         uscanner        # Scanners
# USB Serial devices
#device         ucom            # Generic com ttys
#device         uark            # Technologies ARK3116 based serial adapters
#device         ubsa            # Belkin F5U103 and compatible serial adapters
#device         ubser           # BWCT console serial adapters
#device         uftdi           # For FTDI usb serial adapters
#device         uipaq           # Some WinCE based devices
#device         uplcom          # Prolific PL-2303 serial adapters
#device         uslcom          # SI Labs CP2101/CP2102 serial adapters
#device         uvisor          # Visor and Palm devices
#device         uvscom          # USB serial support for DDI pocket's PHS
# USB Ethernet, requires miibus
#device         aue             # ADMtek USB Ethernet
#device         axe             # ASIX Electronics USB Ethernet
#device         cdce            # Generic USB over Ethernet
#device         cue             # CATC USB Ethernet
#device         kue             # Kawasaki LSI USB Ethernet
#device         rue             # RealTek RTL8150 USB Ethernet

# FireWire support
#device         firewire        # FireWire bus code
#device         sbp             # SCSI over FireWire (Requires scbus and da)
#device         fwe             # Ethernet over FireWire (non-standard!)
#device         fwip            # IP over FireWire (RFC 2734,3146)
#device         dcons           # Dumb console driver
#device         dcons_crom      # Configuration ROM for dcons
и правила файрфола

Код: Выделить всё

#!/bin/sh

FwCMD="/sbin/ipfw"
LanOut="re0"

IpOut="ИП Сервера 2"
IpWin="ИП Сервера 1"
IpHom="Моя домашняя Ипишка"

${FwCMD} -f flush

${FwCMD} add check-state

${FwCMD} add allow ip from any to any via lo0

${FwCMD} add deny ip from any to 127.0.0.0/8
${FwCMD} add deny ip from 127.0.0.0/8 to any

${FwCMD} -f table 0 flush
${FwCMD} add deny not icmp from "table(0)" to me

${FwCMD} add deny ip from any to 10.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 172.16.0.0/12 in via ${LanOut}
${FwCMD} add deny ip from any to 192.168.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 0.0.0.0/8 in via ${LanOut}

${FwCMD} add deny ip from any to 169.254.0.0/16 in via ${LanOut}

${FwCMD} add deny ip from any to 240.0.0.0/4 in via ${LanOut}

${FwCMD} add deny icmp from any to any frag

${FwCMD} add deny log icmp from any to 255.255.255.255 in via ${LanOut}
${FwCMD} add deny log icmp from any to 255.255.255.255 out via ${LanOut}

${FwCMD} add deny ip from 10.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 172.16.0.0/12 to any out via ${LanOut}

${FwCMD} add deny ip from 192.168.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 0.0.0.0/8 to any out via ${LanOut}

${FwCMD} add deny ip from 169.254.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 224.0.0.0/4 to any out via ${LanOut}

${FwCMD} add allow tcp from any to any established
${FwCMD} add allow ip from ${IpOut} to any out xmit ${LanOut}

${FwCMD} add allow udp from any 53 to any via ${LanOut}
#${FwCMD} add allow udp from any to any 53 via ${LanOut}
${FwCMD} add allow udp from any to any 123 via ${LanOut}

#${FwCMD} add allow tcp from any to ${IpOut} 20 via ${LanOut}
#${FwCMD} add allow tcp from any to ${IpOut} 21 via ${LanOut}
#${FwCMD} add allow tcp from any to ${IpOut} 49152-65535 via ${LanOut}

${FwCMD} add allow icmp from any to any icmptypes 0,8,11

${FwCMD} add allow tcp from any to ${IpOut} 80 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 25 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut} 22 via ${LanOut}
#${FwCMD} add allow tcp from any to ${IpOut} 143 via ${LanOut}
#${FwCMD} add allow tcp from any to ${IpOut} 110 via ${LanOut}
#${FwCMD} add allow tcp from any to ${IpOut} 3389 via ${LanOut}

# VPN тунель в другой город инет по нему не ходит
${FwCMD} add allow gre from 212.111.ххх.ххх to ${IpOut} via ${LanOut}
${FwCMD} add allow gre from ${IpOut} to 212.111.ххх.ххх via ${LanOut}

${FwCMD} add allow ip from ${IpWin} to ${IpOut} via ${LanOut}
${FwCMD} add allow ip from ${IpOut} to ${IpWin} via ${LanOut}

${FwCMD} add allow ip from ${IpHom} to ${IpOut} via ${LanOut}
${FwCMD} add allow ip from ${IpOut} to ${IpHom} via ${LanOut}

${FwCMD} nat 1 config log if ${LanOut} redirect_port tcp ${IpWin}:3389 3389
${FwCMD} add nat 1 ip from any to any via ${LanOut}

${FwCMD} add deny ip from any to any

в самой простой конфигурации

Код: Выделить всё

${FwCMD} nat 1 config log if ${LanOut} redirect_port tcp ${IpWin}:3389 3389
${FwCMD} add nat 1 ip from any to any via ${LanOut}
Проброс работает но тогда можно все всем.
Начинаю мутить с правилами перестает работать проброс

Хостинговая компания Host-Food.ru
Хостинг HostFood.ru
 

Услуги хостинговой компании Host-Food.ru

Хостинг HostFood.ru

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2460 рублей (8 CPU, 8Gb RAM, 2x500Gb HDD, RAID 3ware 9750):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

Аватара пользователя
vadim64
майор
Сообщения: 2098
Зарегистрирован: 2009-09-17 15:15:26
Откуда: Засратовец

Re: Проброс порта, IPFW, Kernel NAT, redirect_port

Непрочитанное сообщение vadim64 » 2010-03-05 15:17:33

В чём выражается то, что вы понимаете под "можно всё всем"???
Люди не делятся на национальности, партии, фракции и религии. Люди делятся на умных и дураков, а вот дураки делятся на национальности, партии, фракции и религии.