Не бойся, когда ты один. Бойся, когда ты ноль.
https://forum.lissyara.su/
Код: Выделить всё
ipfw showКод: Выделить всё
pfctl -a '*'Код: Выделить всё
bge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,LINKSTATE>
ether 00:08:02:96:68:de
inet 192.168.0.200 netmask 0xffffff00 broadcast 192.168.0.255
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33184
pfsync0: flags=0<> metric 0 mtu 1500
syncpeer: 0.0.0.0 maxupd: 128 defer: off
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
inet 127.0.0.1 netmask 0xff000000
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
ng0: flags=88d1<UP,POINTOPOINT,RUNNING,NOARP,SIMPLEX,MULTICAST> metric 0 mtu 1492
inet 100.71.115.83 --> 100.71.0.1 netmask 0xffffffff
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
Код: Выделить всё
scrub in all fragment reassemble
scrub out all random-id max-mss 1440 fragment reassemble
block drop in log quick on ! lo inet6 from ::1 to any
block drop in log quick on ! lo inet from 127.0.0.0/8 to any
block drop in log quick on ! ng0 inet from 100.71.115.83 to any
block drop in log quick inet from 100.71.115.83 to any
block drop in log quick inet from 127.0.0.1 to any
block drop in log quick on ! bge0 inet from 192.168.0.0/24 to any
block drop in log quick inet from 192.168.0.200 to any
block drop in log quick inet6 from ::1 to any
block drop in log quick on lo0 inet6 from fe80::1 to any
block drop in quick inet from no-route to any
block drop in quick on ng0 inet from any to 255.255.255.255
block return out quick on ng0 inet from any to <ban>
block drop in quick on bge0 inet from (bge0:network) to 255.255.255.255
block drop all
pass in on bge0 inet proto tcp from (bge0:network) to (bge0) port = domain flags S/SA keep state queue etherq
pass in on bge0 inet proto tcp from (bge0:network) to (bge0) port = 33022 flags S/SA keep state queue etherq
pass in on bge0 inet proto udp from (bge0:network) to (bge0) port = domain keep state queue etherq
pass in on bge0 inet proto udp from (bge0:network) to (bge0) port = ntp keep state queue etherq
pass out on bge0 inet proto tcp from (bge0) port = domain to (bge0:network) flags S/SA keep state queue etherq
pass out on bge0 inet proto tcp from (bge0) port = 33022 to (bge0:network) flags S/SA keep state queue etherq
pass out on bge0 inet proto udp from (bge0) port = domain to (bge0:network) keep state queue etherq
pass out on bge0 inet proto udp from (bge0) port = ntp to (bge0:network) keep state queue etherq
pass in log on bge0 inet proto icmp from (bge0:network) to ! (self:network) icmp-type echoreq keep state queue d_other tag INET_OTHER
pass in log on bge0 inet proto icmp from (bge0:network) to ! (self:network) icmp-type unreach keep state queue d_other tag INET_OTHER
pass in log quick on bge0 inet from <pc_hipri> to ! (self:network) flags S/SA modulate state queue(d_hipri, d_ack) tag INET_HIPRI
pass in log quick on bge0 inet from <pc_pri> to ! (self:network) flags S/SA modulate state queue(d_pri, d_ack) tag INET_PRI
pass in log quick on bge0 inet from <pc_other> to ! (self:network) flags S/SA modulate state queue(d_other, d_ack) tag INET_OTHER
pass in quick on ng0 inet proto tcp from any to (ng0) port = 33022 flags S/SA keep state (source-track rule, max-src-conn-rate 3/60, overload <ban> flush global, src.track 60) queue(ssh_login, ssh_data)
pass out quick on ng0 inet from (ng0) to any flags S/SA modulate state queue(u_hipri, u_ack) tagged INET_HIPRI
pass out quick on ng0 inet from (ng0) to any flags S/SA modulate state queue(u_pri, u_ack) tagged INET_PRI
pass out quick on ng0 inet from (ng0) to any flags S/SA modulate state queue(u_other, u_ack) tagged INET_OTHER
pass out quick on ng0 inet proto icmp from (ng0) to any icmp-type echoreq keep state queue u_other
pass out quick on ng0 inet proto icmp from (ng0) to any icmp-type unreach keep state queue u_other
pass out quick on ng0 inet proto tcp from (ng0) to any port = domain flags S/SA modulate state queue(u_dns, u_ack)
pass out quick on ng0 inet proto udp from (ng0) to any port = domain keep state queue u_dns
pass out quick on ng0 inet from (ng0) to any flags S/SA keep state queue(u_pri, u_ack)
Код: Выделить всё
block in quick on $int_if proto udp from any to $int_if:broadcast port 67
block in quick on $int_if proto udp from any to ($int_if) port 67Да DHCP и Pf находятся на одной машине. Я так понял приоритет правил bpf выше на порядок чем PfЕсли речь о dhcp и firewall на одной машине, причина в работе DHCP через bpf.
