forum.lissyara.su

Код: Выделить всё

mail2# /etc/rc.d/ipfw restart
net.inet.ip.fw.enable: 1 -> 0
Stopping natd.
Waiting for PIDS: 52815, 52815, 52815, 52815, 52815.
Starting divert daemons: natdipfw: hostname ``vr0'' unknown
ipfw: unrecognised option [-1] em0

ipfw: unrecognised option [-1] em0

ipfw: hostname ``vr0'' unknown
ipfw: bad width ``255.255.255.248''
Firewall rules loaded.
net.inet.ip.fw.enable: 0 -> 1







[code]mail2# ipfw list
00100 allow ip from any to any via lo0
00200 allow ip from any to any
00300 allow ip from any to any frag
00400 allow tcp from any to any established
00500 allow ip from xxx.xxxx.xxx.xxx  to any out xmit em0
00600 allow ip from any to me dst-port 4848,15000 in via vr0
00700 deny ip from 192.168.0.0/16 to any in via em0
00800 deny ip from 172.16.0.0/12 to any in via em0
00900 deny ip from 10.0.0.0/8 to any in via em0
01000 allow ip from any to 193.232.88.17
01100 allow ip from any to 194.84.23.125
01200 allow ip from 193.232.88.17 to me
01300 allow ip from 194.84.23.125 to me
01400 allow icmp from any to any
01500 deny icmp from any to any frag
01600 divert 8668 ip from any to any via em0
65535 deny ip from any to any

Код: Выделить всё

#!/bin/sh

fwcmd="/sbin/ipfw -q"

LanOut="em0"
IPOut="xxx.xxx.xxx.xxx"
#NetOut="8"
MaskOut="255.255.255.248"

LanIn="vr0"
IPIn="192.168.0.235"
NetInIP="192.168.0.0"
NetInMask="24"
MaskIn="255.255.255.0"

Dns1="193.232.88.17"
Dns2="194.84.23.125"

### SBROS STARblX PRAVIL
${fwcmd} -f flush

### TRAFF SERVERA
${fwcmd} add allow all from any to any via lo0
${fwcmd} add allow all from any to any
### SAMBA
###${fwcmd} add allow all from ${LanIn} to me 137-139

### 'FRAGMENT' PAKETbl
${fwcmd} add allow all from any to any frag

### YSTANOVLENNblE SOEDINENIIA
${fwcmd} add pass tcp from any to any established
${fwcmd} add pass ip from ${IPOut} to any out xmit ${LanOut}

### PROXY,SOCKS IZ LAN
${fwcmd} add allow all from any to me 4848,15000 in via ${LanIn}

### FTP
#${fwcmd} add allow all from any to any 20,ftp
#${fwcmd} add allow all from any to any 1024-65535

### Terminal,MAIL(POP3,SMTP,IMAP4),DNS

#${fwcmd} add pass tcp from any to any 23,25,110 in via ${LanIn}
#${fwcmd} add pass tcp from any 23,25,110 to any in via ${LanIn}
${fwcmd} add pass tcp from any to any 22
${fwcmd} add pass tcp from any 22 to any
${fwcmd} add pass udp from any to any 53
${fwcmd} add pass udp from any 53 to any


### WWW
${fwcmd} add pass tcp from any to me 80

### ZAPRET POIAVLENIIA PRIVAT ADRESOV NA VNEWNEM INTERFEISE


${fwcmd} add deny ip from 192.168.0.0/16 to any in via ${LanOut}
${fwcmd} add deny ip from 172.16.0.0/12 to any in via ${LanOut}
${fwcmd} add deny ip from 10.0.0.0/8 to any in via ${LanOut}

### RAZREWENIE LYUBOGO TRAFIKA OT/NA DNS SERVERA
${fwcmd} add allow all from any to ${Dns1}
${fwcmd} add allow all from any to ${Dns2}
${fwcmd} add allow all from ${Dns1} to me
${fwcmd} add allow all from ${Dns2} to me

### ICMP I ZAPRET FRAGMENTACII
${fwcmd} add allow icmp from any to any
${fwcmd} add deny icmp from any to any frag

### STOP SPOOFING
${fwcmd} add deny all from ${LanIn}/${MaskIn} to any in via ${LanOut}
${fwcmd} add deny all from ${IPOut}/${MaskOut} to any in via ${LanIn}

${fwcmd} add divert natd all from any to any via ${LanIn}


################### ZAPRET ##########################################
${fwcmd} add 65535 deny all from any to any

Код: Выделить всё

cat /etc/rc.firewall

Код: Выделить всё

${FwCMD} add fwd 127.0.0.1,3128 tcp from ${NetIn} to any 80 via ${LanOut}

Код: Выделить всё

# WAN
oif="xl0"
onet="194.105.x.x"
omask="255.255.255.240"
oip="194.105.x.x"

# LAN
iif="em0"
inet="192.168.0.0"
imask="255.255.0.0"
iip="192.168.1.15"

## NAT IP
nip="192.168.1.15, 192.168.1.16, .... и так далее...нужные ипы"
natd_interface="xl0"

правила до НАТа:
## Proxy
${fwcmd} add fwd 127.0.0.1,3128 tcp from not ${nip} to any 80,443,21 in via ${iif}

Правила НАТа:
${fwcmd} add divert natd all from ${nip} to any via ${natd_interface}
${fwcmd} add divert natd all from any to ${oip} in via ${natd_interface}