forum.lissyara.su

Код: Выделить всё

defaultrouter="xxx.xxx.xxx.xxx"
gateway_enable="YES"
hostname="gw.verilion-ltd.ru"
ifconfig_vr0="inet xxx.xxx.xxx.xxx  netmask 255.255.255.252" #ext ip
ifconfig_alc0="inet xxx.xxx.xxx.xxx  netmask 255.255.255.0" #local ip
keymap="ru.koi8-r"
natd_enable="YES"
natd_interface="vr0"
natd_program="/sbin/natd"
natd_flags="-f /etc/natd.conf"
firewall_enable="YES"
firewall_script="/etc/rc.firewall"
sshd_enable="YES"
dhcpd_enable="YES"
webmin_enable="YES"
rinetd_enable="YES"
squid_enable="YES"
apache_enable="YES"
cleartmp_enable="YES"

Код: Выделить всё

fwcmd="/sbin/ipfw -q"
${fwcmd} -f flush
oif="vr0"
onet=" xxx.xxx.xxx.xxx"
omask="255.255.255.252"
oip=" xxx.xxx.xxx.xxx"
iif="alc0"
inet=" xxx.xxx.xxx.xxx"
imask="255.255.255.0"
iip=" xxx.xxx.xxx.xxx"
${fwcmd} add check-state
${fwcmd} add allow ip from any to any via lo0
${fwcmd} add deny ip from any to 127.0.0.0/8
${fwcmd} add deny ip from 127.0.0.0/8 to any

#    ${fwcmd} add deny ip from any to 10.0.0.0/8 in via ${oif}
    ${fwcmd} add deny ip from any to 172.16.0.0/12 in via ${oif}
#    ${fwcmd} add deny ip from any to 192.168.0.0/16 in via ${oif}
    ${fwcmd} add deny ip from any to 0.0.0.0/8 in via ${oif}
    ${fwcmd} add deny ip from any to 169.254.0.0/16 in via ${oif}
    ${fwcmd} add deny ip from any to 240.0.0.0/4 in via ${oif}
    ${fwcmd} add deny ip from 224.0.0.0/4 to any in via ${oif}
    ${fwcmd} add deny icmp from any to any frag
    ${fwcmd} add deny icmp from any to 255.255.255.255 in via ${oif}
    ${fwcmd} add deny icmp from any to 255.255.255.255 out via ${oif}

# squid
    ${fwcmd} add fwd 127.0.0.1,3128 tcp from 192.168.10.251,192.168.10.252 to any 80,443,8080 via ${oif}
# nat
 ${fwcmd} add divert 8668 ip from ${inet}:${imask} to any out via ${oif}
 ${fwcmd} add divert 8668 ip from any to ${oip} in via ${oif}
							    
# deny through oif
#    ${fwcmd} add deny ip from 10.0.0.0/8 to any out via ${oif}
    ${fwcmd} add deny ip from 172.16.0.0/12 to any out via ${oif}
#    ${fwcmd} add deny ip from 192.168.0.0/16 to any out via ${oif}
    ${fwcmd} add deny ip from 0.0.0.0/8 to any out via ${oif}
    ${fwcmd} add deny ip from 169.254.0.0/16 to any out via ${oif}
    ${fwcmd} add deny ip from 224.0.0.0/4 to any out via ${oif}
    ${fwcmd} add deny ip from 240.0.0.0/4 to any out via ${oif}
										
    ${fwcmd} add deny tcp from any to any in tcpflags fin,syn

 # Allow outbound traffic
    ${fwcmd} add allow ip from ${oip} to any out via ${oif}
											        
# Allow all protocols in localnet
    ${fwcmd} add allow tcp from any to any via ${iif}
    ${fwcmd} add allow udp from any to any via ${iif}
    ${fwcmd} add allow icmp from any to any via ${iif}
													
# 
    ${fwcmd} add allow tcp from any to any established
    ${fwcmd} add allow ip from any to any frag
													    
# NTP
    ${fwcmd} add allow udp from any 123 to any via ${oif}
#    ${fwcmd} add allow udp from any to any 123 via ${oif}

# ICMP
   ${fwcmd} add allow icmp from any to any icmptypes 0,3,8,11 via ${oif}