forum.lissyara.su

Код: Выделить всё

freebsd# cat /etc/rc.conf
amd_enable="NO"
amd_flags="-a /.amd_mnt -l syslog /host /etc/amd.map /net /etc/amd.map"
font8x14="cp866-8x14"
font8x16="cp866b-8x16"
font8x8="cp866-8x8"
hostname="freebsd.m-tisiz.local"
ifconfig_em0="inet 192.168.100.216  netmask 255.255.255.0"
ifconfig_em1="inet 192.168.5.1  netmask 255.255.255.0"
defaultrouter="192.168.5.5"
inetd_enable="NO"
gateway_enable="YES"
sendmail_enable="NONE"
keymap="ru.koi8-r"
keyrate="fast"
mousechar_start="3"
saver="daemon"
scrnmap="koi8-r2cp866"
sshd_enable="YES"
firewall_enable="YES"
firewall_script="/usr/local/etc/rc.firewall"
firewall_type="/usr/local/etc/rc.firewall"
natd_enable="YES"
natd_interface="em1"
natd_flags=""
tcp_extensions="NO"
cupsd_enable="NO"
smbd_enable="YES"
nmbd_enable="YES"
winbindd_enable="YES"
squid_enable="YES"
mpd_enable="YES"
mpd_flags="-b"

Код: Выделить всё

freebsd# cat /usr/local/etc/rc.firewall
#!/bin/sh
ipfw='/sbin/ipfw -q'

${ipfw} flush

${ipfw} add 115 divert natd ip4 from any to any via em1
${ipfw} add 120 allow ip from any to any via lo0
${ipfw} add 125 deny ip from any to 127.0.0.0/8
${ipfw} add 126 deny ip from 127.0.0.0/8 to any

${ipfw} add 131 allow log logamount 1000 tcp from any to me 1723
${ipfw} add 131 allow gre from any to any


${ipfw} add 170 allow ip from any to me 4095
${ipfw} add 175 allow ip from me 4095 to any

${ipfw} add 210 allow icmp from any to any icmptypes 0,8,11

${ipfw} add 300 allow ip from me to any out
${ipfw} add 310 allow ip from any 80 to me established
${ipfw} add 350 allow udp from any 123 to any 123
${ipfw} add 361 allow tcp from 192.168.100.0/24 to 213.142.217.104 9091
${ipfw} add 366 allow tcp from 213.142.217.104 9091 to 192.168.100.0/24 establis                                                                              hed

${ipfw} add 371 allow ip from any to me 5007
${ipfw} add 381 allow ip from me 5007 to any established

${ipfw} add 400 allow udp from any to any 53
${ipfw} add 420 allow udp from any 53 to 192.168.100.244
${ipfw} add 430 allow udp from any 53 to 192.168.100.250
${ipfw} add 420 deny ip from any to any 520

${ipfw} add 600 allow ip from 192.168.100.0/24 to me

${ipfw} add 700 allow tcp from 192.168.100.0/24 to any 25,110
${ipfw} add 710 allow tcp from any 25,110 to 192.168.100.0/24 established
${ipfw} add 730 allow ip from any 443 to any

${ipfw} add 6000 deny log ip from any to any

Код: Выделить всё

netstat -w1
            input        (Total)           output
   packets  errs idrops      bytes    packets  errs      bytes colls
         3     0     0        180          1     0        218     0
         1     0     0         60          1     0        170     0
         2     0     0        120          1     0        170     0
         4     0     0       1001          4     0       1238     0
       180     0     0     186265        187     0     177797     0
     26612     0     0    1606327      26626     0    1587351     0
     62510     0     0    3625716      62509     0    3631014     0
     63999     0     0    3737572      64020     0    3743162     0

Код: Выделить всё

  PID USERNAME  THR PRI NICE   SIZE    RES STATE   C   TIME   WCPU COMMAND
 1137 root        1 113    0  3616K  1516K CPU0    0   7:56 83.89% natd
 1010 squid       1  44    0 84200K 77264K kqread  0   0:23  0.00% squid
 1001 root        1  44    0 13880K  7568K select  0   0:00  0.00% winbindd
  991 root        1  44    0 13884K  7164K select  1   0:00  0.00% winbindd
 1002 root        1  47    0 13996K  7496K select  3   0:00  0.00% winbindd
........................

Код: Выделить всё

00100 allow ip from me to any dst-port 80 via em1
00101 allow ip from any 80 to me established
00115 divert 8668 ip4 from any to any via em1