В этой теме нет ответов

[kvirtu]

Если есть какие недостаки в настройках фаера, ткните плиз пальцем ) система Freebsd 7.2, fxp0 - внешний if. , fxp1 - внутренний. rc.conf: firewall_nat_enable="YES" firewall_nat_interface="fxp0" firewall_type="open" firewall_script="/etc/myfire" Myfire: #!/bin/sh # fwcmd='/sbin/ipfw -q' # ${fwcmd} -f flush ${fwcmd} -f queue flush ${fwcmd} -f pipe flush #loopback ${fwcmd} add 100 pass all from any to any via lo0 ${fwcmd} add 110 deny all from any to 127.0.0.0/8 ${fwcmd} add 120 deny ip from 127.0.0.0/8 to any # ${fwcmd} add 130 check-state #drop icmp ${fwcmd} add 200 deny icmp from any to any in icmptype 0,5,9,10,13,14,15,16,17 # ${fwcmd} add 210 reject all from 10.128.12.0/24 to any out via fxp0 # #Mail Allow ${fwcmd} add 250 allow tcp from xx.xx.xx.6 to any 25 ${fwcmd} add 255 allow tcp from xx.xx.xx.13 to any 25 #Mail Deny ${fwcmd} add 260 deny tcp from 10.128.12.0/24 to any 25 ${fwcmd} add 265 deny tcp from 172.16.35.0/24 to any 25 ${fwcmd} add 270 deny tcp from 172.16.36.0/24 to any 25 #Lokalka ${ipfw} add 354 deny tcp from any 137-139 to any via fxp1 ${ipfw} add 355 deny udp from any 137-139 to any via fxp1 ${ipfw} add 360 deny tcp from any to any 137-139 via fxp1 ${ipfw} add 361 deny udp from any to any 137-139 via fxp1 # #Kernel_NAT ${fwcmd} nat 1 config ip xx.xx.xx.xx log same_ports ${fwcmd} add 65030 nat 1 ip from 172.16.35.0/24 to any #${ipfw} add 65035 nat 1 ip from 172.16.36.0/24 to any ${fwcmd} add 65040 nat 1 ip from any to xx.xx.xx.xx # # Allow TCP through if setup succeeded ${fwcmd} 65100 add pass tcp from any to any established # Allow IP fragments to pass through ${fwcmd} 65110 add pass all from any to any frag # Allow access to our DNS ${fwcmd} 65130 add pass tcp from any to me 53 setup ${fwcmd} 65140 add pass udp from any to me 53 ${fwcmd} 65150 add pass udp from me 53 to any # Allow ports from outside ${fwcmd} 65200 add pass tcp from any to me 25,53,80,110,175,465,995 setup # Reject&Log all setup of incoming connections from the outside ${fwcmd} 65250 add deny log tcp from any to any in via fxp0 setup # Allow setup of any other TCP connection ${fwcmd} 65300 add pass tcp from any to any setup # Allow DNS queries out in the world ${fwcmd} 65400 add pass udp from me to any 53 keep-state # ##${ipfw} add 65535 allow all from any to any