forum.lissyara.su

Код: Выделить всё

mail# cat /etc/ppp/ppp.conf

default:
    set log Phase Chat LCP IPCP CCP tun command
    #set ifaddr 10.0.0.1/0 10.0.0.2/0
optima:
# device:
    set authname ******
    set authkey *****
    set device PPPoE:rl2
    enable lqr
    accept lqr
    enable mssfixup
    set mtu max 1492
    set mru max 1492
    set lqrperiod 5
    #set cd off
    set cd 5
    set crtscts off
    set reconnect 30 0

    #set dial
    set login
    disable ipv6cp
    disable deflate
    disable pred1
    disable vjcomp
    disable acfcomp
    disable protocomp

    add default HISADDR

    nat enable yes

    nat log yes

Код: Выделить всё

mail# cat /etc/rc.conf
# -- sysinstall generated deltas -- # Sat Oct 22 15:28:26 2005
# Created: Sat Oct 22 15:28:26 2005
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
defaultrouter="*212.42.*.*"
gateway_enable="YES"
hostname="mail.domen.com.ua"
ifconfig_rl1="inet 212.42.*.*  netmask 255.255.255.252"
ifconfig_rl0="inet 10.0.100.1  netmask 255.255.255.0"
sendmail_enable="NONE"
inetd_enable="YES"
named_enable="YES"
sshd_enable="YES"
usbd_enable="YES"
pf_enable="YES"

#firewall_type="Open"
exim_enable="YES"
squid_enable="YES"
dhcp_enable="YES"
#cyrus_enable="YES"
apache2_enable="YES"
mysql_enable="YES"
postgresql_enable="YES"

############################
#ppp_enable="YES"
#ppp_profile="optima"
#ppp_mode="ddial"
#ppp_nat="YES"
#############################

Код: Выделить всё

mail# cat test.sh
#!/bin/sh
sleep 15
ppp -ddial optima # звоню в оптиму
sleep 90
ifconfig >> /root/ifconfig.log  - снимаю ифконфиг
sleep 5
netstat -rn >> /root/netstat_rn.log - смотрю маршруты
sleep 5
/etc/rc.d/pf stop - вырубаю файервол - хрен его знает может он дает достучатся к серверу по новому айпи
sleep 10
ps ax | grep pf >>/root/pf_proc.log  - проверяю наличие пф в памяти
sleep 10
/etc/rc.d/sshd restart - на всякий перегружаю ссху
sleep 30
sockstat | grep 22 >>/root/sockstat.log - смотрю что творится 
sleep 200
shutdown -r now - ну и ребутаю дабы вернулся старый линк - так как по новому к серверу не достучатся..

Код: Выделить всё

mail# cat ifconfig.log
rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=8<VLAN_MTU>
        inet 10.0.100.1 netmask 0xffffff00 broadcast 10.0.100.255
        inet6 fe80::202:44ff:fe47:a78e%rl0 prefixlen 64 scopeid 0x1
        ether 00:02:44:47:a7:8e
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
rl1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=8<VLAN_MTU>
        inet 212.42.*.* netmask 0xfffffffc broadcast 212.42.95.255
        inet6 fe80::2e0:7dff:fee6:939e%rl1 prefixlen 64 scopeid 0x2
        ether 00:e0:7d:e6:93:9e
        media: Ethernet autoselect (10baseT/UTP <full-duplex>)
        status: active
rl2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=8<VLAN_MTU>
        inet6 fe80::250:fcff:fe9a:31bf%rl2 prefixlen 64 scopeid 0x3
        ether 00:50:fc:9a:31:bf
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
pflog0: flags=0<> mtu 33208
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1492
        inet 93.127.53.230 --> 213.227.192.184 netmask 0xffffffff
        Opened by PID 12922

Код: Выделить всё

inet 93.127.53.230 --> 213.227.192.184 netmask 0xffffffff

Код: Выделить всё

mail# cat netstat_rn.log
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            213.227.192.184    UGS         0   352676   tun0
10.0.100/24        link#1             UC          0        0    rl0
10.0.100.37        00:18:de:88:32:42  UHLW        0    32114    rl0    999
10.0.100.49        00:0d:61:60:05:73  UHLW        0    12057    rl0    885
10.0.100.96        00:19:d2:c4:13:70  UHLW        0    74058    rl0    967
10.0.100.101       00:1d:92:3d:c6:fe  UHLW        0    27336    rl0   1108
10.0.100.107       00:1c:c0:02:e0:cf  UHLW        0     9036    rl0    988
10.0.100.113       00:1f:c6:a9:2f:b0  UHLW        0     6799    rl0   1134
10.0.100.116       00:90:96:82:1c:9f  UHLW        0    22084    rl0    989
10.0.100.122       00:1d:60:8b:6f:07  UHLW        0        5    rl0    749
10.0.100.127       00:17:31:60:aa:b7  UHLW        0     5928    rl0   1162
10.0.100.139       00:15:58:94:ba:fe  UHLW        0     8264    rl0   1125
10.0.100.145       00:21:6b:28:e2:86  UHLW        0    13613    rl0   1160
10.0.100.156       00:04:61:a1:f0:f6  UHLW        0    17791    rl0    981
10.0.100.162       00:1b:9e:83:d6:c3  UHLW        0    31397    rl0   1163
10.0.100.165       00:08:a1:72:a8:6a  UHLW        0      336    rl0   1162
10.0.100.168       00:11:95:e9:c7:28  UHLW        0     9375    rl0   1146
127.0.0.1          127.0.0.1          UH          0      217    lo0
212.42.95.252/30   link#2             UC          0        0    rl1
212.42.95.253      00:0b:5f:f8:d5:e0  UHLW        0        0    rl1
212.42.95.254      00:e0:7d:e6:93:9e  UHLW        0       15    lo0
213.227.192.184    93.127.53.230      UH          1        0   tun0

Internet6:
Destination                       Gateway                       Flags      Netif Expire
::1                               ::1                           UH          lo0
fe80::%rl0/64                     link#1                        UC          rl0
fe80::202:44ff:fe47:a78e%rl0      00:02:44:47:a7:8e             UHL         lo0
fe80::%rl1/64                     link#2                        UC          rl1
fe80::2e0:7dff:fee6:939e%rl1      00:e0:7d:e6:93:9e             UHL         lo0
fe80::%rl2/64                     link#3                        UC          rl2
fe80::250:fcff:fe9a:31bf%rl2      00:50:fc:9a:31:bf             UHL         lo0
fe80::%lo0/64                     fe80::1%lo0                   U           lo0
fe80::1%lo0                       link#5                        UHL         lo0
ff01::/32                         ::1                           U           lo0
ff02::%rl0/32                     link#1                        UC          rl0
ff02::%rl1/32                     link#2                        UC          rl1
ff02::%rl2/32                     link#3                        UC          rl2
ff02::%lo0/32                     ::1                           UC          lo0
ff02::%tun0/32                    fe80::202:44ff:fe47:a78e%tun0 UC         tun0

Код: Выделить всё

mail# cat sockstat.log
root     sshd       12980 3  tcp4   *:22                  *:*
root     ppp        12922 7  dgram  -> /var/run/logpriv
root     sshd       11442 4  tcp4   212.42.95.254:22      77.90.250.118:49595
squid    squid      543   20 tcp4   10.0.100.1:3128       10.0.100.162:52225
squid    squid      543   22 tcp4   10.0.100.1:3128       10.0.100.37:1175
squid    squid      543   26 tcp4   93.127.53.230:53249   83.237.28.122:443
squid    squid      543   27 tcp4   93.127.53.230:53223   94.100.182.54:443
squid    squid      543   30 tcp4   10.0.100.1:3128       10.0.100.162:52229
squid    squid      543   35 tcp4   10.0.100.1:3128       10.0.100.116:1722
squid    squid      543   44 tcp4   212.42.95.254:49757   205.188.8.228:443
squid    squid      543   90 tcp4   212.42.95.254:54521   84.113.220.200:443
bind     named      292   22 udp4   *:57387               *:*

Код: Выделить всё

Подключение по локальной сети - Ethernet адаптер:

        DNS-суффикс этого подключения . . :
        Описание  . . . . . . . . . . . . : NVIDIA nForce Networking Controller
        Физический адрес. . . . . . . . . : 00-04-61-A1-F0-F6
        Dhcp включен. . . . . . . . . . . : нет
        IP-адрес  . . . . . . . . . . . . : 10.0.100.156
        Маска подсети . . . . . . . . . . : 255.255.255.0
        Основной шлюз . . . . . . . . . . : 10.0.100.1
        DNS-серверы . . . . . . . . . . . : 10.0.100.1

123 - PPP адаптер:

        DNS-суффикс этого подключения . . :
        Описание  . . . . . . . . . . . . : WAN (PPP/SLIP) Interface
        Физический адрес. . . . . . . . . : 00-53-45-00-00-00
        Dhcp включен. . . . . . . . . . . : нет
        IP-адрес  . . . . . . . . . . . . : 93.127.53.230
        Маска подсети . . . . . . . . . . : 255.255.255.255
        Основной шлюз . . . . . . . . . . : 93.127.53.230
        DNS-серверы . . . . . . . . . . . : 213.227.192.130
                                            195.248.191.72
        NetBIOS через TCP/IP. . . . . . . : отключен

Код: Выделить всё

mail# cat /etc/pf.conf
# interfaces
int_if = "rl0"
ext_if = "rl1"

tcp_services = "{ ssh, smtp, ftp, 80, 110, 8080, 3389, 1312  }"
udp_services = "{ ftp, 80 }"
nat_users = "{ 10.0.100.2, 10.0.100.115, 10.0.100.157, 10.0.100.113, 10.0.100.249 }"
icmp_types = "echoreq"

priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 }"
        
# options
set block-policy return
set loginterface $ext_if
# scrub
scrub in all

# nat/rdr
nat on $ext_if from $nat_users to any -> ($ext_if)
#rdr on $int_if proto tcp from any to any port 80 -> 10.0.100.1 \
#   port 3128
rdr on $ext_if proto tcp from any to $ext_if port 3389 -> 10.0.100.249
rdr  on $ext_if proto tcp from any to $ext_if port 8080 -> 10.0.100.249
nat on $int_if  proto tcp from any to 10.0.100.249 port 3389 -> ($int_if)
nat on $int_if  proto tcp from any to 10.0.100.249 port 8080 -> ($int_if)
# filter rules
block all

pass quick on lo0 all
#pass quick on $ext_if all
#pass quick on $int_if all
block drop in  quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets

pass in on $ext_if inet proto tcp from any to ($ext_if) \
   port $tcp_services flags S/SA keep state
pass in on $ext_if inet proto udp from any to ($ext_if) \
   port $udp_services keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in on $ext_if proto tcp from any to 10.0.100.249
pass in  on $int_if from $int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state

pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state

Код: Выделить всё

mail# cat /etc/ssh/sshd_config 
#	$OpenBSD: sshd_config,v 1.68 2003/12/29 16:39:50 millert Exp $
#	$FreeBSD: src/crypto/openssh/sshd_config,v 1.40 2004/04/20 09:37:29 des Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options change a
# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and
# FreeBSD has a few additional options.

#VersionAddendum FreeBSD-20040419

Port 22
Protocol 2
ListenAddress 0.0.0.0
#ListenAddress ::

# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_dsa_key

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
#ServerKeyBits 768

# Logging
#obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile	.ssh/authorized_keys

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# Change to yes to enable built-in password authentication.
#PasswordAuthentication no
#PermitEmptyPasswords no

# Change to no to disable PAM authentication
#ChallengeResponseAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'no' to disable PAM authentication (via challenge-response)
# and session processing.
#UsePAM yes

#AllowTcpForwarding yes
#GatewayPorts no
#X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PrintMotd yes
PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation yes
#PermitUserEnvironment no
#Compression yes
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS yes
#PidFile /var/run/sshd.pid
#MaxStartups 10

# no default banner path
#Banner /some/path

# override default of no subsystems
Subsystem	sftp	/usr/libexec/sftp-server

Код: Выделить всё

64 bytes from 93.127.53.230: icmp_seq=108 ttl=58 time=15.941 ms
64 bytes from 93.127.53.230: icmp_seq=109 ttl=58 time=15.123 ms
^C
--- 93.127.53.230 ping statistics ---
110 packets transmitted, 25 packets received, 77% packet loss
round-trip min/avg/max/stddev = 15.032/16.045/24.527/1.794 ms
stone:~ maxim$ telnet 93.127.53.230 22
Trying 93.127.53.230...
telnet: connect to address 93.127.53.230: Operation timed out
telnet: Unable to connect to remote host