forum.lissyara.su

Код: Выделить всё

nat config if igb0
nat config if igb1

00010 allow ip from any to any via em1
00020 allow ip from any to any via em0
00030 allow ip from any to any via lo0

00100 nat 123 ip from 192.168.1.0/24 to any out via igb0
00105 nat 123 ip from any to 84.11.62.10 in via igb0
00106 nat 124 ip from 192.168.55.0/24 to any out via igb1
00107 fwd 195.12.142.1 ip from 195.12.142.54 to any via igb1
00108 nat 124 ip from any to 195.12.142.54 in via igb1
00120 allow ip from any to any

Код: Выделить всё

# em0 - igb1 (192.168.55.0/24 <-> 195.12.142.54->195.12.142.1)
# em1 - igb0 (192.168.1.0/24 <-> 84.11.62.10->84.11.62.1)

ipfw add allow all from any to any via lo0

ipfw nat 1 config log if igb0 same_ports reset deny_in
ipfw nat 2 config log if igb1 same_ports reset deny_in

ipfw setfib 0 ip from any to any in recv em0
ipfw setfib 1 ip from any to any in recv em1

ipfw add nat 2 ip from any to any via igb1
ipfw add nat 1 ip from any to any via igb0 

ipfw add deny ip from any to any

Код: Выделить всё

sysctl net.inet.fw.one_pass=0
...

# NAT wan_local
${FwCmd} nat 10 config if ${wan_local_if} deny_in reset log
${FwCmd} add 7400 nat 10 ip4 from ${int_net},${vpn_net} to ${wan_local_net} via ${wan_local_if} out
${FwCmd} add 7500 nat 10 ip4 from ${wan_local_net} to me via ${wan_local_if} in

# NAT internet
${FwCmd} nat 11 config if ${wan_inet_if} deny_in reset log 
${FwCmd} add 7600 nat 11 ip4 from ${int_net},${vpn_net} to any via ${wan_inet_if} out
${FwCmd} add 7700 nat 11 ip4 from any to me via ${wan_inet_if} in

# NAT on ext LAN
${FwCmd} nat 12 config if ${ext_if} deny_in reset log
${FwCmd} add 7800 nat 12 ip4 from ${int_net},${vpn_net} to ${ext_net} via ${ext_if} out
${FwCmd} add 7900 nat 12 ip4 from ${ext_net} to me via ${ext_if} in

...

Код: Выделить всё

00030     0       0 allow ip from any to any via lo0
00040  6027  519095 setfib 0 ip from any to any in recv em1
00041    10     715 setfib 1 ip from any to any in recv em0
00100  1464  164551 nat 123 ip from 192.168.1.0/24 to any out via igb0
00105  1519  967325 nat 123 ip from any to 84.11.62.10 in via igb0
00106     6     288 nat 124 ip from 192.168.55.0/24 to any out via igb1
00108     0       0 nat 124 ip from any to 195.12.142.54 in via igb1
00120 10297 1777308 allow ip from any to any
65535     3     384 allow ip from any to any

Код: Выделить всё

[Wed 17:16 root@zlon]/usr/home/west#uname -a
FreeBSD zlon 7.2-RELEASE FreeBSD 7.2-RELEASE #0: Wed Jul 15 16:22:48 MSD 2009     west@zlon:/usr/obj/usr/src/sys/WESTGATE3  amd64

Код: Выделить всё

[192.168.55.2] <-> [192.168.55.17] <-> [192.168.55.1 (NAT машина) 195.12.142.54] ->[195.12.142.1]

Код: Выделить всё

setfib1_enable="YES"
setfib1_defaultroute="1.2.3.4"

Код: Выделить всё

#!/bin/sh
# PROVIDE: SETFIB1
# REQUIRE: NETWORKING
# BEFORE: DAEMON
# 
# Add the following lines to /etc/rc.conf to enable setfib -1 at startup
# setfib1 (bool): Set to "NO" by default.
#                Set it to "YES" to enable setfib1
# setfib1_defaultroute (str): Set to "" by default
#		 Set it to ip address of default gateway for use in fib 1

. /etc/rc.subr

name="setfib1"
rcvar=`set_rcvar`

load_rc_config $name

[ -z "$setfib1_enable" ] && setfib1_enable="NO"
[ -z "$setfib1_defaultroute" ] && setfib1_defaultroute=""

start_cmd="${name}_start"
stop_cmd="${name}_stop"

setfib1_start()
{
        if [ ${setfib1_defaultroute} ]
        then
          setfib 1 route add -net default ${setfib1_defaultroute}
        else
          echo "Can not set default route for fib 1 - setfib1_defaultroute is not assigned in rc.conf!"
        fi
}

setfib1_stop()
{
	  setfib 1 route del -net default
}
run_rc_command "$1"

Код: Выделить всё

             inet       /\               inet   /\
           		|                       |
			|			|	
			|			|			
			\/                      \/
----------------------------------------------------------------------------------
                  igb0             ||            igb1
               84.52.60.241        ||           84.52.60.41
               255.255.255.192     ||           255.255.255.192 
               84.52.60.1          ||            84.52.60.1
                        /\         ||              /\
                        |          ||              |
FreeBSD router 7.2      |          ||              |
amd64 KERNEL NAT        |          ||              |
                        |          ||              | 
                        |          ||              | 
                        |          ||              |
                        \/         ||              \/ 
                   em0             ||            em1                              em2
                 192.168.88.1      ||           192.168.1.20
                 255.255.255.0     ||           255.255.255.240
                                   ||           192.168.1.17
------------------------------------------------------------------------------------
                        /\                         /\
                        |                           |
                        |                           |
                        \/                         \/   
                     сервер                        шлюз 
                    192.168.88.2                 192.168.1.17
                    192.168.88.1                    /\
                    255.255.255.0                    |
                                                     |
                                                    \/
                                                   сервер
                                                  192.168.1.2