Преведик Усем!
Ну, фича в чем:
Авторизируется, трафик считает но есть тока исходящий, обратку не пускает... Где напорол или недопорол???
uname -a
---------
FreeBSD kapitolovka.izumnet 7.2-RELEASE-p8 FreeBSD 7.2-RELEASE-p8 #1: Mon Jun 27 09:07:36 UTC 2011 pushok@kapitolovka.izumnet:/usr/src/sys/i386/compile/PUSHOK i386
===================================
ifconfig -a
------------
xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=9<RXCSUM,VLAN_MTU>
ether 00:04:76:14:03:51
inet 192.168.1.102 netmask 0xffffff00 broadcast 192.168.1.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=389b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC>
ether 00:30:4f:59:6a:dd
inet 10.0.0.1 netmask 0xff000000 broadcast 10.255.255.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> metric 0 mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
inet6 ::1 prefixlen 128
inet 127.0.0.1 netmask 0xff000000
pflog0: flags=0<> metric 0 mtu 33204
pfsync0: flags=0<> metric 0 mtu 1460
syncpeer: 224.0.0.240 maxupd: 128
===============================================
ipfw show
----------
00050 3235 253335 allow tcp from any to me dst-port 22
00051 2227 1229940 allow tcp from me 22 to any
00110 4128 256318 allow ip from any to any via lo0
00120 2736 257515 skipto 1000 ip from me to any
00130 0 0 deny icmp from any to any in icmptypes 5,9,13,14,15,16,17
00160 2806 203743 skipto 2000 ip from any to me
00200 27 5862 skipto 500 ip from any to any via xl0
00300 4 304 skipto 4500 ip from any to any in
00400 0 0 skipto 450 ip from any to any recv xl0
00420 0 0 divert 1 ip from any to any
00450 0 0 divert 2 ip from any to any
00490 0 0 allow ip from any to any
00500 27 5862 skipto 32500 ip from any to any in
00510 0 0 divert 1 ip from any to any
00540 0 0 allow ip from any to any
01000 0 0 allow udp from any 53,7723 to any
01010 0 0 allow tcp from any to any setup keep-state
01020 14 1485 allow udp from any to any keep-state
01100 2729 257038 allow ip from any to any
02000 0 0 check-state
02010 0 0 allow icmp from any to any
02020 228 31513 allow tcp from any to any dst-port 80,443
02050 0 0 deny ip from any to any via xl0
02060 2571 171222 allow udp from any to any dst-port 53,7723
02100 0 0 deny ip from any to any
05000 4 304 deny ip from not table(0) to any
05001 0 0 skipto 5010 ip from table(127) to table(126)
05002 0 0 skipto 5030 ip from any to not table(2)
05003 0 0 deny ip from any to not table(1)
05004 0 0 pipe tablearg ip from table(21) to any
05005 0 0 deny ip from any to any
05010 0 0 pipe tablearg ip from table(127) to any
05030 0 0 deny tcp from table(15) to any dst-port 25
05400 0 0 pipe tablearg ip from table(11) to any
32000 0 0 deny ip from any to any
32490 0 0 deny ip from any to any
33000 0 0 pipe tablearg ip from table(126) to table(127)
33001 27 5862 skipto 33010 ip from not table(2) to any
33002 0 0 pipe tablearg ip from any to table(20)
33003 0 0 deny ip from any to any
33400 0 0 pipe tablearg ip from any to table(10)
65535 27 5862 deny ip from any to any
=============================================
ipfw table 10 list
------------------
10.0.0.2/32 1004
=============================================
netstat -nr
------------
Routing tables
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.1.1 UGS 0 0 xl0
10.0.0.0/8 link#2 UC 0 0 re0
10.0.0.2 00:1e:68:b2:14:92 UHLW 1 5001 re0 1069
127.0.0.1 127.0.0.1 UH 0 2176 lo0
192.168.1.0/24 link#1 UC 0 0 xl0
192.168.1.1 34:08:04:80:a6:a6 UHLW 2 7 xl0 1194
Internet6:
Destination Gateway Flags Netif Expire
::1 ::1 UHL lo0
fe80::%lo0/64 fe80::1%lo0 U lo0
fe80::1%lo0 link#4 UHL lo0
ff01:4::/32 fe80::1%lo0 UC lo0
ff02::%lo0/32 fe80::1%lo0 UC lo0
================================================
ps ax|grep ipcad
-----------------
1004 ?? I<s 0:00.10 /usr/local/bin/ipcad -rds -c /usr/local/etc/ipcad.conf
================================================
ps ax|grep nodeny.pl
---------------------
1101 ?? S< 0:04.37 perl nodeny.pl (perl5.8.9)
=================================================
ping ya.ru с сервера в мир
-----------
PING ya.ru (213.180.204.3): 56 data bytes
64 bytes from 213.180.204.3: icmp_seq=0 ttl=51 time=88.266 ms
64 bytes from 213.180.204.3: icmp_seq=1 ttl=51 time=87.565 ms
64 bytes from 213.180.204.3: icmp_seq=2 ttl=51 time=87.874 ms
64 bytes from 213.180.204.3: icmp_seq=3 ttl=51 time=87.692 ms
^C
--- ya.ru ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 87.565/87.849/88.266/0.264 ms
===================================================
ping ya.ru с клиента в мир
-----------
ping: unknown host ya.ru
===================================================
ping 10.0.0.1 с клиента к серверу
-------------
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_req=1 ttl=64 time=0.210 ms
64 bytes from 10.0.0.1: icmp_req=2 ttl=64 time=0.155 ms
64 bytes from 10.0.0.1: icmp_req=3 ttl=64 time=0.152 ms
64 bytes from 10.0.0.1: icmp_req=4 ttl=64 time=0.161 ms
^C
--- 10.0.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 2997ms
rtt min/avg/max/mdev = 0.152/0.169/0.210/0.026 ms
====================================================
ping 10.0.0.2 с севера к клиенту
-------------
PING 10.0.0.2 (10.0.0.2): 56 data bytes
64 bytes from 10.0.0.2: icmp_seq=0 ttl=64 time=0.173 ms
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.173 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.167 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=0.196 ms
^C
--- 10.0.0.2 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.167/0.177/0.196/0.011 ms
=====================================================
ee /etc/rc.conf
---------------
gateway_enable="YES"
inetd_enable="YES"
keymap="ua.koi8-u.shift.alt"
nfs_client_enable="YES"
nfs_server_enable="YES"
rpcbind_enable="YES"
sshd_enable="YES"
ifconfig_re0="inet 10.0.0.1 netmask 255.0.0.0"
ifconfig_xl0="inet 192.168.1.102 netmask 255.255.255.0"
defaultrouter="192.168.1.1"
hostname="kapitolovka.izumnet"
firewall_enable="YES"
fsck_y_enable="YES"
background_fsck="NO"
mysql_enable="YES"
apache22_enable="YES"
ipcad_enable="YES"
=====================================================
ee /etc/rc.firewall
-------------------
!/bin/sh -
f='/sbin/ipfw'
ifOut='xl0'
${f} -f flush
${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any
${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me
${f} add 200 skipto 500 ip from any to any via ${ifOut}
${f} add 300 skipto 4500 ip from any to any in
${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 divert 1 ip from any to any
${f} add 450 divert 2 ip from any to any
${f} add 490 allow ip from any to any
${f} add 500 skipto 32500 ip from any to any in
${f} add 510 divert 1 ip from any to any
${f} add 540 allow ip from any to any
${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any
${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723
${f} add 2100 deny ip from any to any
${f} add 32490 deny ip from any to any
===================================================
ee /etc/pf.conf
---------------
set limit states 128000
set optimization aggressive
nat pass on xl0 from 10.0.0.0/8 to any -> xl0
nat pass on xl0 from 192.168.0.0/16 to any -> xl0
===================================================
Если это траблы фаера, то по идее если запустить серверную часть без управления фаера, инет на клиетской машине должен заработать? Если в файле
nodeny.pl добавить вначале
...
$use_ipfw=0;
$use_iptables=0;
$verbose=1;
...
оно фаер не задействует???
