forum.lissyara.su

Код: Выделить всё

 uname -a
FreeBSD 8.2-RELEASE-p1 FreeBSD 8.2-RELEASE-p1

Код: Выделить всё

2011/09/16 12:59:48 [crit] 73921#0: *703391 connect() to 192.168.1.35:9801 failed (1: Operation not permitted) while connecting to upstream, client: 212.158.161.136, server: ro.plus1.wapstart.ru, request: "GET /?area=viewBanner&version=2&id=4521&pageId=a23467421c106d32d1377774be04311a26d2fa48&ip=109.71.225.195&encoding=1&markup=3 HTTP/1.1", upstream: "fastcgi://192.168.1.35:9801", host: "ro.plus1.wapstart.ru"
2011/09/16 12:59:48 [crit] 73922#0: *703417 connect() to 192.168.1.36:9801 failed (1: Operation not permitted) while connecting to upstream, client: 194.67.27.118, server: ro.plus1.wapstart.ru, request: "GET /?area=viewBannerXml&version=2&id=150&pageId=ecf77cfc3d7115e0929b0c1480c78fdf2c64ce75&ip=82.145.211.32&encoding=1&sex=1&age=23&geoData=a%3A2%3A%7Bs%3A2%3A%22id%22%3Bs%3A3%3A%22150%22%3Bs%3A7%3A%22geoData%22%3Bs%3A4%3A%229977%22%3B%7D HTTP/1.1", upstream: "fastcgi://192.168.1.36:9801", host: "ro.plus1.wapstart.ru"
2011/09/16 12:59:48 [crit] 73921#0: *703517 connect() to 192.168.1.35:9801 failed (1: Operation not permitted) while connecting to upstream, client: 212.113.110.43, server: ro.plus1.wapstart.ru, request: "GET /?area=viewBannerXml&pageId=80d983db31168832be021522d9cdf237e57beecb&site=113&markup=3&userAgent=Nokia5130c-2%2F2.0+%2807.91%29+Profile%2FMIDP-2.1+Configuration%2FCLDC-1.1&ip=212.113.110.43 HTTP/1.0", upstream: "fastcgi://192.168.1.35:9801", host: "ro.plus1.wapstart.ru"

Код: Выделить всё

bsd2# cat /etc/pf.conf
int_if_ph="bge0"
ext_if_ph="bge1"
ext_if_alias="123123"
int_if="carp0"
ext_if="{ carp1 carp2 carp3 carp4 carp5 carp9 carp10 carp12 carp13 carp14}"

jail_ext_nginx_ip="{ 123123 }"
test_server_ip="{ 192.168.1.203 }"
test_server_ext_ip="{ 123123 }"
wapstart_server_ip="{ 123123 }"
wapstart_server_ext_ip="{ 123123 }"
bitrix_server_ip="{ 123123 }"
bitrix_server_ext_ip="{ 123123 }"
webmoney_ips="{ 123123 }"

set state-policy if-bound
set limit { states 10000000, frags 3000000, src-nodes 200000, tables 1000, table-entries 5000000 }
#set optimization aggressive
#set timeout interval 5

nat on $ext_if_ph from 192.168.1/24 to $webmoney_ips -> $ext_if_alias
nat on $ext_if_ph from 192.168.1/24 to !$int_if_ph -> $ext_if_ph
nat on $ext_if_ph from 192.168.1/24 to !$int_if -> $ext_if_ph

nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"

rdr pass on $int_if_ph proto tcp from $int_if_ph:network to any port 21 -> 127.0.0.1 port 8021
rdr pass on $int_if proto tcp from $int_if:network to any port 21 -> 127.0.0.1 port 8021

rdr pass on $ext_if_ph proto tcp from ! $int_if:network to $test_server_ext_ip port { 80 443 10443 11443 12443 } -> $test_server_ip
rdr pass on $ext_if_ph proto tcp from ! $int_if:network to $test_server_ext_ip port { 10022 } -> $test_server_ip port 22
rdr pass on $ext_if_ph proto tcp from ! $int_if:network to $wapstart_server_ext_ip port { 80 443 } -> $wapstart_server_ip
rdr pass on $ext_if_ph proto tcp from ! $int_if:network to $bitrix_server_ext_ip port { 80 443 } -> $bitrix_server_ip
rdr pass on $ext_if_ph proto tcp from ! $int_if:network to $bitrix_server_ext_ip port { 8080 } -> 192.168.1.205 port 80

block log inet6
block in log on $ext_if
block in log on $ext_if_ph
set skip on lo0
pass out

anchor "ftp-proxy/*"
pass proto tcp from 127.0.0.1 to any port 21 keep state

#pass quick on $int_if_ph proto pfsync keep state (no-sync)
#pass quick on $int_if proto pfsync keep state (no-sync)
#block quick proto pfsync
pass on $int_if_ph proto carp keep state
pass on $ext_if_ph proto carp keep state
pass on $int_if proto carp keep state
pass on $ext_if proto carp keep state

pass in on $ext_if_ph proto tcp to $jail_ext_nginx_ip port { 80 443 10443 11443 12443 } keep state
pass proto { tcp, udp } to port 53 keep state
pass on $ext_if_ph proto tcp to port { 10022 } keep state
pass from $jail_ext_nginx_ip to $jail_ext_nginx_ip
pass quick from $jail_ext_nginx_ip to 192.168.1.0/24
pass quick from 192.168.1.0/24 to $jail_ext_nginx_ip
pass quick from { 192.168.1.24 192.168.1.25 } to 192.168.1.0/24
pass quick from 192.168.1.0/24 to { 192.168.1.24 192.168.1.25 }
pass proto icmp

pass on $int_if
pass on $int_if_ph

Код: Выделить всё

# tcpdump -nettti pflog0 port 80

Код: Выделить всё

pass log on...