forum.lissyara.su

Код: Выделить всё

# --  No restrictions on Loopback Interface [1]
pass in quick on lo0 all
pass out quick on lo0 all

# --  No restrictions on Local Interface [2]

pass in quick from 10.0.2.0/24 to 10.0.2.0/24
pass out quick from 10.0.2.0/24 to 10.0.2.0/24
block in quick from 10.0.2.0/24 to 10.0.0.0/16
block out quick from 10.0.0.0/16 to 10.0.2.0/24
pass in quick on vlan3
pass out quick on vlan3

pass in quick from 10.0.6.0/24 to 10.0.6.0/24
pass out quick from 10.0.6.0/24 to 10.0.6.0/24
block in quick from 10.0.6.0/24 to 10.0.0.0/16
block out quick from 10.0.0.0/16 to 10.0.6.0/24
pass in quick on vlan6
pass out quick on vlan6

pass in quick from 10.0.7.0/24 to 10.0.7.0/24
pass out quick from 10.0.7.0/24 to 10.0.7.0/24
block in quick from 10.0.7.0/24 to 10.0.0.0/16
block out quick from 10.0.0.0/16 to 10.0.7.0/24
pass in quick on vlan7
pass out quick on vlan7

pass in quick from 10.0.3.0/30 to 10.0.3.0/30
pass out quick from 10.0.3.0/30 to 10.0.3.0/30
block in quick from 10.0.3.0/30 to 10.0.0.0/16
block out quick from 10.0.0.0/16 to 10.0.3.0/30
pass in quick on vlan12
pass out quick on vlan12

pass in quick from 10.0.11.0/24 to 10.0.11.0/24
pass out quick from 10.0.11.0/24 to 10.0.11.0/24
block in quick from 10.0.11.0/24 to 10.0.0.0/16
block out quick from 10.0.0.0/16 to 10.0.11.0/24
pass in quick on vlan20
pass out quick on vlan20

pass in quick on vlan21 from xxx.xxx.xxx.xxx/29
pass out quick on vlan21 all

pass in quick on vlan1 all
pass out quick on vlan1 all

pass in quick from 10.0.5.0/24 to 10.0.1.16
pass out quick from 10.0.1.16 to 10.0.5.0/24
pass out quick from any to 10.0.5.252 port = 23
pass out quick from 10.0.5.1 to 10.0.5.9
pass in quick on vlan5 all
block out quick on vlan5 all


pass in quick on rl0 all
pass out quick on rl0 all

pass in quick on rl1 all
pass out quick on rl1 all

#pass in proto tcp from any to any port = 23
pass in proto tcp from any to any port = 25
#pass in proto tcp from any to any port = 110
#pass in proto tcp/udp from any to any port = 2222
# -- Let clients behind the firewall send out to the internet,
# -- and replies to come back in by keeping state [3]
#pass out quick on fxp0 proto tcp all keep state
#pass out quick on fxp0 proto udp all keep state
pass out quick on rl1 proto icmp all keep state

# -- Let's people access the services running on 
# -- this system [4]
#PASV FTP
#pass in quick on fxp0 proto tcp from any to any port 30000 >< 50000 flags S keep state 
# FTP
#pass in quick on fxp0 proto tcp from any to any port = 21
# SSH 
#pass in quick on fxp0 proto tcp from any to any port = 22
#ping
pass in log quick on rl1 proto icmp from any to any icmp-type 8 keep state
# DNS
pass in quick on rl1 proto tcp/udp from any to any port = 53
# WWW
pass in quick on rl1 proto tcp from any to any port = 80 keep state
#pass in quick on fxp0 proto tcp from any to any port = 23 keep state
#pass in quick on fxp0 proto tcp from any to any port = 25 keep state
#pass in quick on fxp0 proto tcp from any to any port = 110 keep state

Код: Выделить всё

diff -u ipfilter.orig ipfilter
--- ipfilter.orig       2004-12-22 15:28:37.000000000 -0600
+++ ipfilter    2004-12-22 15:55:23.000000000 -0600
@@ -44,8 +44,12 @@
 {
        echo "Enabling ipfilter."
        /sbin/ipf -E
-       /sbin/ipf -Fa
-       /sbin/ipf -6 -Fa
+       if [ -f /etc/ipf.conf ]; then
+               /sbin/ipf -Fa
+       fi
+       if [ -f /etc/ipf6.conf ]; then
+               /sbin/ipf -6 -Fa
+       fi
        if [ -f /etc/ipf.conf ]; then
                /sbin/ipf -f /etc/ipf.conf
        fi
@@ -64,8 +68,12 @@
 {
        echo "Reloading ipfilter rules."
 
-       /sbin/ipf -I -Fa
-       /sbin/ipf -6 -I -Fa
+       if [ -f /etc/ipf.conf ]; then
+               /sbin/ipf -I -Fa
+       fi
+       if [ -f /etc/ipf6.conf ]; then
+               /sbin/ipf -6 -I -Fa
+       fi
        if [ -f /etc/ipf.conf ] && ! /sbin/ipf -I -f /etc/ipf.conf; then
                err 1 "reload of ipf.conf failed; not swapping to new ruleset."
        fi

Код: Выделить всё

ipv6_enable="YES"

Код: Выделить всё

options        INET6                   #IPv6 communications protocols