Покритикуйте настройки фаервола.

[kvirtu 315]

Если есть какие недостаки в настройках фаера, ткните плиз пальцем )

система Freebsd 7.2, fxp0 - внешний if. , fxp1 - внутренний.

 

rc.conf:

firewall_nat_enable="YES"

firewall_nat_interface="fxp0"

firewall_type="open"

firewall_script="/etc/myfire"

Myfire:

#!/bin/sh

#

fwcmd='/sbin/ipfw -q'

#

${fwcmd} -f flush

${fwcmd} -f queue flush

${fwcmd} -f pipe flush

#loopback

${fwcmd} add 100 pass all from any to any via lo0

${fwcmd} add 110 deny all from any to 127.0.0.0/8

${fwcmd} add 120 deny ip from 127.0.0.0/8 to any

#

${fwcmd} add 130 check-state

#drop icmp

${fwcmd} add 200 deny icmp from any to any in icmptype 0,5,9,10,13,14,15,16,17

#

${fwcmd} add 210 reject all from 10.128.12.0/24 to any out via fxp0

#

#Mail Allow

${fwcmd} add 250 allow tcp from xx.xx.xx.6 to any 25

${fwcmd} add 255 allow tcp from xx.xx.xx.13 to any 25

#Mail Deny

${fwcmd} add 260 deny tcp from 10.128.12.0/24 to any 25

${fwcmd} add 265 deny tcp from 172.16.35.0/24 to any 25

${fwcmd} add 270 deny tcp from 172.16.36.0/24 to any 25

#Lokalka

${ipfw} add 354 deny tcp from any 137-139 to any via fxp1

${ipfw} add 355 deny udp from any 137-139 to any via fxp1

${ipfw} add 360 deny tcp from any to any 137-139 via fxp1

${ipfw} add 361 deny udp from any to any 137-139 via fxp1

#

#Kernel_NAT

${fwcmd} nat 1 config ip xx.xx.xx.xx log same_ports

${fwcmd} add 65030 nat 1 ip from 172.16.35.0/24 to any

#${ipfw} add 65035 nat 1 ip from 172.16.36.0/24 to any

${fwcmd} add 65040 nat 1 ip from any to xx.xx.xx.xx

#

# Allow TCP through if setup succeeded

${fwcmd} 65100 add pass tcp from any to any established

# Allow IP fragments to pass through

${fwcmd} 65110 add pass all from any to any frag

# Allow access to our DNS

${fwcmd} 65130 add pass tcp from any to me 53 setup

${fwcmd} 65140 add pass udp from any to me 53

${fwcmd} 65150 add pass udp from me 53 to any

# Allow ports from outside

${fwcmd} 65200 add pass tcp from any to me 25,53,80,110,175,465,995 setup

# Reject&Log all setup of incoming connections from the outside

${fwcmd} 65250 add deny log tcp from any to any in via fxp0 setup

# Allow setup of any other TCP connection

${fwcmd} 65300 add pass tcp from any to any setup

# Allow DNS queries out in the world

${fwcmd} 65400 add pass udp from me to any 53 keep-state

#

##${ipfw} add 65535 allow all from any to any