forum.lissyara.su

Код: Выделить всё

allow tcp from any to any dst-port 21 setup
allow tcp from any 20 to any setup

Код: Выделить всё

alligator# ftp ftp.freebsd.org
Trying 2001:4f8:0:2::e...
ftp: connect to address 2001:4f8:0:2::e: No route to host
Trying 2001:6c8:6:4::7...
ftp: connect to address 2001:6c8:6:4::7: No route to host
Trying 62.243.72.50...
Connected to ftp.freebsd.org.
220 ftp.FreeBSD.org NcFTPd Server (licensed copy) ready.
Name (ftp.freebsd.org:alligator): ftp
331 Guest login ok, send your complete e-mail address as password.
Password:
230-You are user #307 of 600 simultaneous users allowed.
230-
230 Logged in anonymously.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
502 Unimplemented command.
227 Entering Passive Mode (62,243,72,50,209,37)
550 Data connection must go to same host as control connection.
421 Service not available, remote server has closed connection.
ftp>

Код: Выделить всё

alligator# cat /etc/rc.conf
gateway_enable="YES"
hostname="alligator.linkintel.ru"
ifconfig_rl0="DHCP"
static_routes="ftp1"
route_ftp1="82.204.179.158 192.168.201.200"
#inetd_enable="YES"
keymap="ru.koi8-r"
linux_enable="YES"
saver="dragon"
sshd_enable="YES"
usbd_enable="YES"
firewall_enable="YES"
firewall_script="/usr/local/etc/ipfw.conf"
natd_enable="YES"
natd_interface="tun0"
natd_flags="-dynamic -u -m"
apache_enable="YES"
squid_enable="YES"
#ipsec_enable="YES"
#ipsec_file="/etc/ipsec.conf"
#racoon_enable="YES"
#racoon_flags="-f /usr/local/etc/racoon/racoon.conf"
#c_icap_enable="YES"
#clamav_freshclam_enable="YES"
moused_port="/dev/psm0"
moused_type="auto"
moused_enable="YES"
ntpd_enable="YES"
ntpd_flags="-l /var/log/ntpd.log -p /var/run/ntpd.pid"

Код: Выделить всё

alligator# cat /usr/local/etc/ipfw.conf
#!/bin/sh

FwCMD="/sbin/ipfw"

LanOut="rl0"
LanIn="ath0"
IpOut="192.168.201.133"
IpIn="192.168.1.1"
NetMask="24"
NetIn="192.168.1.0"

InetIp="10.0.4.125"
InetIf="tun0"

${FwCMD} -f flush
${FwCMD} add check-state

${FwCMD} add allow ip from any to any via lo0
${FwCMD} add deny ip from any to 127.0.0.0/8
${FwCMD} add deny ip from 127.0.0.0/8 to any
${FwCMD} add deny tcp from any to not 192.168.1.0/24 80,21 via ath0
${FwCMD} add divert natd ip from ${NetIn}/${NetMask} to any out via ${InetIf}
${FwCMD} add divert natd ip from any to ${InetIp} in via ${InetIf}

${FwCMD} add allow all from any to any via ${LanIn}

${FwCMD} add allow tcp from any to any established

${FwCMD} add allow icmp from any to any

${FwCMD} add allow gre from ${IpOut} to 192.168.201.200 via ${LanOut}
${FwCMD} add allow gre from 192.168.201.200 to ${IpOut} via ${LanOut}
${FwCMD} add allow tcp from ${IpOut} to 192.168.201.200 1723 via ${LanOut} setup

${FwCMD} add allow gre from any to any via ${InetIf}
${FwCMD} add allow tcp from any to any 1723 via ${InetIf} setup

${FwCMD} add allow udp from ${IpOut} to any 53 via ${LanOut} keep-state

${FwCMD} add allow udp from any to 192.168.0.200 53 out xmit ${InetIf}
${FwCMD} add allow udp from 192.168.0.200 53 to any in recv ${InetIf}

${FwCMD} add allow tcp from ${InetIp} to any 80,443,25,110 via ${InetIf} setup
${FwCMD} add allow tcp from any to any 21 via ${InetIf} setup keep-state
${FwCMD} add allow tcp from any 20 to any via ${InetIf} setup

${FwCMD} add allow tcp from any to any 22 via ${InetIf} setup

${FwCMD} add allow udp from 82.204.179.155 27015-27017 to any via ${InetIf}
${FwCMD} add allow udp from any to 82.204.179.155 27015-27017 via ${InetIf}

${FwCMD} add allow udp from any to any 123 via tun0

${FwCMD} add allow tcp from any to 82.204.179.155 6666 via tun0 setup
OC
${FwCMD} add allow tcp from ${IpOut} to 82.204.179.158 via rl0 setup

#${FwCMD} add allow ip from any to any

Код: Выделить всё

alligator# ftp ftp.linkintel.ru
Connected to ftp.linkintel.ru.
220 Welcome to LINKINTEL FTP service.
Name (ftp.linkintel.ru:alligator): ftp
331 Please specify the password.
Password:
230 Login successful. Have fun.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
500 Unknown command.
227 Entering Passive Mode (82,204,179,157,238,33)
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x   10 501      501            64 Feb 01 01:02 Music
drwxr-xr-x   32 501      501          4096 Mar 05 17:21 Video
226 Directory send OK.
ftp>

Код: Выделить всё

/usr/local/etc/>ipfw show | grep 192.168.0.82
04821   233    58516 pipe 1821 ip from 192.168.0.82 to any dst-port 20,21,80,443,3128,5190,15779 via rl1 in
04822   578   617936 pipe 1822 ip from any 20,21,80,443,1155,5190,15779 to 192.168.0.82 via rl1 out
04823     6      288 deny log logamount 10000 ip from 192.168.0.82 to any

Код: Выделить всё

/usr/local/etc/>tail -f /var/log/security |grep 192.168.0.82
Apr 10 12:25:39 mx kernel: ipfw: 4823 Deny TCP 192.168.0.82:1164 192.168.0.1:61893 in via rl1
Apr 10 12:25:45 mx kernel: ipfw: 4823 Deny TCP 192.168.0.82:1171 192.168.0.1:53122 in via rl1
Apr 10 12:25:45 mx kernel: ipfw: 4823 Deny TCP 192.168.0.82:1164 192.168.0.1:61893 in via rl1
Apr 10 12:25:48 mx kernel: ipfw: 4823 Deny TCP 192.168.0.82:1171 192.168.0.1:53122 in via rl1
Apr 10 12:25:54 mx kernel: ipfw: 4823 Deny TCP 192.168.0.82:1171 192.168.0.1:53122 in via rl1
^C
/usr/local/etc/>

Код: Выделить всё

01821: 128.000 Kbit/s    0 ms  12 KB 1 queues (1 buckets) droptail
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
  0 tcp     192.168.0.82/1161      192.168.0.1/21     233    58516  0    0   0
/usr/local/etc/>ipfw pipe show 1822
01822: 128.000 Kbit/s    0 ms  12 KB 1 queues (1 buckets) droptail
    mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
  0 tcp      192.168.0.1/21       192.168.0.82/1161   694   783718  0    0   6
/usr/local/etc/>