ipfw + Netams + nat
уже давно настроено и работает, но вот сейчас потребовалось добавить проброс с ограничением по конкретному IP
имеем рабочий (текущий конфиг):
Код: Выделить всё
#!/bin/sh
FW='/sbin/ipfw -q'
EXTIF="re1"
#EXTIF="vr2"
EXTIP="ХХХХХХХХХХХХ"
INTIF="re2"
INTNET="192.168.0.0/24"
INTIF2="re3"
INTNET2="192.168.1.0/24"
INTNETS="{ $INTNET, $INTNET2 }"
# Clear rules
$FW -f flush
$FW -f pipe flush
$FW -f queue flush
$FW -f table 0 flush
$FW -f table 1 flush
$FW -f table 2 flush
$FW -f table 3 flush
$FW -f table 4 flush
# Fake NETS
$FW table 1 add 10.0.0.0/8
$FW table 1 add 172.16.0.0/12
$FW table 1 add 192.168.0.0/16
$FW table 1 add 169.254.0.0/16
$FW table 1 add 224.0.0.0/4
$FW table 1 add 0.0.0.0/8
cat /etc/rc.ip.txt | while read ip; do
$FW table 2 add $ip
done
$FW table 3 add 192.168.0.31
$FW table 3 add 192.168.0.32
$FW table 3 add 192.168.0.33
$FW table 3 add 192.168.0.35
$FW table 4 add 192.168.0.6
$FW table 4 add 192.168.0.11
$FW table 4 add 192.168.0.15
$FW table 4 add 192.168.0.23
$FW table 4 add 192.168.0.24
$FW table 4 add 192.168.0.27
$FW table 4 add 192.168.0.28
$FW table 4 add 192.168.0.26
$FW table 4 add 192.168.0.71
$FW table 4 add 192.168.0.72
$FW table 4 add 192.168.0.85
$FW table 4 add 192.168.0.86
$FW table 4 add 192.168.0.87
$FW table 4 add 192.168.0.90
$FW pipe 1 config bw 4096Kbit/s
$FW pipe 2 config bw 1024Kbit/s
$FW add pipe 1 ip from any to "table(3)"
$FW add pipe 1 ip from "table(3)" to any
$FW add pipe 2 ip from any to "table(4)"
$FW add pipe 2 ip from "table(4)" to any
###
# Start rules
###
# Loopback antispoof
$FW add allow ip from any to any via lo0
$FW add deny ip from any to 127.0.0.0/8
$FW add deny ip from 127.0.0.0/8 to any
# SSHIT
$FW add deny ip from "table(0)" to me
# Antispoof
$FW add deny ip from $EXTIP to any in via $EXTIF
$FW add deny ip from not $INTNET to any in via $INTIF
$FW add deny ip from not $INTNET2 to any in via $INTIF2
$FW add deny ip from "table(1)" to any in via $EXTIF
$FW add deny ip from "table(2)" to any in via $EXTIF
# NETAMS+NAT
#$FW nat 1 config if $EXTIF reset same_ports unreg_only \
$FW nat 1 config if $EXTIF reset same_ports deny_in \
redirect_port tcp 192.168.1.2:4499 4499 \
redirect_port tcp 192.168.0.102:4488 4488 \
redirect_port tcp 192.168.0.4:4848 4848 \
redirect_port tcp 192.168.0.5:4849 4849 \
redirect_port tcp 192.168.0.111:34567 34567 \
redirect_port tcp 192.168.0.111:5801 5801 \
redirect_port tcp 192.168.0.112:34567 34568 \
redirect_port tcp 192.168.0.112:5801 5802 \
redirect_port tcp 192.168.0.113:8000 8000 \
# redirect_port tcp 192.168.0.91:1540 1540 \
# redirect_port tcp 192.168.0.91:1541 1541 \
# redirect_port tcp 192.168.0.91:1560-1591 1560-1591 \
# redirect_port udp 192.168.0.91:1540 1540 \
# redirect_port udp 192.168.0.91:1541 1541 \
# redirect_port udp 192.168.0.91:1560-1591 1560-1591
$FW add divert 199 ip from $INTNETS to any out xmit $EXTIF
$FW add nat 1 ip from any to any via $EXTIF
$FW add allow tcp from any to 192.168.1.2 dst-port 4499 in recv $EXTIF setup limit src-addr 1
$FW add allow tcp from any to 192.168.0.102 dst-port 4488 in recv $EXTIF setup limit src-addr 3
$FW add divert 199 ip from any to $INTNETS in recv $EXTIF
$FW add deny ip from not $EXTIP to any out via $EXTIF
$FW add allow ip from $INTNET to not me in recv $INTIF
$FW add allow ip from not me to $INTNET out xmit $INTIF
$FW add allow ip from $INTNET2 to not me in recv $INTIF2
$FW add allow ip from not me to $INTNET2 out xmit $INTIF2
$FW add allow ip from not me to $INTNETS in via $EXTIF
$FW add check-state
# Allow outgoing traffic from server
$FW add allow ip from me to any keep-state
# SSH
$FW add allow ip from any to me 33 keep-state
# BIND
$FW add allow udp from any to me 53 keep-state
# NTP
$FW add allow udp from any to me 123 keep-state
# ICMP
$FW add allow icmp from any to me icmptypes 0,8,11
# HTTP
$FW add allow tcp from any to $EXTIP 80 limit src-addr 30
$FW add allow tcp from any to $EXTIP 80 via $EXTIF setup limit src-addr 10
$FW add allow tcp from any to me 80 keep-state
$FW add allow tcp from any to me 443 keep-state
# SAMBA
$FW add allow tcp from $INTNETS to me 445 keep-state
$FW add allow udp from $INTNETS to me 137,138 keep-state
# SMTP, SMTPS
$FW add allow tcp from any to me 25,465 keep-state
# POP3S, IMAP4S
$FW add allow tcp from any to me 993,995 keep-state
$FW add deny log ip from any to any
а вот добавить IP входящего не получается.
делал по примерам https://www.lissyara.su/articles/freebs ... /ipfw_nat/ из этой стотьи. не работает.
