forum.lissyara.su

Код: Выделить всё

options         ROUTETABLES=2
#netgraph(4) system
options         NETGRAPH
options         NETGRAPH_PPPOE
options         NETGRAPH_SOCKET
options         NETGRAPH_ETHER
options         NETGRAPH_TEE

#firewall
options         IPFIREWALL
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=200
options         IPFIREWALL_FORWARD
options         IPDIVERT
options         DUMMYNET

Код: Выделить всё

#!/bin/sh

fwcmd="/sbin/ipfw"

ext_if=Сетевая карта, смотрит в сторону инета
int_if=Сетевая карта, смотрит в сторону локалки
ext_ip=Внешний айпи выданный провайдером

${fwcmd} -f flush

no comments ;)
${fwcmd} add 90 allow ip from 127.0.0.1 to 127.0.0.1

###########################################################
# global counter
###########################################################
Здесь чтобы неотправлял почту через другие почтовые сервера, полезно, когда поселиться вирус и начингает спамить в НАТ.
${fwcmd} add 900 reset log tcp from 10.0.0.0/8 to any 25 out xmit ${ext_if}
###########################################################
# denying external connection to proxy
###########################################################
${fwcmd} add 1000 deny log tcp from any to me 3128,1080 in via ${ext_if}
${fwcmd} add 1010 skipto 1040 ip from 10.209.109.0/24 to 10.209.109.1
${fwcmd} add 1020 skipto 1040 ip from 10.209.109.1 to 10.209.109.0/24
${fwcmd} add 1030 deny log tcp from any to me 3128,1080
${fwcmd} add 1031 deny log udp from any to me 3128,1080
${fwcmd} add 1032 deny tcp from 10.209.109.0/24 to any 1080,2080

# allowing our ftp, http
${fwcmd} add 2000 skipto 3600 tcp from 10.209.109.0/24 to me 80,21

# denying some packets
${fwcmd} add 3000 deny log ip from 10.209.109.0/24 to any in recv ${ext_if}
${fwcmd} add 3040 deny log ip from 224.0.0.0/8 to any in recv ${ext_if}
${fwcmd} add 3050 deny ip from any to any frag
${fwcmd} add 3060 deny icmp from any to any in via ${ext_if} icmptype 5,9,13,14,15,16,17

###########################################################
# Allow incoming connections
###########################################################
${fwcmd} add 3500 allow tcp from any to me ssh,pop3s,pop3,http,ftp,1,11,15,79,111 limit dst-addr 30 via ${ext_if}
${fwcmd} add 3510 allow tcp from any to me smtp limit dst-addr 15 via ${ext_if}
${fwcmd} add 3520 allow tcp from me ssh,pop3s,pop3,http,smtp,ftp to any via ${ext_if}

# natd
${fwcmd} add 4000 divert natd ip from any to ${ext_ip} in recv ${ext_if}

###########################################################
# transparent proxy
###########################################################
${fwcmd} add 6000 skipto 6500 tcp from 10.209.109.1 to any
${fwcmd} add 6001 skipto 6500 tcp from any to me
${fwcmd} add 6100 fwd 127.0.0.1,3128 tcp from 10.209.109.0/24 to any 80,81,82,88,3128,8080,8101,21,443 out xmit ${ext_if}

# check-state
${fwcmd} add 6500 check-state

# Запретить подключения ко мне
${fwcmd} add 6510 deny tcp from any to me 113,135,137,138,139,445 in via ${ext_if}
${fwcmd} add 6520 deny udp from any to me 113,135,137,138,139,445 in via ${ext_if}
${fwcmd} add 6550 deny log tcp from any to me 1-1023 in via ${ext_if}
${fwcmd} add 6560 deny log udp from any to me 1-1023 in via ${ext_if}
${fwcmd} add 6570 deny log tcp from any to me 3306 in via ${ext_if}          # MySQL
${fwcmd} add 6580 skipto 6600 ip from 10.209.109.0/24 to any in via ${int_if}
${fwcmd} add 6582 skipto 6600 ip from 0.0.0.0 to 255.255.255.255 in via ${int_if}
${fwcmd} add 6585 deny ip from 192.168.0.0/16 to any in via ${int_if}
${fwcmd} add 6590 deny ip from any to any in via ${int_if}

###########################################################
# natd разрешаем только те айпи, которым необходимо ходить на нат
###########################################################
${fwcmd} add 8000 skipto 9000 ip from 10.209.109.1 to any

#Остальным запрещаем ходить на NAT
${fwcmd} add 8900 skipto 10000 ip from 10.209.109.0/24 to any

${fwcmd} add 9000 divert natd ip from 10.209.109.0/24 to any out xmit ${ext_if}

# denying packets from local net to external
${fwcmd} add 10000 deny ip from 10.0.0.0/8 to any out xmit ${ext_if}
${fwcmd} add 10010 deny ip from 192.168.0.0/16 to any out xmit ${ext_if}

##########################################################
# allowing everything else
##########################################################
${fwcmd} add 65000 allow ip from any to any

Код: Выделить всё

deny ip from any to 172.16.0.0/12 in
deny ip from any to 192.168.0.0/16 in
deny ip from any to 0.0.0.0/8 in
deny ip from any to 169.254.0.0/16 in
deny ip from any to 240.0.0.0/4 in
deny ip from any to 224.0.0.0/3 in
deny ip from any to 192.0.2.0/24 in
deny ip from any to any not antispoof in

Код: Выделить всё

${fwcmd} add 65000 allow ip from any to any