forum.lissyara.su

Код: Выделить всё

## Net Settings ##
gateway_enable="YES"
hostname="proxy.domain.ru"
ifconfig_re0="inet 192.168.1.222 netmask 255.255.255.0"
ppp_enable="YES"
ppp_mode="ddial"
ppp_profile="bwc"
firewall_enable="YES"
firewall_script="/etc/list.ipfw"
firewall_logging="YES"
tcp_extensions="NO"
tcp_drop_synfin="YES"
icmp_drop_redirect="YES"
icmp_log_redirect="YES"

Код: Выделить всё

net.inet.ip.fw.one_pass: 1

Код: Выделить всё

FwCMD="/sbin/ipfw -q  "
LanOut="tun0"                           #Интерфейс созданный подключением PPPoE
LanIn="re0"                               #Интерфейс смотрящий в лок сеть
IpOut="81.18.81.18"               #Внешний стат IP 
IpIn="192.168.1.222"                 #Внутренний IP фри
NetMask="24"
NetIn="192.168.1.0"

${FwCMD} -f flush

#loopback
        ${FwCMD} 100 add allow all from any to any via lo0
        ${FwCMD} 101 add deny all from any to 127.0.0.0/8
        ${FwCMD} 102 add deny all from 127.0.0.0/8 to any

#       ${FwCMD} 110 add check-state




## SSH
        ${FwCMD} 120 add allow tcp from any to any 22 setup keep-state

###############################################################################################################
########################################## Firewall_Begin #####################################################

        ${FwCMD} add 1040 allow ip from any to any via re0

        ${FwCMD} nat 1 config log if tun0 reset same_ports deny_in \
                redirect_port tcp 192.168.1.102:3389 3389 \
                redirect_port udp 192.168.1.20:80 80

        ${FwCMD} add 10130 nat 1 ip from any to any via tun0
        ${FwCMD} add 10150 pass tcp from any to ${IpOut} 3389 via ${LanOut}
        ${FwCMD} add 10140 pass tcp from any to 192.168.1.102 3389 via ${LanOut}
        ${FwCMD} add 10140 pass tcp from any to 192.168.1.102 3389 via ${LanIn}

Код: Выделить всё

re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=389b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC>
        ether 1c:6f:65:85:e9:ec
        inet 192.168.1.222 netmask 0xffffff00 broadcast 192.168.1.255
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=3808<VLAN_MTU,WOL_UCAST,WOL_MCAST,WOL_MAGIC>
        ether 00:02:44:71:89:9a
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
plip0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> metric 0 mtu 1500
ipfw0: flags=8801<UP,SIMPLEX,MULTICAST> metric 0 mtu 65536
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=3<RXCSUM,TXCSUM>
        inet 127.0.0.1 netmask 0xff000000
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1492
        options=80000<LINKSTATE>
        inet 81.18.81.18 --> 2.2.2.3 netmask 0xffffffff
        Opened by PID 497

Код: Выделить всё

[14:33]/home/immortal/>ipfw show
00100   0     0 allow ip from any to any via lo0
00101   0     0 deny ip from any to 127.0.0.0/8
00102   0     0 deny ip from 127.0.0.0/8 to any
00120   0     0 allow tcp from any to any dst-port 22 setup keep-state
01040 324 34964 allow ip from any to any via re0
10130   3   144 nat 1 ip from any to any via tun0
10150   0     0 allow tcp from any to 81.18.118.195 dst-port 3389 via tun0
10160   0     0 allow tcp from any to 192.168.1.102 dst-port 3389 via tun0
10170   0     0 allow tcp from any to 192.168.1.102 dst-port 3389 via re0
65535   0     0 deny ip from any to any

Код: Выделить всё

[14:19]/home/immortal/>tcpdump -i tun0 tcp port 3389
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type NULL (BSD loopback), capture size 96 bytes
14:20:12.379132 IP 81.18.115.84.2700 > 81.18.81.18.rdp: Flags [S], seq 3266011509, win 16384, options [mss 1360,nop,nop,sackOK], length 0
14:20:15.418094 IP 81.18.115.84.2700 > 81.18.81.18.rdp: Flags [S], seq 3266011509, win 16384, options [mss 1360,nop,nop,sackOK], length 0
14:20:21.432593 IP 81.18.115.84.2700 > 81.18.81.18.rdp: Flags [S], seq 3266011509, win 16384, options [mss 1360,nop,nop,sackOK], length 0

tcpdump -i tun0 tcp port 3389
Не дал результата...

Код: Выделить всё

ext_if="tun0"   # replace with actual external interface name i.e., dc0
int_if="em1"    # replace with actual internal interface name i.e., dc1
tcp_services="{ 23, 22, 2120, 8021, 49152:65535, 19114, 57400, 1413, 3389, 21 }"
server="192.168.1.10"
rdr on $ext_if proto tcp from any to ($ext_if) port 3389 -> $server port 3389
pass in on $ext_if inet proto tcp from any to $server port $tcp_services flags S/SA keep state
pass out keep state

Код: Выделить всё

ppp_enable="YES"
ppp_mode="ddial"
ppp_nat="YES"
ppp_profile="pppoe"
pf_enable="YES"
pf_rules="/etc/pf.conf"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"