Если у меня опускаются руки, это значит, я потянулся к кувалде
https://forum.lissyara.su/
Код: Выделить всё
ipfw add 100 pipe 1 ip from me to any MAC <mac> anyКод: Выделить всё
ipfw show && ipfw pipe showhizel писал(а):фильтрование layer2 включена через sysctl ?
Код: Выделить всё
sysctl -a | grep net.link.ether.ipfw
net.link.ether.ipfw: 0zingel писал(а):покажите конфиг ipfw
Код: Выделить всё
oif="xl0"
onet="192.168.0.0"
omask="255.255.255.0"
oip="192.168.0.2"
iif="rl0"
inet="172.16.0.0"
imask="255.255.0.0"
iip="172.16.101.102"
${fwcmd} add check_state
${fwcmd} add pipe 1 tcp from ${oip} to any via ${oif}
${fwcmd} add pipe 1 udp from ${oip} to any via ${oif}
${fwcmd} add pipe 1 ip from ${oip} to any via ${oif}
${fwcmd} pipe 1 config bw 100Mbit/s
#${fwcmd} add deny all from me 3128 to 172.16.111.111
${fwcmd} add pipe 4 ip from me 3128 to 172.16.111.111 #any MAC 00:18:8B:DA:FC:DB any
${fwcmd} pipe 4 config bw 100Mbit/s
${fwcmd} add deny ip from not ${inet}:${imask} to ${inet}:${imask} # stop all external traffic 2 internal networks
setup_loopback
#${fwcmd} add deny tcp from ${inet}:${imask} to any http,https via ${oif}
${fwcmd} add deny tcp from any to any 135,136,137,138,139 via ${oif}
${fwcmd} add divert natd all from any to ${oip} via ${oif}
case ${natd_enable} in
[Yy][Ee][Ss])
if [ -n "${natd_interface}" ]; then
${fwcmd} add divert natd all from ${inet}:${imask} to any via ${natd_interface}
fi
;;
esac
${fwcmd} add pass tcp from any to any 25
${fwcmd} add pass tcp from any 25 to any
${fwcmd} add pass ICMP from any to any
${fwcmd} add deny icmp from any to any frag
${fwcmd} add deny tcp from any to me 135,136,137,138,139 via ${oif}
#---------------------------------------------------------------------------------------
${fwcmd} add pass udp from any to any domain
${fwcmd} add pass udp from any domain to any
#------------------------------------------------------------------------------------
${fwcmd} add pass tcp from any to any 80
${fwcmd} add pass tcp from any 80 to any
${fwcmd} add pass udp from ${inet}:${imask} to any 123
${fwcmd} add pass udp from any 123 to any established
${fwcmd} add deny all from any to me
;;