forum.lissyara.su

Код: Выделить всё

100 deny ip from any to 8.72.18.17 setup

Код: Выделить всё

#!/bin/sh
ipfw -q -f flush
cmd="ipfw -q add"
skip="skipto 500"
net="tun0" интернет (webstream) adsl
lan="fxp0" морда каторая смотрит в локалку
access="192.168.0.3" этому можно всё
lan_in="192.168.0.0/24" сеть
out_tcp="22,25,37,43,53,67,68,80,81,85,443,110,210,2802,5190,8080,3218,5999,8030" исходящие порты

$cmd 010 permit icmp from any to any icmptype 0,8,11
$cmd 020 permit udp from any to any 137,138 in via $lan     
$cmd 030 permit tcp from any to any 139,445 in via $lan          
$cmd 040 unreach host ip from not $access to any in via $lan 
$cmd 050 allow all from any to any via lo0
$cmd 100 divert natd ip from not $lan_in to any in via $net

$cmd 101 check-state

$cmd 130 $skip udp from any to any 53 out via $net keep-state 
$cmd 135 $skip tcp from any to any $out_tcp out via $net setup keep-state
$cmd 140 $skip icmp from any to any out via $net keep-state
$cmd 145 $skip udp from any to any 123 out via $net keep-state

$cmd 150 deny all from 192.168.0.0/24  to any in via $net  #RFC 1918 private IP
$cmd 155 deny all from 172.16.0.0/12   to any in via $net  #RFC 1918 private IP
$cmd 160 deny all from 10.0.0.0/8      to any in via $net  #RFC 1918 private IP
$cmd 165 deny all from 127.0.0.0/8     to any in via $net  #loopback
$cmd 170 deny all from 0.0.0.0/8       to any in via $net  #loopback
$cmd 175 deny all from 169.254.0.0/16  to any in via $net  #DHCP auto-config
$cmd 180 deny all from 192.0.2.0/24    to any in via $net  #reserved for docs
$cmd 185 deny all from 204.152.64.0/23 to any in via $net  #Sun cluster
$cmd 190 deny all from 224.0.0.0/3     to any in via $net  #Class D & E multicast

$cmd 210 deny tcp from any to any 137 in via $net
$cmd 215 deny tcp from any to any 138 in via $net
$cmd 220 deny tcp from any to any 139 in via $net
$cmd 225 deny tcp from any to any 445 in via $net
$cmd 230 deny tcp from any to any 22 in via $net 
$cmd 235 deny tcp from any to any 23 in via $net 
$cmd 240 deny tcp from any to any 81 in via $net
$cmd 245 deny tcp from any to any 8229 in via $net
$cmd 250 deny tcp from any to any 828 in via $net
$cmd 255 deny all from any to any frag in via $net
$cmd 260 deny tcp from any to any established in via $net
$cmd 265 deny tcp from any to any 113 in via $net 
$cmd 270 deny log all from any to any in via $net
$cmd 300 deny log all from any to any out via $net

$cmd 500 divert natd ip from $lan_in to any out via $net
$cmd 501 allow ip from any to any  
$cmd 1000 deny log all from any to any