forum.lissyara.su

Код: Выделить всё

#Opisivaem tabl IP kotorim otkryt dostup http
table <http_hosts> const { 192.168.0.134, 192.168.0.1 }
#Opisivaem tabl IP kotorim otkryt dostup ftp
#table <ftp_hosts> const { 192.168.0.29 }
#Opisivaem tabl IP kotorim otryt dostup k statistike
table <stat_user> const { 192.168.0.134, 192.168.0.76 }
#Opisivaem gruppi portov
both = "{ tcp, udp }"                                   #Dlya pravil s dvoinimi
www_services = "{ http, https }"                        #Porti dlya Web
ftp_ports = "{ ftp-data, ftp, ftps-data, ftps, auth }"  #Porti dlya ftp
mail_ports = "{ pop3, pop3s, smtp, imap, imaps }"       #Porti dlya pochti
squid_ports = "{ 80, 81, 82, 83, 88, 8000, 8001, 8002, 8080, 8081 }"    #Chto pu

#Opisivaem interface
ext_if="bce0"                                           #Vneshniy interface
ext_ip="xxxxxxxxxx"                                   #Vneshniy IP
int_if="bce1"                                          #Vnutrenniy interface
int_ip="192.168.0.201"                                    #Vnutrenniy IP
lan_net="192.168.0.0/24"                                #Vnutrennyaya lokalka

#Opcii PF
set block-policy drop                                   #Otbrasivat levie paketi
set skip on lo0                                         #Ne filtrovat localhost (127.0.0.1)

# NAT
nat on $ext_if from $lan_net to any -> ($ext_if)
rdr on $int_if proto tcp from any to !$int_if:network port $squid_ports -> 127.0.0.1 port 3128

#Redirectim HTTP zaprosi na squid

#

########
# Rules start ####################################################################
###############
#pass all                                               #Razreshaem vse. Zakommentirovat pocle nastroyiki
block in all                                            #Raskommentirovat posle nastroiki dostupov iz lokalki
#block in quick on $int_if proto tcp from $int_if:network to any port 25 no state
#pass in quick on $ext_if proto tcp from any to any port 22 keep state

#Razreshaem ishod s ext_if
pass out on $ext_if from $ext_ip to any keep state
#
##############################################
# Pravila dostupa iz lokalki k etomu serveru ####################################
##############################################
pass in on $int_if inet proto tcp from <stat_user> to $int_ip port 80 keep state
#Razreshaem DNS zaprosi k etomu serveru
pass in on $int_if inet proto $both from $int_if:network to $int_ip port 53 keep state
#Razreshaem SSH dostup iz lokalki
pass on $int_if inet proto tcp from any to any port 22 keep state
#
##########################################
##########################################
# Pravila dlya dostupa iz lokalki v inet ########################################
##########################################
#Blokiruem http na vse IP
#block inet proto tcp from $int_if:network to any port $www_services
#Razreshaem http dlya IP opisannyh v tablice
pass in on $int_if inet proto tcp from <http_hosts> to any port $www_services keep state
#Razreshaem ICQ
pass in on $int_if inet proto tcp from $int_if:network to any port 5190 keep state
#Razreshaem pochtu
pass in on $int_if inet proto $both from $int_if:network to any port $mail_ports keep state
#Razreshaem Bank_klient
#pass in on $int_if inet proto tcp from <http_hosts> to (IPaddr i port banka) keep state
#Rubim icmp (ping) na naruzhnom interface
block in on $ext_if proto icmp from any to $ext_ip
#
#######################################
# Razreshaem ICMP (ping) i traceroute ###########################################
#######################################
#Razreshaem ICMP
pass proto icmp from any to any
#Otkrivaem porti dlya traceroute(8): "base+nhops*nqueries-1" (33434+64*3-1)
pass out inet proto udp from any to any port 33433 >< 33626 keep state
#
################
# End of rules ##################################################################
################

Код: Выделить всё

внешний_ип 3389 внутрений_ип 3389

Код: Выделить всё

rinetd: couldn't bind to address внешний_ип port 3389

Код: Выделить всё

sockstat -4

Код: Выделить всё

rdr pass on $ext_if inet proto {tcp, udp} from any to ($ext_if) port 5000 -> 192.168.1.179