Код: Выделить всё
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100
options IPFIREWALL_NAT
options LIBALIAS
options ROUTETABLES=2
options DUMMYNET
options HZ="1000"
Код: Выделить всё
firewall_nat_enable="YES"
firewall_nat_interface="внешняя сетевая"
Код: Выделить всё
ipfw add 1 allow log ip from any to any
Код: Выделить всё
ipfw: 1 Accept TCP 91.193.70.161:49323 10.0.1.2:1723 in via xl0
ipfw: 1 Accept TCP 10.0.1.2:1723 91.193.70.161:49323 out via xl0
Код: Выделить всё
$fwcmd add 6100 allow tcp from any to $extip 1723 in via $extif setup
$fwcmd add 6110 allow tcp from $extip 1723 to any out via $extif setup
Код: Выделить всё
$fwcmd add 1600 deny ip from 0.0.0.0/8 to any in via $extif
#----allow all lo0 traffic----------------------
$fwcmd add 1000 allow ip from any to any via lo0
#----deny loopback-----------------------------
$fwcmd add 1100 deny ip from any to 127.0.0.0/8
$fwcmd add 1200 deny ip from 127.0.0.0/8 to any
#----NAT---------------------------------------------
ipfw nat 1 config log if xl0 reset same_ports deny_in
$fwcmd add 3000 nat 1 ip4 from any to any via $extif
#---check-state------------
$fwcmd add 3900 check-state
#---allow all LAN traffic----------------------------------
$fwcmd add 4200 allow ip from any to $intnet in via $intif
$fwcmd add 4300 allow ip from $intnet to any out via $intif
#----allow all established tcp connections-----------
$fwcmd add 4400 allow tcp from any to any established
#----allow SSH-------------------------------------------------------------------------
$fwcmd add 5000 allow tcp from any to $extip 35665 in via $extif setup limit src-addr 4
#----allow port 1723 (for mpd5 clients)------------------------------------------------
$fwcmd add 6100 allow tcp from any to $extip 1723 in via $extif setup
$fwcmd add 6110 allow tcp from $extip 1723 to any out via $extif setup
#----allow GRE traffic for mpd5-----------
$fwcmd add 6200 allow gre from any to any
#----block other established tcp connections----------------------
${fwcmd} add 6600 deny tcp from any to $extip in via $extif setup
#----allow established tcp connections from ext IP to ext interface-----------
${fwcmd} add 6700 allow tcp from $extip to any out via $extif setup keep-state
${fwcmd} add 6800 allow tcp from any to $extip in via $intif setup