forum.lissyara.su

Код: Выделить всё

#!/bin/sh
#Lan local
LanLocal=192.168.1.0/24
IPLocal=192.168.1.240
IFLocal=rl1
#Lan inet
LanInet=192.168.0.0/24
IPInet=192.168.0.240
IFInet=rl0
InetNat=192.168.1.1,192.168.1.7
InetMy=192.168.1.100,192.168.1.250
#erase all
ipfw -f flush
ipfw -f pipe flush
#pipe speed
ipfw pipe 1 config bw 0Kbit/s
ipfw pipe 2 config bw 16Kbit/s
ipfw pipe 3 config bw 32Kbit/s
ipfw pipe 4 config bw 64Kbit/s
ipfw pipe 5 config bw 128Kbit/s
ipfw pipe 6 config bw 256Kbit/s
ipfw pipe 7 config bw 512Kbit/s
ipfw pipe 8 config bw 1Mbit/s
ipfw pipe 9 config bw 2Mbit/s
ipfw pipe 10 config bw 4Mbit/s
ipfw pipe 11 config bw 8Mbit/s
ipfw pipe 12 config bw 16Mbit/s
ipfw pipe 13 config bw 32Mbit/s
#lo0
ipfw add 00101 allow ip from any to any via lo0
ipfw add 00102 deny ip from any to 127.0.0.0/8
ipfw add 00103 deny ip from 127.0.0.0/8 to any
#inet in
ipfw add 01000 pipe 7 ip from any to ${InetNat} out via ${IFLocal}
#inet out
ipfw add 02000 pipe 5 ip from ${InetNat} to any in via ${IFLocal}                                                     
#nat in                                                                                                               
ipfw add 03000 divert natd ip from ${InetNat},${InetMy} to any out via ${IFInet}                                                
#nat out                                                                                                              
ipfw add 03999 divert natd ip from any to ${IPInet} in via ${IFInet}

Код: Выделить всё

ipfw add deny ip from ${LanInet} to any in via ${IFInet}

Код: Выделить всё

uname -a
dmesg -a
ifconfig -a
netstat -r

Код: Выделить всё

ipfw add deny ip from ${LanInet} to any in via ${IFInet}

Код: Выделить всё

add 00050 check-state

# Allow IP via LAN-interface(s)
add 00420 allow ip from any to any via bce1

# Allow IP from me to any via WAN-interface
add 00430 allow ip from me to any via bce2 keep-state

# Deny IP from/to RFC1918 networks via WAN-interface(s)
add 01010 deny ip from any to 192.168.0.0/16 in recv bce2
add 01020 deny ip from 192.168.0.0/16 to any in recv bce2
add 01030 deny ip from any to 172.16.0.0/12 in recv bce2
add 01040 deny ip from 172.16.0.0/12 to any in recv bce2
add 01050 deny ip from any to 10.0.0.0/8 in recv bce2
add 01060 deny ip from 10.0.0.0/8 to any in recv bce2
add 01070 deny ip from any to 169.254.0.0/16 in recv bce2
add 01080 deny ip from 169.254.0.0/16 to any in recv bce2

# WAN-services
add 03020 allow tcp from any to me 21 in recv bce2 keep-state
add 03021 allow tcp from any to me 110 in recv bce2 keep-state
add 03022 allow tcp from any to me 143 in recv bce2 keep-state
add 03030 allow tcp from any to me 25 in recv bce2 keep-state
add 03040 allow tcp from any to me 1723 in recv bce2 keep-state
add 03050 allow tcp from any to me 5006 in recv bce2 keep-state
add 03060 allow tcp from any to me 80 in recv bce2 keep-state

nat 1 config if bce2 reset same_ports deny_in redirect_port tcp 192.168.9.49:3389 3389
add 50010 nat 1 ip from any to me via bce2
add 50030 nat 1 ip from 192.168.8.0.22 to any via bce2

add 65534 deny log ip from any to any