forum.lissyara.su

Код: Выделить всё

00050 check-state
00100 allow ip from any to any via lo0
00200 allow ip from any to any via ng0
00201 allow ip from any to any via ng1
00400 deny ip from any to 127.0.0.0/8
00450 deny ip from 127.0.0.0/8 to any
00500 deny ip from 192.168.0.0/24 to any in via sk0
00550 deny ip from xx.xx.xx.0/30 to any in via sk1
00600 deny ip from any to 10.0.0.0/8 in via sk0
00610 deny ip from any to 172.16.0.0/12 in via sk0
00620 deny ip from any to 0.0.0.0/8 in via sk0
00630 deny ip from any to 169.254.0.0/16 in via sk0
00700 deny ip from any to 224.0.0.0/4 in via sk0
00710 deny ip from any to 240.0.0.0/4 in via sk0
00800 deny icmp from any to any frag
00810 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00900 reject tcp from any to any tcpflags syn,fin,ack,psh,rst,urg
00910 reject tcp from any to any tcpflags !syn,!fin,!ack,!psh,!rst,!urg
00920 reject tcp from any to any not established tcpflags fin
00930 reject log logamount 100 ip from any to any not verrevpath in
01000 deny tcp from any to any dst-port 113 in via sk0
01100 deny tcp from any to any dst-port 137 in via sk0
01110 deny tcp from any to any dst-port 138 in via sk0
01120 deny tcp from any to any dst-port 139 in via sk0
01200 deny log logamount 100 icmp from any to 255.255.255.255 in via sk0
01210 deny log logamount 100 icmp from any to 255.255.255.255 out via sk0
01300 fwd 127.0.0.1,8080 tcp from 192.168.0.0/24 to any dst-port 80 via sk0
01400 divert 8668 ip from 192.168.0.0/24 to any out via sk0
01450 divert 8668 ip from any to xx.xx.xx.xx in via sk0
01500 deny ip from 10.0.0.0/8 to any out via sk0
01510 deny ip from 172.16.0.0/12 to any out via sk0
01520 deny ip from 0.0.0.0/8 to any out via sk0
01530 deny ip from 169.254.0.0/16 to any out via sk0
01600 deny ip from 224.0.0.0/4 to any out via sk0
01650 deny ip from 240.0.0.0/4 to any out via sk0
01700 deny icmp from any to xx.xx.xx.xx
01750 allow icmp from any to any icmptypes 0,8,11
01800 allow ip from any to 192.168.0.0/24 in via sk1
01850 allow ip from 192.168.0.0/24 to any out via sk1
01900 allow tcp from any to any established
02000 allow udp from any to xx.xx.xx.xx dst-port 53 in via sk0
02010 allow udp from xx.xx.xx.xx 53 to any out via sk0
02020 allow udp from any 53 to xx.xx.xx.xx in via sk0
02030 allow udp from xx.xx.xx.xx to any dst-port 53 out via sk0
02100 allow tcp from any to xx.xx.xx.xx dst-port 53 in via sk0
02200 allow tcp from any to xx.xx.xx.xx dst-port 35665 in via sk0 setup
02300 allow tcp from any to 192.168.0.222 dst-port 15655 via sk0 setup
02305 allow tcp from any to 192.168.0.222 dst-port 15655 via sk1 setup
02310 allow log logamount 100 tcp from any to 192.168.0.5 dst-port 25017 via sk0 setup
02315 allow tcp from any to 192.168.0.5 dst-port 25017 via sk1 setup
02320 allow tcp from any to 192.168.0.5 dst-port 26095 via sk0 setup
02325 allow tcp from any to 192.168.0.5 dst-port 26095 via sk1 setup
02330 allow tcp from any to 192.168.0.20 dst-port 51413 via sk0 setup
02335 allow tcp from any to 192.168.0.20 dst-port 51413 via sk1 setup
02340 allow tcp from any to 192.168.0.149 dst-port 21 via sk0 setup
02345 allow tcp from any to 192.168.0.149 dst-port 21 via sk1 setup
02350 allow tcp from any to 192.168.0.5 dst-port 26834 via sk0 setup
02355 allow tcp from any to 192.168.0.5 dst-port 26834 via sk1 setup
02400 allow tcp from any to xx.xx.xx.xx dst-port 1723 in via sk0 setup
02410 allow gre from any to any
02700 deny log logamount 100 tcp from any to xx.xx.xx.xx in via sk0 setup
02900 allow tcp from xx.xx.xx.xx to any out via sk0 setup
02950 allow tcp from any to xx.xx.xx.xx in via sk1 setup
03000 allow tcp from 192.168.0.0/24 to any dst-port 25,110,443 in via sk1 setup
03010 allow tcp from 192.168.0.80 to any in via sk1 setup
03020 allow tcp from 192.168.0.20 to any via sk1 setup
03030 allow tcp from 192.168.0.150 to any in via sk1 setup
03040 allow tcp from 192.168.0.5 to any in via sk1 setup
03050 allow tcp from 192.168.0.149 to any in via sk1 setup
03100 allow tcp from 192.168.0.60 to any in via sk1 setup
03110 allow tcp from 192.168.0.61 to any in via sk1 setup
03120 allow tcp from 192.168.0.62 to any in via sk1 setup
03130 allow tcp from 192.168.0.63 to any in via sk1 setup
03200 allow tcp from 192.168.0.24 to any dst-port 20,21,80,5190 in via sk1 setup
03210 allow tcp from 192.168.0.114 to any dst-port 20,21,80,8080,5190 in via sk1 setup
03220 allow tcp from 192.168.0.100 to any dst-port 20,21,80,5190 in via sk1 setup
03230 allow tcp from 192.168.0.123 to any in via sk1 setup
03240 allow tcp from 192.168.0.211 to any dst-port 20,21,80,8000,5190 in via sk1 setup
03250 allow tcp from 192.168.0.11 to any dst-port 20,21,80,5190 in via sk1 setup
03260 allow tcp from 192.168.0.223 to any in via sk1 setup
03270 allow tcp from 192.168.0.222 to any via sk1 setup
03280 allow tcp from 192.168.0.218 to any in via sk1 setup
03300 allow tcp from 192.168.0.215 to any dst-port 20,21,80,5190 in via sk1 setup
03310 allow tcp from 192.168.0.151 to any dst-port 20,21,80-89 in via sk1 setup
03320 allow tcp from 192.168.0.240 to any dst-port 20,21,80-95,5190 in via sk1 setup
03330 allow tcp from 192.168.0.152 to any dst-port 20,21,80 in via sk1 setup
03340 allow tcp from 192.168.0.153 to any dst-port 20,21,80,5190 in via sk1 setup
65534 deny ip from any to any
65535 allow ip from any to any

Код: Выделить всё

${FwCMD} 579 allow ip from ${NetIn} to not ${NetIn} limit src-addr 60