Настроен: ipfw + nat
Проблема: провайдер решил сделать привязку mac адреса к ip. И после этого инет стал пропадать по причине того, что у него проскакивают мои некоторые локальные ip.
Ворде все настраивал правильно, но скорее всего где-то не прав. Ткните плз хоть в какую сторону смотреть
Вот конфиг ipfw:
Код: Выделить всё
#!/bin/sh
fwcmd="/sbin/ipfw -q"
${fwcmd} -f flush
# local nets table;
${fwcmd} table 10 flush
${fwcmd} table 10 add 192.168.101.0/24
${fwcmd} table 10 add 192.168.102.0/24
${fwcmd} table 10 add 192.168.110.0/24
${fwcmd} table 10 add 192.168.104.0/24
# out local ips table;
${fwcmd} table 20 flush
${fwcmd} table 20 add 212.109.39.186
${fwcmd} table 20 add 94.45.58.202
${fwcmd} table 20 add 80.245.120.146
${fwcmd} table 20 add 195.60.71.102
${fwcmd} table 20 add 82.207.121.43
${fwcmd} table 20 add 213.227.208.183
${fwcmd} table 20 add 80.78.41.22
${fwcmd} table 20 add 195.225.144.23
${fwcmd} table 20 add 212.90.161.202
${fwcmd} table 20 add 83.238.96.145
${fwcmd} table 20 add 193.138.187.3
${fwcmd} table 20 add 213.154.220.60
${fwcmd} table 20 add 93.127.99.69
${fwcmd} table 20 add 82.207.42.115
${fwcmd} table 20 add 93.127.17.137
${fwcmd} table 20 add 217.24.168.26
${fwcmd} table 20 add 77.222.148.50
${fwcmd} table 20 add 85.198.139.2
${fwcmd} table 20 add 213.227.206.142
${fwcmd} table 20 add 212.109.39.186
${fwcmd} table 20 add 212.109.39.187
${fwcmd} table 20 add 212.109.39.188
${fwcmd} table 20 add 212.109.39.189
${fwcmd} table 20 add 212.109.39.190
${fwcmd} table 20 add 93.127.101.123
${fwcmd} table 20 add 195.64.225.100
${fwcmd} table 20 add 172.23.130.10
${fwcmd} table 20 add 80.91.190.251
${fwcmd} table 20 add 213.154.200.77
${fwcmd} table 20 add 17.149.36.86
${fwcmd} table 20 add 213.227.217.202
${fwcmd} table 20 add 62.80.162.254
${fwcmd} table 20 add 212.3.107.242
${fwcmd} table 20 add 212.109.45.77
${fwcmd} table 20 add 85.238.96.145
# local ip access to 102/24 subnet;
${fwcmd} table 30 flush
${fwcmd} table 30 add 192.168.102.200
${fwcmd} table 30 add 192.168.102.21
${fwcmd} table 30 add 192.168.102.70
${fwcmd} table 30 add 192.168.102.40
${fwcmd} table 30 add 192.168.102.28
${fwcmd} table 30 add 192.168.102.24
${fwcmd} table 30 add 192.168.102.50
${fwcmd} table 30 add 192.168.102.17
${fwcmd} table 30 add 192.168.102.35
# retalix test;
${fwcmd} table 30 add 192.168.102.250
${fwcmd} table 30 add 192.168.102.251
${fwcmd} table 30 add 192.168.102.252
# all subnet except 101/24;
${fwcmd} table 40 flush
${fwcmd} table 40 add 192.168.102.0/24
${fwcmd} table 40 add 192.168.104.0/24
${fwcmd} table 40 add 192.168.110.0/24
#${fwcmd} table 40 add 10.0.0.0/24
# allow loopback for sockets;
${fwcmd} add 90 allow ip from any to any via lo0
# allow icmps;
${fwcmd} add 100 allow icmp from me to any
${fwcmd} add 110 allow icmp from table\(10\) to 192.168.101.0/24
${fwcmd} add 120 allow icmp from table\(10\) to 192.168.102.0/24
${fwcmd} add 130 allow icmp from table\(10\) to 192.168.110.0/24
${fwcmd} add 140 allow icmp from table\(10\) to 192.168.104.0/24
# deny;
#${fwcmd} add 150 deny ip from me to 91.211.117.87
#${fwcmd} add 151 deny ip from 91.211.177.87 to me
# divert and hide our local ips with nat;
${fwcmd} add 200 divert natd all from any to any via sk0 in
# divert icpms with nat;
${fwcmd} add 210 divert natd icmp from table\(10\) to any
# divert news.ntu-kpi.kiev.ua with nat;
${fwcmd} add 215 divert natd tcp from table\(10\) to 77.47.128.140 dst-port 119 via sk0 out
# divert allow pop3;
${fwcmd} add 216 divert natd tcp from table\(10\) to any dst-port 110 via sk0 out
# redirecting ports out;
${fwcmd} add 250 divert natd tcp from 192.168.101.222 8050,3389 to any via sk0 out
# test camera;
#${fwcmd} add 251 divert natd tcp from 192.168.101.0/24 to any 81,82,83,7070,5938,64021 via sk0 out
# klo kerio vpn client;
${fwcmd} add 252 divert natd tcp from table\(10\) to any 4090 via sk0 out
${fwcmd} add 253 divert natd udp from table\(10\) to any 4090 via sk0 out
# other;
${fwcmd} add 256 divert natd tcp from 192.168.101.150 9998 to any via sk0 out
# rdp access to 1c servers;
${fwcmd} add 260 divert natd tcp from 192.168.104.33 3389 to any via sk0 out
${fwcmd} add 261 divert natd tcp from 192.168.102.70 3389,3390,8192,8193,11112 to any via sk0 out
${fwcmd} add 262 divert natd tcp from 192.168.101.3 3389,7777,8888 to any via sk0 out
${fwcmd} add 270 divert natd tcp from 192.168.102.28 8070,8071,8072 to any via sk0 out
# test host;
#${fwcmd} add 290 divert natd tcp from 192.168.102.200 to any 80,21,443,3389,3390 via sk0 out
#${fwcmd} add 292 divert natd tcp from 192.168.102.125 to any 80,21,443 via sk0 out
#${fwcmd} add 293 divert natd tcp from 192.168.102.1 to any 80,21,443 via sk0 out
# radio;
${fwcmd} add 295 divert natd tcp from 192.168.102.0/24 to any 8000,8006,5125,8102 via sk0 out
# vnedrenci out to AZS;
${fwcmd} add 299 divert natd ip from 192.168.101.3 to any 3389,3390
# nat to out ip - test servers, NGC, etc.;
${fwcmd} add 300 divert natd ip from table\(10\) to table\(20\)
# allow vpn to LukOil and other servers;
${fwcmd} add 300 allow gre from any to any
${fwcmd} add 310 allow gre from any to any via sk0
${fwcmd} add 320 allow gre from any to any via msk0
${fwcmd} add 330 allow gre from any to any via re0
${fwcmd} add 340 allow gre from any to any via sk1
# local access;
${fwcmd} add 400 allow ip from table\(30\) to 192.168.101.0/24
${fwcmd} add 401 allow tcp from table\(30\) to 192.168.101.0/24
${fwcmd} add 402 allow tcp from 192.168.101.0/24 to table\(30\)
${fwcmd} add 410 allow ip from 192.168.101.0/24 to table\(30\)
${fwcmd} add 420 allow ip from 192.168.102.0/24 to 192.168.101.23
${fwcmd} add 430 allow ip from 192.168.101.23 to 192.168.102.0/24
# deny to 101/24 subnet;
${fwcmd} add 440 deny ip from table\(40\) to 192.168.101.0/24
${fwcmd} add 450 deny ip from 192.168.101.0/24 to table\(40\)
# allow to other subnet;
${fwcmd} add 460 allow ip from table\(40\) to 192.168.102.0/24
${fwcmd} add 461 allow ip from 192.168.102.0/24 to table\(40\)
${fwcmd} add 462 allow ip from table\(40\) to 192.168.104.0/24
${fwcmd} add 463 allow ip from 192.168.104.0/24 to table\(40\)
${fwcmd} add 464 allow ip from table\(40\) to 192.168.110.0/24
${fwcmd} add 465 allow ip from 192.168.110.0/24 to table\(40\)
# open only known ports; other ports will be droped by router;
${fwcmd} add 600 allow ip from any 20,21,47,51,1494,1723,186,3390 to any via sk0 in
${fwcmd} add 610 allow ip from any 80,20,25,53,110,119,123,143,443,465,587,995,1494,1723,1782,3390,3389,8194 to any via sk0
${fwcmd} add 620 allow ip from any to me dst-port 20,21,25,47,53,80,110,123,222,443,1723,1863,3310,3389,3390,8194 via sk0
${fwcmd} add 640 allow ip from any to 192.168.102.0/24 via re0 out
${fwcmd} add 641 allow ip from 192.168.102.0/24 to any via re0 in
${fwcmd} add 642 allow ip from any to 192.168.101.0/24 via msk0 out
${fwcmd} add 643 allow ip from 192.168.101.0/24 to any via msk0 in
${fwcmd} add 644 allow ip from any to 192.168.110.0/24 via sk1 out
${fwcmd} add 645 allow ip from 192.168.110.0/24 to any via sk1 in
${fwcmd} add 646 allow ip from any to 192.168.104.0/24 via sk1 out
${fwcmd} add 647 allow ip from 192.168.104.0/24 to any via sk1 in
# construction ports;
${fwcmd} add 650 allow ip from any to any 3389,3390,8192,8193,8070,8071,8072,9998,11112,22201,22202,8194 via sk0 in
${fwcmd} add 700 allow ip from any to any established
${fwcmd} add 65000 allow ip from any to any
а на практике ....не пойму....
