Настройка шлюза на FreeBSD 7.3

[zaka]

все тагже

[zaka]

cannot resolve http://www.kg:

а если по ипу?

а если по ипу говарит что у меги авария пля

[Infernal Flame]

zaka
а трасерты ходят до ИПов? тем более если у меги авария.. вот ип для интереса 77.235.23.90 - что покажет?

[zaka]

# traceroute 77.235.23.90

traceroute to 77.235.23.90 (77.235.23.90), 64 hops max, 40 byte packets
1 77-235-16-105.mega.kg (77.235.16.105) 4.232 ms 3.433 ms 3.821 ms
2 * * *
3 * * *

[Infernal Flame]

77-235-16-105

твой ИП?

[zaka]

неа мой 77.235.16.ЧЧЧ

[Infernal Flame]

zaka
случаем не 77.235.16.104? а 77.235.16.105 случаем не дефолт гетвей?

[zaka]

ип: нет
гв: да

[Infernal Flame]

zaka
ну в таком случае на лицо понт в гетвее... ежели до него пинги ходють

[zaka]

open firewall
инет есть и на сервере и на клиентских машинах (винда) трасер все ок ходет по шлюзу
но если запускаем правила все тухнет вот правила

Код: Выделить всё

cat /etc/ipfw
#!/bin/sh
#peremenie
IPFW="/sbin/ipfw"
EXT="rl0" #vneshni interfeis
INT="rl1" #Vnutrenyi interfeis
EXT_IP="77.235.16.XXX" #vneshii Ip
INT_IP="192.168.0.88" #vnutrenii IP
LAN="192.168.0.0" #localka
MSK="24" #maska pod seti
${IPFW} -f flush
${IPFW} add check-state
${IPFW} add allow ip from any to any via lo0
${IPFW} add deny ip from any to 127.0.0.0/8
${IPFW} add deny ip from 127.0.0.0/8 to any
${IPFW} add allow tcp from any to any via ${INT}
${IPFW} add allow udp from any to any via ${INT}
${IPFW} add allow icmp from any to any via ${INT}
# ${IPFW} add allow all from any to any via ${INT}
${IPFW} add deny ip from any to ${LAN}/${MSK} in via ${EXT}
${IPFW} add deny log icmp from any to 255.255.255.255 in via ${EXT}
${IPFW} add deny log icmp from any to 255.255.255.255 out via ${EXT}
#DNS
${IPFW} add allow udp from any 53 to any via ${EXT}
${IPFW} add allow udp from any to any 53 via ${EXT}
${IPFW} add allow tcp from any 53 to any via ${EXT}
${IPFW} add allow tcp from any to any 53 via ${EXT}
#ssh
${IPFW} add allow tcp from any to ${EXT_IP} 7022 via ${EXT}
#ping
${IPFW} add allow icmp from any to any icmptypes 0,8,11
#squid
${IPFW} add fwd 127.0.0.1:3129 tcp from ${LAN}/${MSK} to any 21,80,443 via
${EXT}
#nat v lan
${IPFW} add divert natd ip from ${LAN}/${MSK} to any out via ${EXT}
${IPFW} add divert natd ip from any to ${EXT_IP} in via ${EXT}
${IPFW} add allow tcp from any established
${IPFW} add deny ip from 10.0.0.0/8 to any out via ${EXT}
${IPFW} add deny ip from 172.16.0.0/12 to any out via ${EXT}
${IPFW} add deny ip from 192.168.0.0/16 to any out via ${EXT}
${IPFW} add deny ip from 0.0.0.0/8 to any out via ${EXT}
${IPFW} add deny ip from 169.254.0.0/16 to any out via ${EXT}
${IPFW} add deny ip from 224.0.0.0/4 to any out via ${EXT}
${IPFW} add allow ip from ${EXT_IP} to any out xmit ${EXT} # setup keep-state
${IPFW} add deny log all from any to any