forum.lissyara.su

Код: Выделить всё

IPF="ipfw -q add"
ipfw -q -f flush
#loopback
$IPF 1 fwd 127.0.0.1,3128 tcp from 192.168.0.111/24 to any 80 out via msk1
$IPF add 2 divert natd ip from any to any via msk1
$IPF 10 allow all from any to any via lo0
#$IPF 20 deny all from any to 127.0.0.0/8
#$IPF 30 deny all from 127.0.0.0/8 to any
#$IPF 40 deny tcp from any to any frag
# statefull
$IPF 50 check-state
$IPF 60 allow tcp from any to any established
$IPF 70 allow all from any to any out keep-state
$IPF 80 allow icmp from any to any
# open port ftp (20,21), ssh (22), mail (25)
# http (80), dns (53) etc
$IPF 110 allow tcp from any to any 21 in
$IPF 120 allow tcp from any to any 21 out
$IPF 130 allow tcp from any to any 22 in
$IPF 140 allow tcp from any to any 22 out
$IPF 150 allow tcp from any to any 25 in
$IPF 160 allow tcp from any to any 25 out
$IPF 170 allow udp from any to any 53 in
$IPF 175 allow tcp from any to any 53 in
$IPF 180 allow udp from any to any 53 out
$IPF 185 allow tcp from any to any 53 out
$IPF 200 allow tcp from any to any 80 in
$IPF 210 allow tcp from any to any 80 out
$IPF 250 allow tcp from any to any 443 in
$IPF 260 allow tcp from any to any 443 out
$IPF 420 allow tcp from any to any 3128 in
$IPF 430 allow tcp from any to any 3128 out


# deny and log everything
$IPF 500 deny log all from any to any

Код: Выделить всё

 $IPF add 2 divert natd ip from any to any via msk1

Код: Выделить всё

ergo# ipfw show

Код: Выделить всё

00001   0     0 fwd 127.0.0.1,3128 tcp from 192.168.0.0/24 to any dst-port 80 out via msk1
00010   0     0 allow ip from any to any via lo0
00050   0     0 check-state
00060 112 19410 allow tcp from any to any established
00070  39  2642 allow ip from any to any out keep-state
00080   0     0 allow icmp from any to any
00110   0     0 allow tcp from any to any dst-port 21 in
00120   0     0 allow tcp from any to any dst-port 21 out
00130   2   104 allow tcp from any to any dst-port 22 in
00140   0     0 allow tcp from any to any dst-port 22 out
00150   0     0 allow tcp from any to any dst-port 25 in
00160   0     0 allow tcp from any to any dst-port 25 out
00170   0     0 allow udp from any to any dst-port 53 in
00175   0     0 allow tcp from any to any dst-port 53 in
00180   0     0 allow udp from any to any dst-port 53 out
00185   0     0 allow tcp from any to any dst-port 53 out
00200   0     0 allow tcp from any to any dst-port 80 in
00210   0     0 allow tcp from any to any dst-port 80 out
00250   0     0 allow tcp from any to any dst-port 443 in
00260   0     0 allow tcp from any to any dst-port 443 out
00420   0     0 allow tcp from any to any dst-port 3128 in
00430   0     0 allow tcp from any to any dst-port 3128 out
00500  25  2446 deny log ip from any to any
65535   6   432 deny ip from any to any

Код: Выделить всё

ergo# service ipfw restart

Код: Выделить всё

ergo# ipfw show

Код: Выделить всё

00001  0    0 fwd 127.0.0.1,3128 tcp from 192.168.0.0/24 to any dst-port 80 out via msk1
00002  0    0 divert 8668 ip from any to any via msk1
00010  0    0 allow ip from any to any via lo0
00050  0    0 check-state
00060 11 1084 allow tcp from any to any established
00070  0    0 allow ip from any to any out keep-state
00080  0    0 allow icmp from any to any
00110  0    0 allow tcp from any to any dst-port 21 in
00120  0    0 allow tcp from any to any dst-port 21 out
00130  0    0 allow tcp from any to any dst-port 22 in
00140  0    0 allow tcp from any to any dst-port 22 out
00150  0    0 allow tcp from any to any dst-port 25 in
00160  0    0 allow tcp from any to any dst-port 25 out
00170  0    0 allow udp from any to any dst-port 53 in
00175  0    0 allow tcp from any to any dst-port 53 in
00180  0    0 allow udp from any to any dst-port 53 out
00185  0    0 allow tcp from any to any dst-port 53 out
00200  0    0 allow tcp from any to any dst-port 80 in
00210  0    0 allow tcp from any to any dst-port 80 out
00250  0    0 allow tcp from any to any dst-port 443 in
00260  0    0 allow tcp from any to any dst-port 443 out
00420  0    0 allow tcp from any to any dst-port 3128 in
00430  0    0 allow tcp from any to any dst-port 3128 out
00500  1  229 deny log ip from any to any
65535  6  432 deny ip from any to any