Имеем: IPWF в качестве фаервола + PF для NAT
ipfw show
00100 12 996 allow ip from any to any via lo0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny log logamount 5 ip from 127.0.0.0/8 to any
00400 0 0 allow tcp from any to any dst-port 80 in via em0
00500 0 0 allow tcp from any to any dst-port 22 in via em0 setup keep-state
00600 0 0 allow tcp from any to any dst-port 20,21 in via em0
00700 0 0 allow tcp from any to me dst-port 50000-59999 setup
00800 0 0 allow udp from any to any dst-port 123 out via em0
00900 0 0 allow udp from 83.218.226.67 to any in via em0
01000 0 0 allow udp from any to any dst-port 53 in via em0
01100 63989 3071472 pipe 2 ip from table(1) to table(0) out via em0 keep-state
01200 16884 810432 pipe 4 ip from table(1) to any out via em0 keep-state
01300 0 0 pipe 1 ip from table(0) to table(1) in via em0
01400 0 0 pipe 3 ip from any to table(1) in via em0
01500 0 0 check-state
01600 0 0 allow ip from any to me in via em1 setup keep-state
01700 0 0 allow icmp from any to any icmptypes 3
01800 0 0 allow icmp from any to any icmptypes 4
01900 0 0 allow icmp from any to any icmptypes 11 in
02000 0 0 allow icmp from any to any icmptypes 8
02100 0 0 allow icmp from any to any icmptypes 0 in
02200 140 15156 allow tcp from any to any established
02300 0 0 deny log logamount 5 tcp from any to 10.1.100.2 in via em0 setup
02400 8 384 allow tcp from table(1) to not table(1) in via em1 setup
02500 18 1857 allow ip from table(1) to table(1) in via em1
02600 0 0 allow ip from table(1) to table(1) in via em1
65000 3 712 deny log logamount 5 ip from any to any
65535 1653 264512 allow ip from any to any
##cat /etc/pf.conf
ext_if="em0"
int_if="em1"
table <localnet> { 192.168.32.0/24 }
nat on $ext_if from <localnet> to any -> ($ext_if)
##pfctl -s nat
No ALTQ support in kernel
ALTQ related functions disabled
nat on em0 from <localnet> to any -> (em0) round-robin
##cat /etc/rc.conf |grep pf
pf_enable="YES" # Set to YES to enable packet filter (pf)
pf_rules="/etc/pf.conf" # rules definition file for pf
НЕ РАБОТАЕТ :(((((( сил больше нет :(
Если у кого то есть рабочий конфиг, выложите плс ....
