forum.lissyara.su

Код: Выделить всё

hostname="gate"
gateway_enable="YES"
ifconfig_re0="inet 192.168.2.215 netmask 255.255.255.0"
firewall_enable="YES"
firewall_script="/etc/firewall"
ppp_enable="YES"
ppp_mode="ddial"
ppp_nat="NO"
ppp_profile="bwc"

Код: Выделить всё

${fw} -f flush

${fw} 101 add pass ip from any to any via lo0
${fw} 102 add deny ip from any to 127.0.0.0/8
${fw} 103 add deny ip from 127.0.0.0/8 to any
${fw} add check-state

## Forward on squid ##
${fw} add allow tcp from me to any out via ${LanOut} uid squid keep-state
${fw} add fwd 127.0.0.1,3128 tcp from ${MyNet} to any dst-port 80 via ${LanOut}

${fw} add pass ip from any to any via ${LanIn}
${fw} add pass tcp from any to any established
${fw} add pass ip from ${IpIn} to any out xmit ${LanOut}
${fw} add pass icmp from any to any
${fw} add pass udp from any 53 to ${IpOut} in via ${LanOut}
${fw} add pass udp from ${IpOut} to any 53 out via ${LanOut}

Код: Выделить всё

default:
 set log Phase Chat LCP IPCP CCP tun command
 ident user-ppp VERSION
 disable ipv6cp
 set speed sync
 set mru 1492
 set mtu 1492
 set ctsrts off
 enable lqr
 set timeout 0

provider:
 set device PPPoE:vr0
 set authname 0123456
 set authkey P@ssw0rd
 set dial
 set login
 add default HISADDR
 set redial 0 0
 set reconnect 1 0

Код: Выделить всё

[16:31] gate /home/immortal >ipfw show
00101    0      0 allow ip from any to any via lo0
00102    0      0 deny ip from any to 127.0.0.0/8
00103    0      0 deny ip from 127.0.0.0/8 to any
00203    0      0 check-state
00303    0      0 allow tcp from me to any out via tun0 uid squid keep-state
00403    0      0 fwd 127.0.0.1,3128 tcp from 192.168.0.0/16 to any dst-port 80 via tun0
00503  157  15989 allow ip from any to any via re0
00603    0      0 divert 8668 ip from 192.168.0.0/16 to any out via tun0
00703    0      0 divert 8668 ip from any to 81.18.118.195 in via tun0
00803    0      0 allow tcp from any to any established
00903    0      0 allow ip from 192.168.2.215 to any out xmit tun0
01003    0      0 allow icmp from any to any
01103    0      0 allow udp from any 53 to 81.18.118.195 in via tun0
01203    0      0 allow udp from 81.18.118.195 to any dst-port 53 out via tun0
65535 7122 693200 deny ip from any to any

Код: Выделить всё

ipfw show

Код: Выделить всё

visible_hostname gate.domain.ru
connect_timeout 20 second
shutdown_lifetime 1 seconds
cache_mem 256 MB
maximum_object_size_in_memory 512 KB
access_log daemon:/var/log/squid/access.log squid
redirect_program /usr/local/bin/samsredir
logfile_rotate 7

#acl localnet src 10.0.0.0/8    # RFC1918 possible internal network
#acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
#acl localnet src fc00::/7       # RFC 4193 local private network range
#acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

# Deny requests to certain unsafe ports
http_access deny !Safe_ports

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager

#http_access deny to_localhost

http_access allow localnet
http_access allow localhost

# And finally deny all other access to this proxy
http_access deny all

# Squid normally listens to port 3128
http_port 3128 intercept

# Uncomment and adjust the following to add a disk cache directory.
#cache_dir ufs /var/squid/cache/squid 100 16 256

# Leave coredumps in the first cache dir
coredump_dir /var/squid/cache/squid
#
# Add any of your own refresh_pattern entries above these.
#
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

Код: Выделить всё

http_port IP:3128 intercept