forum.lissyara.su

Код: Выделить всё

# ngctl list
Name: div0_sock_out   Type: ksocket         ID: 0000007f   Num hooks: 1
Name: div0_sock_in    Type: ksocket         ID: 0000007e   Num hooks: 1
Name: div0_ip_acct    Type: ipacct          ID: 0000007d   Num hooks: 2

Код: Выделить всё

IFACE="xl0"
...
### packets reaching tee are _accepted_,
### so use theese rules _AFTER_ all deny rules
ipfw add 64021 tee 3021 ip from any to room101 via ${IFACE}
ipfw add 64022 tee 3022 ip from room101 to any via ${IFACE}

Код: Выделить всё

FwCMD="/sbin/ipfw -q"
LanOut="fxp0"           # внешний интерфейс
LanIn0="fxp1"            # внутренний интерфейс 0
LanIn1="fxp2"            # внутренний интерфейс 1
IpOut="1.2.3.4"   # внешний IP адрес машины
IpIn0="192.168.160.1"        # 1 внутренний IP машины
IpIn1="192.168.161.1"        # 2 внутренний IP машины
NetIn0="192.168.160.0"       # Внутренняя сеть 1
NetIn1="192.168.161.0"       # Внутренняя сеть 2
NetVpn="10.10.200.0"

${FwCMD} flush
${FwCMD} add check-state
${FwCMD} add allow ip from any to any via lo0
${FwCMD} add deny ip from any to 127.0.0.0/8
${FwCMD} add deny ip from 127.0.0.0/8 to any
${FwCMD} add deny ip from any to 10.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 172.16.0.0/12 in via ${LanOut}
${FwCMD} add deny ip from any to 192.168.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 0.0.0.0/8 in via ${LanOut}
${FwCMD} add deny ip from any to 169.254.0.0/16 in via ${LanOut}
${FwCMD} add deny ip from any to 240.0.0.0/4 in via ${LanOut}
${FwCMD} add deny icmp from any to any frag
${FwCMD} add deny log icmp from any to 255.255.255.255 in via ${LanOut}
${FwCMD} add deny log icmp from any to 255.255.255.255 out via ${LanOut}
${FwCMD} add deny ip from ${NetIn0}/24 to ${NetIn1}/24 in via ${LanIn0}
${FwCMD} add deny ip from ${NetIn1}/24 to ${NetIn0}/24 in via ${LanIn1}
${FwCMD} add deny tcp from ${NetIn0}/23 to not ${NetIn0}/23 25 in
${FwCMD} add fwd 127.0.0.1,3128 tcp from ${NetIn0}/23 to any 80 via ${LanOut}
${FwCMD} add divert natd ip from ${NetIn0}/23 to any out via ${LanOut}
${FwCMD} add divert natd ip from any to ${IpOut} in via ${LanOut}
${FwCMD} add deny ip from 10.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 172.16.0.0/12 to any out via ${LanOut}
${FwCMD} add deny ip from 192.168.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 0.0.0.0/8 to any out via ${LanOut}
${FwCMD} add deny ip from 169.254.0.0/16 to any out via ${LanOut}
${FwCMD} add deny ip from 224.0.0.0/4 to any out via ${LanOut}
${FwCMD} add deny ip from 240.0.0.0/4 to any out via ${LanOut}
${FwCMD} add allow tcp from any to any established
# OpenVPN ###############################################
${FwCMD} add tee 3021 ip from any to any out xmit gif*         # ???
${FwCMD} add tee 3022 ip from any to any via tun*                # ???
${FwCMD} add allow udp from any to ${IpOut1} 2000 via ${LanOut} # у меня OpenVPN на 2000 пору
${FwCMD} add allow ip from ${NetVpn}/24 to ${NetIn0}/24
#########################################################
${FwCMD} add allow udp from any 53 to any via ${LanOut}
${FwCMD} add allow udp from any to any 123 via ${LanOut}
${FwCMD} add allow icmp from any to any icmptypes 0,8,11
${FwCMD} add allow tcp from any to ${IpOut1} 80 via ${LanOut}
${FwCMD} add allow tcp from any to ${IpOut1} ssh via ${LanOut}
# разрешения для каждого юзера:
${FwCMD} add allow all from any to user1_IP via ${LanIn0}
${FwCMD} add allow all from user1_IP to any via ${LanIn0}
${FwCMD} add allow all from any to user2_IP via ${LanIn0}
${FwCMD} add allow all from user2_IP to any via ${LanIn0}
...

Код: Выделить всё

${FwCMD} add tee 3021  ip from any to any in via tun*
${FwCMD} add tee 3022  ip from any to any out via tun*

Код: Выделить всё

${FwCMD} add allow tcp from any to any established

Код: Выделить всё

02700   319   32253 tee 3021 ip from any to any in via tun*
02800   449  433683 tee 3022 ip from any to any out via tun*
02900 83994 7147560 allow tcp from any to any established

Код: Выделить всё

...
10.10.200.6     50651   192.168.160.33  445     6       320     32305
10.10.200.6     50651   192.168.160.33  445     6       1       52
10.10.200.6     49332   192.168.160.33  445     6       1       52
10.10.200.6     49315   192.168.160.33  445     6       1       52
10.10.200.6     49318   192.168.160.33  80      6       3       152
192.168.160.33  445     10.10.200.6     50651   6       449     433683
10.10.200.6     49968   192.168.160.33  445     6       1       52
...

Код: Выделить всё

$IPACCTCTL ${IFACE}_ip_acct:$IFACE show >> $DIR/$NAME

Код: Выделить всё

# make install clean
===>  Vulnerability check disabled, database not found
===>  Found saved configuration for ng_ipacct-20061223
=> ng_ipacct-20061223.tar.gz doesn't seem to exist in /usr/ports/distfiles/.
=> Attempting to fetch from ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/local-distfiles/skv/.
ng_ipacct-20061223.tar.gz                     100% of   24 kB 7142  Bps
===>  Extracting for ng_ipacct-20061223
=> MD5 Checksum OK for ng_ipacct-20061223.tar.gz.
=> SHA256 Checksum OK for ng_ipacct-20061223.tar.gz.
===>  Patching for ng_ipacct-20061223
===>  Configuring for ng_ipacct-20061223
===>  Building for ng_ipacct-20061223
===> ng_ipacct (all)
Warning: Object directory not changed from original /usr/ports/net-mgmt/ng_ipacct/work/ng_ipacct/ng_ipacct
@ -> /usr/src/sys
machine -> /usr/src/sys/i386/include
:> opt_netgraph.h
cc -O2 -fno-strict-aliasing -pipe -DMEM_USE_ZONE -g  -D_KERNEL -DKLD_MODULE -std=c99 -nostdinc  -I/usr/ports/net-mgmt/ng_ipacct/work/ng_ipacct/ng_ipacct -I. -I@ -I@/contrib/altq -finline-limit=8000 --param inline-unit-growth=100 --param large-function-growth=1000 -fno-common  -mno-align-long-strings -mpreferred-stack-boundary=2  -mno-mmx -mno-3dnow -mno-sse -mno-sse2 -mno-sse3 -ffreestanding -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes  -Wmissing-prototypes -Wpointer-arith -Winline -Wcast-qual  -Wundef -Wno-pointer-sign -fformat-extensions -c ng_ipacct.c
ng_ipacct.c: In function 'pcb_get_cred':
ng_ipacct.c:905: error: too few arguments to function 'in_pcblookup_local'
*** Error code 1

Stop in /usr/ports/net-mgmt/ng_ipacct/work/ng_ipacct/ng_ipacct.
*** Error code 1

Stop in /usr/ports/net-mgmt/ng_ipacct/work/ng_ipacct.
*** Error code 1

Stop in /usr/ports/net-mgmt/ng_ipacct.
*** Error code 1

Stop in /usr/ports/net-mgmt/ng_ipacct.

Код: Выделить всё

#
# "/usr/local/www/apache22/cgi-bin" should be changed to whatever your ScriptAliased
# CGI directory exists, if you have that configured.
#
<Directory "/usr/local/www/apache22/cgi-bin">
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
</Directory>


Alias /pma/ "/usr/local/www/phpMyAdmin/"
<Directory "/usr/local/www/phpMyAdmin/">
    Options None
    AllowOverride Limit

    Order allow,deny
    Deny from all
    Allow from 127.0.0.1 192.168.0.8
</Directory>



#
# DefaultType: the default MIME type the server will use for a document
# if it cannot otherwise determine one, such as from filename extensions.
# If your server contains mostly text or HTML documents, "text/plain" is
# a good value.  If most of your content is binary, such as applications
# or images, you may want to use "application/octet-stream" instead to
# keep browsers from trying to display binary files as though they are
# text.
#
DefaultType text/plain

<IfModule mime_module>
    #
    # TypesConfig points to the file containing the list of mappings from
    # filename extension to MIME-type.
    #
    TypesConfig etc/apache22/mime.types

    #
    Addtype application/x-httpd-php .php
    Addtype application/x-httpd-php-source .phps