Исходное сообщение
"IPFW not work" Отправлено shoko, 23-Янв-09 08:47
Привет спецам. В Фрюхе я новичок. Но пытаюсь сделать сам многое, Но видимо в Фрюхе Фаейрволл очент крутой или я чего то не догоняю. мне нужно сделать Инет шлюз на для ста компьютеров.  Снаружи для сервера должен быть открыт доступ только для 22 порта и для 25 порта и для днс сервера на этом сервере,  нат  без него ни как ))) ну и потом можно будет сквид к нему прикрутить. Вот мой конфиг. В ядре опции: options         IPFIREWALL                      # turn on firewall options         IPFIREWALL_FORWARD              # FORWARD packet to another  program options         IPFIREWALL_VERBOSE              # connection limit mode options         IPFIREWALL_VERBOSE_LIMIT=500    # connection limit options         IPFIREWALL_NAT                  # ipfw kernel nat support options         LIBALIAS options         IPDIVERT                        # turn on nat funtion options         DUMMYNET                        # for routed flud info to nowhere options         HZ=1000                         # how many packet we will see потом в rc.conf  конфиге : defaultrouter="222.222.222.22" gateway_enable="YES" hostname="хост.домейн.локал" ifconfig_xl0_name="wan" ifconfig_ed1_name="lan" ifconfig_wan="inet 222.222.222.12 up netmask 255.255.255.х" ifconfig_wan_alias0="inet 222.222.222.13 up netmask 255.255.255.х" ifconfig_lan="inet 172.16.20.1 up netmask 255.255.255.0" keymap="us.iso" named_enable="YES" named_program="/usr/sbin/named" named_flags="-u bind -c /etc/namedb/named.conf" sshd_enable="YES" firewall_enable="YES" firewall_logging="YES" firewall_quiet="NO" firewall_script="/etc/rc.firewall" natd_enable="YES" natd_interface="wan" natd_flags="-m  -u" log_in_vain="YES" и сам конфиг фаерволла: cat /etc/rc.firewall # !/bin/sh - FwCMD="/sbin/ipfw"   LanOut="xl0"     IpOut="222.222.222.12" Netmask="х" LanIn="ed1"             IpIn="172.16.20.1"   NetMask="24"             NetIn="172.16.20.0"   ${FwCMD} -f flush ${FwCMD} add check-state ${FwCMD} add allow ip from any to any via lo0 ${FwCMD} add deny ip from any to 127.0.0.0/8 ${FwCMD} add deny ip from 127.0.0.0/8 to any ${FwCMD} add deny ip from any to 10.0.0.0/8 in via ${LanOut} ${FwCMD} add deny ip from any to 172.16.0.0/12 in via ${LanOut} ${FwCMD} add deny ip from any to 192.168.0.0/16 in via ${LanOut} ${FwCMD} add deny ip from any to 0.0.0.0/8 in via ${LanOut} ${FwCMD} add deny ip from any to 169.254.0.0/16 in via ${LanOut} ${FwCMD} add deny ip from any to 240.0.0.0/4 in via ${LanOut} ${FwCMD} add deny icmp from any to any frag ${FwCMD} add deny log icmp from any to 255.255.255.255 in via ${LanOut} ${FwCMD} add deny log icmp from any to 255.255.255.255 out via ${LanOut} ${FwCMD} add fwd ${IpIn},2121 tcp from ${NetIn}/${NetMask} to any 21 via ${LanOut} ${FwCMD} add fwd 127.0.0.1,3128 tcp from ${NetIn}/${NetMask} to any 80 via ${LanOut} ${FwCMD} add divert natd ip from ${NetIn}/${NetMask} to any out via ${LanOut} ${FwCMD} add divert natd ip from any to ${IpOut} in via ${LanOut} ${FwCMD} add deny ip from 10.0.0.0/8 to any out via ${LanOut} ${FwCMD} add deny ip from 172.16.0.0/12 to any out via ${LanOut} ${FwCMD} add deny ip from 192.168.0.0/16 to any out via ${LanOut} ${FwCMD} add deny ip from 0.0.0.0/8 to any out via ${LanOut} ${FwCMD} add deny ip from 169.254.0.0/16 to any out via ${LanOut} ${FwCMD} add deny ip from 224.0.0.0/4 to any out via ${LanOut} ${FwCMD} add deny ip from 240.0.0.0/4 to any out via ${LanOut} ${FwCMD} add allow tcp from any to any established ${FwCMD} add allow ip from ${IpOut} to any out xmit ${LanOut} ${FwCMD} add allow udp from any 53 to any via ${LanOut} ${FwCMD} add allow udp from any to any 123 via ${LanOut} ${FwCMD} add allow tcp from any to ${IpOut} 21 via ${LanOut} # ${FwCMD} add allow tcp from any to ${IpOut} \ #`sysctl net.inet.ip.portrange.first | awk '{print $2}'`-\ #`sysctl net.inet.ip.portrange.last | awk '{print $2}'` via ${LanOut} ${FwCMD} add allow tcp from any to ${IpOut} 49152-65535 via ${LanOut} ${FwCMD} add allow icmp from any to any icmptypes 0,8,11 ${FwCMD} add allow tcp from any to ${IpOut} 80 via ${LanOut} # ${FwCMD} add allow tcp from any to ${IpOut} 25 via ${LanOut} ${FwCMD} add allow tcp from any to ${IpOut} 22 via ${LanOut} # ${FwCMD} add allow tcp from any to ${IpOut} 143 via ${LanOut} ${FwCMD} add allow tcp from any to ${IpOut} 110 via ${LanOut} # ${FwCMD} add allow ip from any to any via ${LanIn} # ${FwCMD} add allow gre from any to any via ${LanIn} ${FwCMD} add allow tcp from any to any via ${LanIn} ${FwCMD} add allow udp from any to any via ${LanIn} ${FwCMD} add allow icmp from any to any via ${LanIn} ${FwCMD} add deny ip from any to any что сделал не так  ? что нужно переделать ?   спасибо всем заранее