forum.lissyara.su

Код: Выделить всё

#!/bin/sh

fw="/sbin/ipfw"

# интернет  
inet="tun0"
ipInet = "XXX.XXX.XXX.XXX"

#внутренний интерфейс
local="re0"
iplocal = "192.168.0.250"

# VPN 1
vpn1="rl0"
ipvpn1 = "10.10.0.100"
gatewayVPN1 = "10.10.0.101"

#VPN2
vpn2="vr0"
ipvpn = "192.168.30.1"

$fw -q -f flush
$fw -q -f pipe flush
$fw -q -f queue flush

$fw add allow ip from any to any via lo0

$fw add deny ip from any to 127.0.0.0/8
$fw add deny ip from 127.0.0.0/8 to any

$fw add deny all from 192.168.0.0/16  to any in via ${inet} 
$fw add deny all from 172.16.0.0/12   to any in via ${inet} 
$fw add deny all from 10.0.0.0/8      to any in via ${inet}  
$fw add deny all from 127.0.0.0/8     to any in via ${inet}  
$fw add deny all from 0.0.0.0/8       to any in via ${inet}
$fw add deny all from 169.254.0.0/16  to any in via ${inet}  
$fw add deny all from 192.0.2.0/24    to any in via ${inet}  
$fw add deny all from 204.152.64.0/23 to any in via ${inet}  
$fw add deny all from 224.0.0.0/3     to any in via ${inet}  


$fw add deny icmp from any to any via ${inet}


$fw table 0 add 192.168.0.0/24

$fw nat 1 config log if ${inet} reset same_ports

$fw add nat 1 ip from any to any via ${inet}

$fw add allow ip from any to any via re0

$fw add allow ip from any to 10.10.0.1 via $vpn1
$fw add allow ip from 10.10.0.1 to any via $vpn1

Код: Выделить всё

#!/bin/sh
fw="/sbin/ipfw"

# интернет  
inet="tun0"
ipInet = "XXX.XXX.XXX.XXX"

#внутренний интерфейс
local="re0"
iplocal = "192.168.0.250"

$fw -q -f flush
$fw -q -f pipe flush
$fw -q -f queue flush

$fw add allow ip from any to any via lo0
$fw add deny ip from any to 127.0.0.0/8
$fw add deny ip from 127.0.0.0/8 to any

$fw add allow ip from any to any via $local
$fw add allow ip from me to any via $inet keep-state

$fw table 0 add 192.168.0.0/24
$fw nat 1 config log if $inet reset same_ports deny_in
$fw add nat 1 ip from any to any via $inet