forum.lissyara.su

Код: Выделить всё

# macros
ext_if="pcn0"
int_if="pcn1"

tcp_services="{ 22, 113 }"
icmp_types="echoreq"

comp3="192.168.115.128"

# options
set block-policy return
set loginterface $ext_if

set skip on lo

# scrub
scrub in all

# nat/rdr
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

#rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr on $ext_if proto tcp from any to any port 80 -> $comp3

# filter rules
block in

pass out keep state

anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }

pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
pass in on $ext_if inet proto tcp from any to $comp3 port 80 flags S/SA synproxy state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass quick on $int_if

Код: Выделить всё

# -- For internal sites
rdr on $int_if proto tcp from $internal_net to $ext_if port {25,143,110} ->  192.168.x.x
rdr on $int_if proto tcp from $internal_net to $ext_if port 80 ->  192.168.x.x
no nat on $int_if proto tcp from $int_if to $internal_net
nat on $int_if proto tcp from $internal_net to 192.168.x.x port {25,143,110} ->  $int_if
nat on $int_if proto tcp from $internal_net to 192.168.x.x port 80 ->  $int_if