forum.lissyara.su

DEX писал(а):Помогите написать правило для подсчёта входящего трафика для конкретного IP.
${fwcmd} add count ip from any to 192.168.10.1 in via ${lanin} - не работает.
lanin - внутренняя сетевуха.

DEX писал(а):Вот по этому правилу - ${fwcmd} add count ip from 192.168.10.1 to any in via ${lanin}
будет счетаться ВЕСЬ входящий интернет трафик для данного IP ?

DEX писал(а):Входящий интернет трафик для хоста

allow ip from any to any via lo
allow ip from any to any via ${lanin}
..
..

allow ip from any to any via lo
${fwcmd} add count ip from not ${mylan} to 192.168.10.1 out via ${lanin}
allow ip from any to any via ${lanin}

fwcmd="/sbin/ipfw -q"
lanout="fxp0"
lanin="fxp1"
ipout="ХХХ.ХХХ.ХХХ.ХХ"
ipin="192.168.10.ХХ"
netmask="24"
netin="192.168.10.0"
${fwcmd} -f flush
${fwcmd} add allow ip from any to any via lo0
${fwcmd} add deny ip from any to 127.0.0.0/8
${fwcmd} add deny ip from 127.0.0.0/8 to any
${fwcmd} add deny ip from any to 10.0.0.0/8 in via ${lanout}
${fwcmd} add deny ip from any to 172.16.0.0/12 in via ${lanout}
${fwcmd} add deny ip from any to 192.168.0.0/16 in via ${lanout}
${fwcmd} add deny ip from any to 0.0.0.0/8 in via ${lanout}
${fwcmd} add deny ip from any to 169.254.0.0/16 in via ${lanout}
${fwcmd} add deny ip from any to 240.0.0.0/4 in via ${lanout}
${fwcmd} add deny icmp from any to any frag
${fwcmd} add deny log icmp from any to 255.255.255.255 in via ${lanout}
${fwcmd} add deny log icmp from any to 255.255.255.255 out via ${lanout}
#${fwcmd} add divert 8668 tcp from any to 212.119.109.58 3389 via fxp0
#${fwcmd} add divert 8668 tcp from 192.168.10.1 3389 to any via fxp0
#${fwcmd} add allow log tcp from any to 192.168.10.1 3389 via any
#################################
${fwcmd} add count log tcp from 192.168.10.1 to any in via ${lanin}
##################################
${fwcmd} add divert natd ip from ${netin}/${netmask} to any out via ${lanout}
${fwcmd} add divert natd ip from any to ${ipout} in via ${lanout}
${fwcmd} add allow tcp from any to any 25
${fwcmd} add allow tcp from any 25 to any
${fwcmd} add allow tcp from any to any 110
${fwcmd} add allow tcp from any 110 to any
${fwcmd} add deny ip from 10.0.0.0/8 to any out via ${lanout}
${fwcmd} add deny ip from 172.16.0.0/12 to any out via ${lanout}
${fwcmd} add deny ip from 192.168.0.0/16 to any out via ${lanout}
${fwcmd} add deny ip from 0.0.0.0/8 to any out via ${lanout}
${fwcmd} add deny ip from 169.254.0.0/16 to any out via ${lanout}
${fwcmd} add deny ip from 224.0.0.0/4 to any out via ${lanout}
${fwcmd} add deny ip from 240.0.0.0/4 to any out via ${lanout}
${fwcmd} add count ip from not 192.168.0.0/16 to 192.168.10.1 out via ${lanin}
${fwcmd} add allow tcp from any to any established
${fwcmd} add allow ip from ${ipout} to any out xmit ${lanout}
${fwcmd} add allow udp from any 53 to any via ${lanout}
${fwcmd} add allow tcp from any to ${ipout} 49152-65535 via ${lanout}
${fwcmd} add allow tcp from 192.168.10.20 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.21 to any 80,25,110,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.22 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.23 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.24 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.26 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.27 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.28 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.29 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.30 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.31 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.32 to any 80,110,25,2041,2042 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.35 to any 80,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.36 to any 80,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.37 to any 80,110,25,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.39 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.40 to any 80,110,25,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.41 to any 80,110,25,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.42 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.43 to any 80,110,25,5190,21,20,443 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.44 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.45 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.46 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.47 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.48 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.49 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.50 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.51 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.53 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.54 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.55 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.56 to any 80,20,21 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.58 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.59 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.60 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.61 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.63 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.1 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.5 to any not 80 via ${lanin} keep-state
${fwcmd} add allow udp from any to any via ${lanin}
${fwcmd} add allow icmp from any to any via ${lanin}
${fwcmd} add deny tcp from any to any

UTNIOZ писал(а):Подскажите как правильно задать доменное имя в правиле файера?
У нас в офисе установлен антивирус nod32 он может делает обновления начиная с u20.eset.com и заканчивая u39.eset.com

dikens3 писал(а):

Код: Выделить всё

${fwcmd} add allow tcp from 192.168.10.20 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.21 to any 80,25,110,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.22 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.23 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.24 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.26 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.27 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.28 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.29 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.30 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.31 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.32 to any 80,110,25,2041,2042 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.35 to any 80,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.36 to any 80,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.37 to any 80,110,25,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.39 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.40 to any 80,110,25,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.41 to any 80,110,25,5190 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.42 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.43 to any 80,110,25,5190,21,20,443 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.44 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.45 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.46 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.47 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.48 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.49 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.50 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.51 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.53 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.54 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.55 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.56 to any 80,20,21 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.58 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.59 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.60 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.61 to any 80,110,25 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.63 to any 80 via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.1 to any via ${lanin} keep-state
${fwcmd} add allow tcp from 192.168.10.5 to any not 80 via ${lanin} keep-state

А диапазон адресов нельхя разве в ipfw задавать? У тебя один провайдер, я так понимаю?

UTNIOZ писал(а):Подскажите как правильно задать доменное имя в правиле файера?
У нас в офисе установлен антивирус nod32 он может делает обновления начиная с u20.eset.com и заканчивая u39.eset.com

Команда:
ipfw add allow tcp from u32.eset.com to me
В фаере:
32000 allow tcp from 89.202.149.42 to me

dikens3 писал(а):Если правильно мыcлю что ты хочешь:

Код: Выделить всё

Команда:
ipfw add allow tcp from u32.eset.com to me
В фаере:
32000 allow tcp from 89.202.149.42 to me

lissyara писал(а):можно. дефис рулит
=========
тебе ли не знать - ты ж пеерводил хандбук

dikens3 писал(а):Конструкций аля:
ipfw add allow tcp from (u20-u39).eset.com to me
ipfw вроде не поддерживает(попробуй), а лень штука плохая.

i=20
while test $i != 40
do
${FwCMD} add allow tcp from u${i}.eset.com to me
i=$(($i+1))
done