forum.lissyara.su

Код: Выделить всё

hostname="Aurora"
ifconfig_em0="*локальный айпи*"
ifconfig_em1="*внешний айпи*"
defaultrouter="*ip*"
sshd_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
gateway_enable="YES"

sendmail_enable="NONE"
sendmail_submit_enable="NONE"
sendmail_outbound_enable="NONE"
sendmail_msp_enable="NONE"

firewall_enable="YES"
firewall_nat_enable="YES"
firewall_nat_interface="em1"
firewall_logging="YES"
firewall_script="/etc/ipfw"

squid_enable="YES"

Код: Выделить всё

ipfw -q flush
local="192.168.10.0/24, 10.1.1.0/24, 192.168.0.0/24"

ipfw add allow tcp from me to any out via em1 keep-state uid squid # разрешить машине ходить через squid

ipfw add allow ip4 from any 80 to any out     # набор для теста
ipfw add allow ip4 from any 80 to any in
ipfw add allow ip4 from any to any 80 out
ipfw add allow ip4 from any to any 80 in

ipfw add fwd 127.0.0.1,3128 ip4 from $local to any 80,443 out via em1 # Заворачивание на squid

ipfw nat 1 config log if em1 reset same_ports \ #Сам нат
        redirect_port tcp 192.168.10.8:80 80
ipfw add nat 1 log ip4 from any to any via em1

ipfw add allow ip from any to any via lo0
ipfw add deny ip from 127.0.0.1/24 to any
ipfw add deny ip from any to 127.0.0.1/24
ipfw add allow icmp from any to any
ipfw add allow ip4 from any to any via em0

ipfw add deny log all from any to any

Код: Выделить всё

ipfw -q flush
ipfw nat 1 config log if em1 reset same_ports \
        redirect_port tcp 192.168.10.8:80 80 \
        redirect_port tcp site2.domain.local:80 3333
ipfw add nat 1 log ip4 from any to any via em1

ipfw add allow all from any to any via em0 in
ipfw add allow all from any to any via em0 out
ipfw add allow all from any to any via em1 in
ipfw add allow all from any to any via em1 out


ipfw add deny log all from any to any

Код: Выделить всё

#пустить через второго провайдера
${ipfw} table 10 add 192.168.0.100

setfib -F0 route add default ${gw1}
setfib -F1 route add default ${gw2}


${ipfw} add setfib 1 all from table\(10\) to any in

###NAT-1

${ipfw} nat 1 config log ip ${nat1} deny_in same_ports \
redirect_port tcp ${mail}:25 25 


#${ipfw} add nat 1 ip from 192.168.0.0/24 to not table\(10\) out via ${LanOut}
${ipfw} add nat 1 ip from any to any out via ${LanOut}
${ipfw} add nat 1 ip from any to ${nat1} in via ${LanOut}


###NAT-2
${ipfw} nat 2 config log ip ${nat2} deny_in same_ports \
redirect_port tcp ${mail}:25 25

#${ipfw} add nat 2 ip from table\(10\) to any out via ${LanOut}
${ipfw} add nat 2 ip from any to ${nat2} in via ${LanOut}