forum.lissyara.su

Код: Выделить всё

out# uname -a
FreeBSD out.ac-construction.local 8.1-RELEASE FreeBSD 8.1-RELEASE #3: Mon Apr 25 17:55:35 MSD 2011     Admin@out.ac-construction.local:/usr/obj/usr/src/sys/main_kernell.2011-25-04  amd64

Код: Выделить всё

#!/bin/sh
ipfw -f flush
ipfw -f pipe flush
ipfw -f queue flush
#NAT
ipfw nat 123 config if bge1 log same_ports reset redirect_port tcp 192.168.0.5:3389 3389

cmd="/sbin/ipfw add"

LanOut="bge1"                  # Внешняя сетевуха
NetOut="192.168.100.0/24"   # внешняя сеть
IpOut="192.168.100.31"       # Внешний IP

LanIn="bge0"                   # внутренняя сетевуха
NetIn="192.168.0.0/23"        # Внутренняя сеть
ip_lan="192.168"            # Шаблон внутреннего адреса

skip="skipto 800"
skip2="skipto 805"

#local
$cmd 005 allow all from any to any via $LanIn

# loopback
$cmd 010 allow all from any to any via lo0
$cmd 011 $skip2 tcp from 192.168.0.5 to any via $LanOut

#Incoming traffic to NAT
$cmd 030 nat 123 ip from any to me in via $LanOut

#Allow DYN rules
$cmd 040 check-state

# DNS resolve
$cmd 050 $skip udp from any to any 53 out via $LanOut keep-state

# Outgoing server to Internet
$cmd 060 $skip tcp from me to any out via $LanOut setup keep-state

# Postal service
$cmd 070 $skip tcp from any to any 25 out via $LanOut setup keep-state
$cmd 080 $skip tcp from any to any 110 out via $LanOut setup keep-state

#banking service
$cmd 090 $skip tcp from any to any 3290 out via $LanOut setup keep-state
$cmd 100 $skip udp from any to any 1024,2046,55777 out via $LanOut keep-state

$cmd 091 $skip tcp from any to any 59714 out via $LanOut setup keep-state

#RDP
$cmd 150 skipto 800 ip from any to 192.168.0.5 3389 in via $LanOut

$cmd 110 $skip ip from 192.168.1.135 to any 3389 out via $LanOut setup keep-state
$cmd 111 $skip ip from 192.168.1.187 to any 3389 out via $LanOut setup keep-state
$cmd 112 $skip ip from 192.168.1.25 to any 3389 out via $LanOut setup keep-state

# ICMP
$cmd 100 $skip icmp from any to any out via $LanOut keep-state

# Time
$cmd 120 $skip udp from any to any 123 out via $LanOut keep-state
# NAT for 192.168.0.11
$cmd 130 $skip ip from 192.168.0.11 to any out via $LanOut setup keep-state

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 200 deny all from 192.168.0.0/16  to any in via $LanOut
$cmd 201 deny all from 172.16.0.0/12   to any in via $LanOut
$cmd 202 deny all from 10.0.0.0/8      to any in via $LanOut
$cmd 203 deny all from 127.0.0.0/8     to any in via $LanOut
$cmd 204 deny all from 0.0.0.0/8       to any in via $LanOut
$cmd 205 deny all from 169.254.0.0/16  to any in via $LanOut
$cmd 206 deny all from 192.0.2.0/24    to any in via $LanOut
$cmd 207 deny all from 204.152.64.0/23 to any in via $LanOut
$cmd 208 deny all from 224.0.0.0/3     to any in via $LanOut

# Deny ident
$cmd 209 deny tcp from any to any 113 in via $LanOut

#Netbios
$cmd 210 deny tcp from any to any 137 via $LanOut
$cmd 211 deny tcp from any to any 138 via $LanOut
$cmd 212 deny tcp from any to any 139 via $LanOut
$cmd 213 deny tcp from any to any 81  via $LanOut

# Deny fragments packets
$cmd 214 deny all from any to any frag in via $LanOut

# Deny ACK packets that did not match the dynamic rule table
$cmd 215 deny tcp from any to any established in via $LanOut

# Allow in ssh from Internet
#$cmd 300 allow tcp from any to me 22 in via $LanOut setup limit src-addr 1

# Reject incomming traffic from Inet
$cmd 400 deny log all from any to any in via $LanOut

# Reject outgoing traffic to Inet
$cmd 410 deny log all from any to any out via $LanOut

# NAT from local to Inet
$cmd 800 nat 123 ip from $NetIn to any out via $LanOut

$cmd 801 allow ip from any to any

$cmd 805 nat 123 ip from any to any via $LanOut
$cmd 999 deny log all from any to any

Код: Выделить всё

#Incoming traffic to NAT
$cmd 030 nat 123 ip from any to me in via $LanOut

# NAT from local to Inet
$cmd 800 nat 123 ip from $NetIn to any out via $LanOut

Код: Выделить всё

#!/bin/sh
ipfw -f flush
ipfw -f pipe flush
ipfw -f queue flush
#NAT
ipfw nat 123 config if bge1 log same_ports reset deny_in redirect_port tcp 192.168.0.5:3389 3389

cmd="/sbin/ipfw add"

LanOut="bge1"                  # Внешняя сетевуха
NetOut="192.168.100.0/24"   # внешняя сеть
IpOut="192.168.100.31"       # Внешний IP

LanIn="bge0"                   # внутренняя сетевуха
NetIn="192.168.0.0/23"        # Внутренняя сеть


# loopback
$cmd 010 allow all from any to any via lo0

#local
$cmd 105 allow all from any to any via $LanIn

# NAT from local to Inet
$cmd 800 nat 123 ip from any to any out via $LanOut

$cmd 801 allow ip from any to any

Код: Выделить всё

#Incoming traffic to NAT
$cmd 030 nat 123 ip from any to me in via $LanOut

Код: Выделить всё

$cmd 800 nat 123 ip from $NetIn to any out via $LanOut

Код: Выделить всё

$cmd 806 allow ip from any to any