forum.lissyara.su

Код: Выделить всё

00100 allow ip from any to any via lo0
00200 allow tcp from me 22 to any
00300 allow tcp from any to me dst-port 22

/sbin/ipfw nat 100 config ip xxx.xxx.xxx.xxx log \
redirect_port tcp 192.168.1.3:3389 3389 \
redirect_port tcp 192.168.1.3:31320 31320
00400 nat 100 ip from 192.168.1.0/24 to not 172.24.0.0/16
00500 nat 100 ip from not 172.24.0.0/16 to xx.xxx.xxx.xxx

/sbin/ipfw nat 200 config ip 172.24.50.20
00600 nat 200 ip from 192.168.1.0/24 to 172.24.0.0/16 out via em0
00700 nat 200 ip from 172.24.0.0/16 to 172.24.50.20 in via em0
00800 allow udp from any to any dst-port 53
00900 allow log logamount 100 tcp from any to any dst-port 80,443,21
01000 allow icmp from any to any
65000 allow ip from any to any
65535 deny ip from any to any

Код: Выделить всё

Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            xxx.xxx.xxx.xxx     US          0   790765    ng0
xxx.xxx.xx.xxx     link#5             UHS         0       76    lo0
127.0.0.1          link#4             UH          0       26    lo0
172.24.0.0/16      172.24.50.1        UGS         2   857897    em0
172.24.50.0/24     link#2             U           0      179    em0
172.24.50.20       link#2             UHS         0        0    lo0
192.168.1.0/24     link#1             U           3    68114    re0
192.168.1.1        link#1             UHS         0        0    lo0
192.168.110.1      link#5             UH          0        7    ng0

Код: Выделить всё

startup:
        # configure mpd users
        set user foo bar admin
        set user foo1 bar1
        # configure the console
        set console self 127.0.0.1 5005
        set console open
        # configure the web server
        set web self 0.0.0.0 5006
        set web open

#
# Default configuration is "dialup"

default:
        load pptp_client

pptp_client:
#
# PPTP client: only outgoing calls, auto reconnect,
# ipcp-negotiated address, one-sided authentication,
# default route points on ISP's end
#

        create bundle static B1
        set iface up-script /usr/local/etc/mpd5/vpn-up.sh
        set iface down-script /usr/local/etc/mpd5/vpn-down.sh
        create link static L1 pptp
        set link action bundle B1
        set auth authname login
        set auth password password
        set link max-redial 0
        set link mtu 1460
        set link keep-alive 20 75
        set pptp peer 172.24.x.y
        set pptp disable windowing
        open

Код: Выделить всё

#!/bin/sh
VPN=172.24.0.0
GW=172.24.50.1
route delete $VPN
route add $VPN $GW
route delete default
route add default xxx.xxx.xxx.xxx
sleep 1s
/usr/local/etc/ipfw.conf

Код: Выделить всё

 set iface enable tcpmssfix

Код: Выделить всё

#!/bin/sh

fwcmd="/sbin/ipfw"

# Force a flushing of the current rules before we reload.
${fwcmd} -f flush

        #inet if
        eint="em0"
        #inet ip реальный адрес выданный провайдером
        eip="xxx.xxx.xxx.x1"
        #local net ip
        iip="192.168.0.1"
        #local net if
        iint="re0"

        m0="255.255.0.0"
        m1="255.255.255.0"
        m2="255.255.255.248"

        n1="192.168.0.0"
        n2="10.0.0.0"
        #vpn server ip
        vpn_server="10.1.21.12"

        ${fwcmd} add check-state
        # pass all through loopback device
        ${fwcmd} add pass all from any to any via lo0
        # deny other lo0
        ${fwcmd} add deny all from any to 127.0.0.0/8
        ${fwcmd} add deny all from 127.0.0.0/8 to any
        ${fwcmd} add deny ip from any to 192.168.0.0/16 in recv em0
        ${fwcmd} add deny ip from 192.168.0.0/16 to any in recv em0
        ${fwcmd} add deny ip from any to 172.16.0.0/12 in recv em0
        ${fwcmd} add deny ip from 172.16.0.0/12 to any in recv em0
        ${fwcmd} add deny ip from any to 169.254.0.0/16 in recv em0
        ${fwcmd} add deny ip from 169.254.0.0/16 to any in recv em0
        # ICMP
        ${fwcmd} add deny icmp from any to any frag
        ${fwcmd} add deny icmp from any to any in icmptype 5,9,13,14,15,16,17
        ${fwcmd} add allow icmp from any to any

         #allow to web server
        ${fwcmd} add allow tcp from any to me 80 keep-state

		# NATd
        ${fwcmd} nat 1 config ip ${eip} log same_ports
        #${fwcmd} add nat 1 ip4 from any  to any via ${iint}
        ${fwcmd} add nat 1 ip4 from ${n1}/24 to any
        ${fwcmd} add nat 1 ip4 from any to ${eip}

        ${fwcmd} add allow ip from any to any via ${iint}
        ${fwcmd} add allow udp from any to any via ${iint}
        ${fwcmd} add allow icmp from any to any via ${iint}
		
		
        #${fwcmd} add allow ip from any to any
        # deny netbios
        ${fwcmd} add allow ip from any 137-139 to any
        ${fwcmd} add allow ip from any to any 137-139

        #allow DHCP client in provider net
        ${fwcmd} add allow tcp from me 67,68 to any via ${eint}
        ${fwcmd} add allow tcp from any to me 67,68 via ${eint}

        #${fwcmd} add allow tcp from any to any established
        #connect me to any
        ${fwcmd} add allow ip from me to any out xmit ${eint} keep-state

        # GRE for MPD5
        ${fwcmd} add allow gre from any to any
        #  VPN-connect for MPD, autorization request port
        ${fwcmd} add allow tcp from me 1723 to any
        ${fwcmd} add allow tcp from any to me 1723
        ${fwcmd} add allow udp from me 1723 to any
        ${fwcmd} add allow udp from any to me 1723


        # SSH for localhost allow
        #${fwcmd} add allow tcp from me 22 to any
        ${fwcmd} add allow tcp from any to me 22 keep-state

        # DNS, NTP, SNMPx2, DNSs
        ${fwcmd} add allow udp from any to me 123 keep-state
        #${fwcmd} add allow udp from me 123 to any
        ${fwcmd} add allow udp from any to me 53 keep-state
        #${fwcmd} add allow udp from me 53 to any

        #allow to ftp server
        ${fwcmd} add allow tcp from any to me 20,21 keep-state
        #${fwcmd} add allow tcp from me 20,21 to any
        #${fwcmd} add allow tcp from me 49151-65535 to any
        ${fwcmd} add allow tcp from any to me 49151-65535 keep-state

        # log - всё, что не пропустилось, в лог (/var/log/security по умолчанию)
        ${fwcmd} add deny log logamount 3000 all from any to any

Код: Выделить всё

options         IPFIREWALL
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=100
options         IPFIREWALL_NAT
options         LIBALIAS
options         ROUTETABLES=2
options         DUMMYNET

Код: Выделить всё

ип 192.168.0.4
маска 255.255.255.0
шлюз 192.168.0.1

Код: Выделить всё

gateway_enable="YES"
ifconfig_em0="DHCP"
ifconfig_re0="inet 192.168.0.1 netmask 255.255.255.0"
#ip шлюз провайдера
defaultrouter="xxx.xxx.xxx.xx"
firewall_enable="YES"
firewall_type="/etc/rc.firewall2"