forum.lissyara.su

Код: Выделить всё

/etc/natd.conf

Код: Выделить всё

#log
port 8668
alias_address xxx.xxx.xxx.xxx
same_ports yes
dynamic yes
use_sockets yes
#sber-bank
redirect_port tcp 77.108.111.100:87 192.168.0.7:87
redirect_port udp 77.108.111.100:87 192.168.0.7:87
redirect_port udp 77.108.111.100:1024-65535 192.168.0.7:1024-65535
unregistered_only

Код: Выделить всё

/etc/rc.firewall

Код: Выделить всё

#!/bin/sh

ipfw="/sbin/ipfw -q"
# ipfw="/sbin/ipfw"
/usr/bin/killall -9 natd

ournet="192.168.0.0/24"
uprefix="192.168.0"
ifout="xl0"
ifuser="xl1"
oip="80.247.184.214"
uip="192.168.0.1"

${ipfw} -f flush

${ipfw} add 100 allow icmp from any to any
${ipfw} add 110 deny icmp from any to any in icmptype 5,9,13,14,15,16,17

${ipfw} add 200 allow all from any to any via lo0
${ipfw} add 400 allow tcp from any to me ssh,25,80
${ipfw} add 410 allow tcp from ${ournet} to ${uip} 9000
${ipfw} add 420 allow tcp from ${ournet} to ${uip} 110

${ipfw} add 500 divert natd all from ${ournet} to any out via ${ifout}
${ipfw} add 510 divert natd all from any to ${oip} in via ${ifout}
/sbin/natd -f /etc/natd.conf

# FTP
${ipfw} add 40110 pass tcp from any to any 20
${ipfw} add 40120 pass tcp from any 20 to any
${ipfw} add 40130 pass tcp from any to any 21
${ipfw} add 40140 pass tcp from any 21 to any
# DNS
${ipfw} add pass udp from me to any 53
${ipfw} add pass udp from any 53 to me
#буховская машина с банк-клиентами
${ipfw} add allow tcp from ${uprefix}.7 to ${uip} 3128 via ${ifuser}
${ipfw} add allow tcp from ${uip} 3128 to ${uprefix}.7 via ${ifuser}
${ipfw} add allow ip from ${uprefix}.7 to 195.5.142.162 via ${ifuser}
${ipfw} add allow ip from 195.5.142.162 to ${uprefix}.7 via ${ifuser}
#sberbank 
${ipfw} add allow all from ${uprefix}.7 to 77.108.111.100 via ${ifuser} 
${ipfw} add allow all from 77.108.111.100 to ${uprefix}.7 via ${ifuser}
${ipfw} add divert natd all from 77.108.111.100 to ${uprefix}.7 
#
${ipfw} add 30010 pass tcp from any to any established
${ipfw} add 30020 pass tcp from ${oip} to any setup
${ipfw} add deny log ip from any to any
${ipfw} add deny log tcp from any to any in via ${ifout} setup

Код: Выделить всё

/etc/rc.conf

Код: Выделить всё

 firewall_type="OPEN"
natd_enable="YES"
natd_interface="fxp0"
#natd_flags="-f /etc/natd.conf"
#natd_flags="-redirect_port udp 192.168.0.7:87 77.108.111.100 :87 -f /etc/natd.conf"
natd_flags="- dynamic -f /etc/natd.conf"

Код: Выделить всё

/etc/rc.firewall

Код: Выделить всё

#буховская машина
#доступ к сквиду для инета
${ipfw} add allow tcp from ${uprefix}.7 to ${uip} 3128 via ${ifuser}
${ipfw} add allow tcp from ${uip} 3128 to ${uprefix}.7 via ${ifuser}
#банк-клиент (не сбер)
${ipfw} add allow ip from ${uprefix}.7 to 195.5.142.162 via ${ifuser}
${ipfw} add allow ip from 195.5.142.162 to ${uprefix}.7 via ${ifuser}
#sberbank 
${ipfw} add allow all from ${uprefix}.7 to 77.108.111.100 via ${ifuser} 
${ipfw} add allow all from 77.108.111.100 to ${uprefix}.7 via ${ifuser}
${ipfw} add divert natd all from 77.108.111.100 to ${uprefix}.7 

Код: Выделить всё

/etc/natd.conf

Код: Выделить всё

#для не сберовского клиента
redirect_port tcp 192.168.0.7:1500 1500
#sber-bank
redirect_port tcp 77.108.111.100:87 192.168.0.7:87
redirect_port udp 77.108.111.100:87 192.168.0.7:87
redirect_port udp 77.108.111.100:1024-65535 192.168.0.7:1024-65535

Код: Выделить всё

#для не сберовского клиента
redirect_port tcp 192.168.0.7:1500 1500
#sber-bank
redirect_port tcp 192.168.0.7:87 87
redirect_port udp 192.168.0.7:87 87