forum.lissyara.su

Код: Выделить всё

options         IPDIVERT                # Enable NATD / Den

Код: Выделить всё

#cpu		I586_CPU
cpu		I686_CPU
ident		GENERIC

# To statically compile in device wiring instead of /boot/device.hints
#hints		"GENERIC.hints"		# Default places to look for devices.

# Use the following to compile in values accessible to the kernel
# through getenv() (or kenv(1) in userland). The format of the file
# is 'variable=value', see kenv(1)
#
# env		"GENERIC.env"

makeoptions	DEBUG=-g		# Build kernel with gdb(1) debug symbols

options         IPDIVERT                # Enable NATD / Den
options 	SCHED_ULE		# ULE scheduler 

Код: Выделить всё

/usr/src/>make buildkernel KERNCONF=GENERIC && \
make installkernel KERNCONF=GENERIC

Код: Выделить всё

ifconfig_rl1="inet 192.168.1.3  netmask 255.255.255.0" - интерфейс смотрящий в инет.
defaultrouter="192.168.1.1" - модем
hostname="bsd.domain.ru"

router_enable="NO"
gateway_enable="NO"
inetd_enable="YES"

natd_enable="YES"
natd_interface="rl1"
natd_flags="-m -u" 

gateway_enable="YES" 

Код: Выделить всё

use_sockets yes
same_ports yes
unregistered_only yes

Код: Выделить всё

named_enable="YES"
named_flags="-u bind" 

Код: Выделить всё

// If you've got a DNS server around at your upstream provider, enter
// its IP address here, and enable the line below.  This will make you
// benefit from its cache, thus reduce overall DNS traffic in the Internet.

	forwarders {isp_ip1; isp_ip2;};


// If the 'forwarders' clause is not empty the default is to 'forward first'
// which will fall back to sending a query from your local server if the name
// servers in 'forwarders' do not have the answer.  Alternatively you can
// force your name server to never initiate queries of its own by enabling the
// following line:
	forward only; 

Код: Выделить всё

00050   7    589 divert 8668 ip4 from any to any via rl1
00100   0      0 allow ip from any to any via lo0
00200   0      0 deny ip from any to 127.0.0.0/8
00300   0      0 deny ip from 127.0.0.0/8 to any
65000 719 113489 allow ip from any to any
65535   0      0 deny ip from any to any 

Код: Выделить всё

[Cc][Ll][Ii][Ee][Nn][Tt])
	############
	# This is a prototype setup that will protect your system somewhat
	# against people from outside your own network.
	#
	# Configuration:
	#  firewall_client_net:		Network address of local network.
	############

	# set this to your local network
	net="$firewall_client_net"
               
	# Allow DNS queries out in the world
	${fwcmd} add pass udp from me to any 53 keep-state

	${fwcmd} add pass udp from any to me 53 keep-state [b]# новое добавил[/b]

	# Everything else is denied by default, unless the
	# IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
	# config file.
	;;

[Ss][Ii][Mm][Pp][Ll][Ee])
	############
	# This is a prototype setup for a simple firewall.  Configure this
	# machine as a DNS and NTP server, and point all the machines
	# on the inside at this machine for those services.
	#
	# Configuration:
	#  firewall_simple_iif:		Inside network interface.
	#  firewall_simple_inet:	Inside network address.
	#  firewall_simple_oif:		Outside network interface.
	#  firewall_simple_onet:	Outside network address.
	############

	# set these to your outside interface network
	oif="$firewall_simple_oif"
	onet="$firewall_simple_onet"

	# set these to your inside interface network
	iif="$firewall_simple_iif"
	inet="$firewall_simple_inet"


	# Allow access to our DNS
	${fwcmd} add pass tcp from any to me 53 setup
	${fwcmd} add pass udp from any to me 53
	${fwcmd} add pass udp from me 53 to any

        ${fwcmd} add pass udp from any 53 to me [b]# новое добавил[/b]
        ${fwcmd} add pass udp from any to any 53[b] # новое добави[/b]л
        ${fwcmd} add pass udp from any 53 to any [b]# новое добавил[/b]

	# Allow DNS queries out in the world
	${fwcmd} add pass udp from me to any 53 keep-state

	${fwcmd} add pass udp from any to me 53 keep-state [b]# новое добавил[/b]

	# Everything else is denied by default, unless the
	# IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
	# config file.
	;;
 

Код: Выделить всё

C:\Documents and Settings\Admin>ping -t ya.ru

Обмен пакетами с ya.ru [213.180.204.8] по 32 байт:

Превышен интервал ожидания для запроса.

Код: Выделить всё

named already runing? PID=788

Код: Выделить всё

// If you've got a DNS server around at your upstream provider, enter
// its IP address here, and enable the line below.  This will make you
// benefit from its cache, thus reduce overall DNS traffic in the Internet.

   forwarders {isp_ip1; isp_ip2;};


// If the 'forwarders' clause is not empty the default is to 'forward first'
// which will fall back to sending a query from your local server if the name
// servers in 'forwarders' do not have the answer.  Alternatively you can
// force your name server to never initiate queries of its own by enabling the
// following line:
   forward only;

Код: Выделить всё

tcp6       0      0 ::1.953                *.*                    LISTEN
tcp4       0      0 127.0.0.1.953          *.*                    LISTEN
tcp4       0      0 127.0.0.1.53           *.*                    LISTEN
tcp4       0      0 *.23                   *.*                    LISTEN
tcp4       0      0 *.21                   *.*                    LISTEN
tcp4       0      0 127.0.0.1.25           *.*                    LISTEN
tcp4       0      0 *.22                   *.*                    LISTEN
tcp6       0      0 *.22                   *.*                    LISTEN 

Код: Выделить всё

named is running as pid 788.

Код: Выделить всё

// If named is being used only as a local resolver, this is a safe default.
// For named to be accessible to the network, comment this option, specify
// the proper IP address, or delete this option.
	listen-on	{ 127.0.0.1; };