Вот появилась проблемка с настройкой фареволла, помогите плиз разобраться.Имеем FreeBSD 6.1, 2 сетевухи (sk0 и rl0) - комп не является раутером или чем-то в этом роде. Подключение к инету через раутер 192.168.123.254 (sk0 - 192.168.123.0/24). rl0 (10.0.0.0/24) - домашняя сетка.
Правила из rc.firewall
Код: Выделить всё
[Cc][Ll][Ii][Ee][Nn][Tt])
############
# This is a prototype setup that will protect your system somewhat
# against people from outside your own network.
############
# set these to your network and netmask and ip
net1="192.168.123.0"
net2="10.0.0.0"
mask="255.255.255.0"
ip1="192.168.123.1"
ip2="10.0.0.1"
if1="sk0"
if2="rl0"
setup_loopback
# Deny any traffic from 10.x.x.x to 192.x.x.x
${fwcmd} add deny all from ${net1}:${mask} to ${net2}:${mask}
${fwcmd} add deny all from ${net2}:${mask} to ${net1}:${mask}
# Allow any traffic in the home net
${fwcmd} add pass all from ${ip2} to ${net2}:${mask} via ${if2} out
${fwcmd} add pass all from ${net2}:${mask} to ${ip2} via ${if2} in
# Allow any traffic out for internet.
${fwcmd} add pass all from ${ip1} to any via ${if1} out
# Deny IP fragments to pass through
${fwcmd} add deny all from any to any via ${if1} frag
${fwcmd} add deny icmp from any to any via ${if1} icmptype 8
# Allow setup of SMTP connections
${fwcmd} add pass tcp from any 25 to ${ip1} via ${if1} in
# Allow setup of POP3 connections
${fwcmd} add pass tcp from any 110 to ${ip1} via ${if1} in
# Allow FTP connections
${fwcmd} add pass tcp from any 20 to ${ip1} via ${if1} in
${fwcmd} add pass tcp from any 21 to ${ip1} via ${if1} in
# Allow DNS queries out in the world
${fwcmd} add pass udp from any 53 to ${ip1} via ${if1} in
# Allow NTP queries out in the world
${fwcmd} add pass udp from any 123 to ${ip1} via ${if1} in
# Allow HTTP & HTTPS connections
${fwcmd} add pass tcp from any 80 to ${ip1} via ${if1} in
${fwcmd} add pass tcp from any 443 to ${ip1} via ${if1} in
# Allow ICQ connections
${fwcmd} add pass all from any 5190 to ${ip1} via ${if1} in
# Allow 4662 4672 4665 imcoming connections
${fwcmd} add pass tcp from any to ${ip1} 4662 via ${if1} in
${fwcmd} add pass tcp from any to ${ip1} 4665 via ${if1} in
${fwcmd} add pass udp from any to ${ip1} 4672 via ${if1} in
# Everything else is denied by default, unless the
# IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
# config file.
;;Код: Выделить всё
darkstone% sudo ipfw list
Password:
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from 192.168.123.0/24 to 10.0.0.0/24
00500 deny ip from 10.0.0.0/24 to 192.168.123.0/24
00600 allow ip from 10.0.0.1 to 10.0.0.0/24 via rl0 out
00700 allow ip from 10.0.0.0/24 to 10.0.0.1 via rl0 in
00800 allow ip from 192.168.123.1 to any via sk0 out
00900 deny ip from any to any via sk0 frag
01000 deny icmp from any to any via sk0 icmptypes 8
01100 allow tcp from any 25 to 192.168.123.1 via sk0 in
01200 allow tcp from any 110 to 192.168.123.1 via sk0 in
01300 allow tcp from any 20 to 192.168.123.1 via sk0 in
01400 allow tcp from any 21 to 192.168.123.1 via sk0 in
01500 allow udp from any 53 to 192.168.123.1 via sk0 in
01600 allow udp from any 123 to 192.168.123.1 via sk0 in
01700 allow tcp from any 80 to 192.168.123.1 via sk0 in
01800 allow tcp from any 443 to 192.168.123.1 via sk0 in
01900 allow ip from any 5190 to 192.168.123.1 via sk0 in
02000 allow tcp from any to 192.168.123.1 dst-port 4662 via sk0 in
02100 allow tcp from any to 192.168.123.1 dst-port 4665 via sk0 in
02200 allow udp from any to 192.168.123.1 dst-port 4672 via sk0 in
65535 deny ip from any to anyНа интерфейсе rl0 - всё ок.
На sk0 работает всё кроме осла и ftp. Никак не пойму в чём дело.
