forum.lissyara.su

Код: Выделить всё

# cat /etc/firewall.conf
#!/bin/sh
cmd="/sbin/ipfw"
wan="rl0"
lan="em0"
wanip="ххх.ххх.ххх.ххх"
lanip="192.168.2.250"
server1c="192.168.2.240"
modem="192.168.1.1"

${cmd} -f flush
${cmd} table 1 flush
${cmd} table 2 flush

${cmd} add check-state

${cmd} add allow ip from any to any via lo0

${cmd} add deny ip from any to 127.0.0.0/8
${cmd} add deny ip from 127.0.0.0/8 to any
${cmd} add deny ip from any to 10.0.0.0/8 in via ${wan}
${cmd} add deny ip from any to 172.16.0.0/12 in via ${wan}
# ne pinguet modem esli raskomentit
#${cmd} add deny ip from any to 192.168.0.0/16 in via ${wan}
${cmd} add deny ip from any to 0.0.0.0/8 in via ${wan}
${cmd} add deny ip from any to 169.254.0.0/16 in via ${wan}
${cmd} add deny ip from any to 240.0.0.0/4 in via ${wan}
${cmd} add deny icmp from any to any frag
${cmd} add deny log icmp from any to 255.255.255.255 in via ${wan}
${cmd} add deny log icmp from any to 255.255.255.255 out via ${wan}

${cmd} add deny all from any to 212.7.192.12
${cmd} add deny all from any to 195.95.206.214
${cmd} add deny all from any to 185.17.30.0
${cmd} add deny all from any to any 8108 via tun0
${cmd} add deny all from any 4504 to any
${cmd} add deny all from any 4857 to any

${cmd} add allow ip from any to ${lanip} 9999 via ${lan}
${cmd} add allow ip from any to ${wanip} 9999 via tun0

------>${cmd} nat 1 config if tun0 reset same_ports redirect_port tcp 192.168.2.240:3389 3389
${cmd} add nat 1 ip from any to any via tun0

Код: Выделить всё

{cmd} add deny ip from any to 192.168.0.0/16 in via ${wan}