Итак ...
Система - freebsd 6.2 + ipfw +natd+ stargazer
Сетевухи:
инет - 192.168.20.2 (192.168.20.1 - роутер)
локалка - 192.168.10.1
подсеть для раздачи инета 192.168.10.0/24
ip админа 192.168.10.5
нужен ssh
Вот все конфиги ...
при таком раскладе конфигуратор и коннектор работают а вот инета нет ((
rules:
ALL 192.168.10.0/24 DIR0
ALL 192.168.10.1 DIR0
ICMP 0.0.0.0/0 NULL
onConnect
#Этот скрипт вызывается в момент, когда пользователь
#успешно прошел авторизацию на сервере. Задача скрипта - перестроить
#файрвол так, что бы пользователь получил доступ в интернет
fwcmd="/sbin/ipfw"
int_if="rl1"
ip="$2"
login="$1"
id="$4"
${fwcmd} add 'expr $id '*' 10 + 29000' fwd 127.0.0.1,3128 tcp from $ip to any 80 via ${int_if}
${fwcmd} add 'expr $id '*' 10 + 29001' allow ip from $ip to any via ${int_if}
echo "connect $login " >> /var/log/stargazer/connect.log
OnDisconnect
fwcmd="/sbin/ipfw"
id=$4
${fwcmd} delete 'expr $id '*' 20 + 29000'
${fwcmd} delete 'expr $id '*' 20 + 29001'
echo "disconnect $1" >> /var/log/stargazer/connect.log
LogFile = /var/log/stargazer/stargazer.log
Rules = /etc/stargazer/rules
DetailStatWritePeriod=1/6
StatWritePeriod = 10
DayFee = 1
DayFeeIsLastDay = yes
DayResetTraff = 1
SpreadFee = no
FreeMbAllowInet = yes
WriteFreeMbTraffCost = no
<DirNames>
DirName0 = Internet
DirName1 =
DirName2 =
DirName3 =
DirName4 =
DirName5 =
DirName6 =
DirName7 =
DirName8 =
DirName9 =
</DirNames>
ExecutersNum = 1
ModulesPath = /usr/lib/stg
<StoreModule store_files>
WorkDir = /var/stargazer
ConfOwner = root
ConfGroup = wheel
ConfMode = 600
StatOwner = root
StatGroup = wheel
StatMode = 640
UserLogOwner = root
UserLogGroup = wheel
UserLogMode = 640
</StoreModule>
<Modules>
<Module auth_ao>
</Module>
<Module auth_ia>
Port = 5555
UserDelay = 15
UserTimeout = 65
FreeMb = 0
</Module>
<Module conf_sg>
Port = 5555
</Module>
<Module cap_bpf>
#iface = rl0
iface = rl1
#iface = dc0
</Module>
<Module ping>
PingDelay = 15
</Module>
</Modules>
firewall.script
#!/bin/sh
fwcmd="/sbin/ipfw"
natdcmd="/sbin/natd"
ext_if="rl0"
int_if="rl1"
${fwcmd} -f flush
${natdcmd} -s -m -a 192.168.20.1
${fwcmd} add 10 allow icmp from any to any
${fwcmd} add 300 allow ip from any to 192.168.10.1 5555 in via ${int_if}
${fwcmd} add 301 allow ip from 192.168.10.1 to any via ${int_if}
${fwcmd} add 310 allow ip from 192.168.10.5 to 192.168.10.1 via ${int_if}
${fwcmd} add 311 allow ip from 192.168.10.1 to any via ${int_if}
${fwcmd} add 320 deny log ip from 192.168.10.0/24 to 192.168.10.1 via ${int_if}
${fwcmd} add 50020 divert natd all from any to any via ${ext_if}
${fwcmd} add 50030 allow tcp from any to any out via ${ext_if} setup
${fwcmd} add 50031 allow tcp from any to any via ${ext_if} established
${fwcmd} add 50034 allow udp from any to any out via ${ext_if}
${fwcmd} add 50035 allow udp from any 53 to any in via ${ext_if}
${fwcmd} add deny log ip from any to any
