forum.lissyara.su

Код: Выделить всё

defaultrouter="10.213.8.1"
hostname="server1"
inetd_enable="YES"
ifconfig_fxp0="dhcp"
ifconfig_nfe0="inet 192.168.1.1 netmask 255.255.255.0"
sshd_enable="YES"

firewall_enable="YES"	
firewall_nat_enable="YES"
firewall_script="/etc/firewall.script"	
gateway_enable="YES"	
firewall_nat_interface="fxp0"

Код: Выделить всё

#!/bin/sh

fwcmd="ipfw -q" 	#command ipfw 
LanIf="nfe0"		#Interface LAN
LanNet="192.168.0.0/16"		#LAN IP
LanIp=`ifconfig nfe0 | grep inet | awk '{print $2}'`
WanIf="fxp0"	#Interface WAN
WanIp=`ifconfig fxp0 | grep inet | awk '{print $2}'`

ipfw -q -f flush		

${fwcmd} add 200 check-state	
${fwcmd} add 300 allow all from any to me via ${LanIf} keep-state
${fwcmd} add 400  allow tcp from ${LanNet} to me 22 in via ${LanIf} keep-state

#NAT
${fwcmd} nat 1 config log if ${WanIf} reset same_ports
${fwcmd} add 500 nat 1 ip from ${LanNet} to any
${fwcmd} add 600 nat 1 ip from any to any via ${WanIf}  

${fwcmd} add 700 allow all from any to any

${fwcmd} add deny ip from any to any

Код: Выделить всё

synchronous_dhclient="YES" 

Код: Выделить всё

man чего-то-там

Код: Выделить всё

allow ip from any to any

Код: Выделить всё

00200 check-state
00300 allow ip from any to me via nfe0 keep-state
00400 allow tcp from 192.168.0.0/16 to me dst-port 22 in via nfe0 keep-state
00600 nat 2 ip from any to any via ng0
00700 allow ip from any to any
65535 deny ip from any to any

Код: Выделить всё

${fwcmd} add 500 check-state
${fwcmd} add 600 allow all from me to any out via ${LanIf} keep-state
${fwcmd} add 700 allow tcp from ${LanNet} to me 22 in via ${LanIf}

${fwcmd} add 800 deny all from ${LanNet} to me in via ${LanIf}
${fwcmd} add 900 allow all from ${LanNet} to any in via ${LanIf}

${fwcmd} nat 1 config log if ${WanIf} reset same_ports deny_in
${fwcmd} add 1000 nat 1 ip from any to any via ${WanIf} 

${fwcmd} add 2000 deny ip from any to any

Код: Выделить всё

${fwcmd} add 2000 deny ip from any to any

Код: Выделить всё

${fwcmd} add 2000 allow ip from any to any

Код: Выделить всё

FreeBSD server1 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Sun Mar  6 11:44:03 UTC 2011     root@server1:/usr/obj/usr/src/sys/SERVERKERN  i386

Код: Выделить всё

	case IP_FW_NGTEE:
	case IP_FW_NETGRAPH:
		if (ng_ipfw_input_p == NULL) {
			ret = EACCES;
			break; /* i.e. drop */
		}
		ret = ng_ipfw_input_p(m0, dir, &args,
			(ipfw == IP_FW_NGTEE) ? 1 : 0);
		if (ipfw == IP_FW_NGTEE) /* ignore errors for NGTEE */
			goto again;	/* continue with packet */
		break;

	case IP_FW_NAT:
		/* honor one-pass in case of successful nat */
		if (V_fw_one_pass)
			break; /* ret is already 0 */
		goto again;

	case IP_FW_REASS:
		goto again;		/* continue with packet */
	
	default:
		KASSERT(0, ("%s: unknown retval", __func__));
	}

	if (ret != 0) {
		if (*m0)
			FREE_PKT(*m0);
		*m0 = NULL;
	}
	if (*m0 && mtod(*m0, struct ip *)->ip_v == 4)
		SET_HOST_IPLEN(mtod(*m0, struct ip *));
	return ret;
}