помогите serhiy141!!!!

[SerjioMati]

фаєрвол у прорядку як провірити нат?

[stix]

смотря на чем nat
на ipfw или pf или еще чем-то.

[SerjioMati]

[root@router /usr/home/serjio]# cat /etc/rc.firewall
#!/bin/sh -
f='/sbin/ipfw'

ifOut='fxp0'

${f} -f flush

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any
${f} add 55 allow tcp from any to me dst-port 8081,8082

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me

${f} add 300 skipto 4500 ip from any to any in

${f} add 280 fwd 127.0.0.1,8081 tcp from "table(35)" to not me dst-port 80 in
${f} add 290 fwd 127.0.0.1,8082 tcp from not "table(0)" to not me dst-port 80 in

${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 tee 1 ip from any to any
${f} add 450 tee 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 tee 1 ip from any to any
${f} add 540 allow ip from any to any


${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723

${f} add 2100 deny ip from any to any

${f} add 32490 deny ip from any to any

[root@router /usr/home/serjio]# cat /etc/rc.firewall
#!/bin/sh -
f='/sbin/ipfw'

ifOut='fxp0'

${f} -f flush

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any
${f} add 55 allow tcp from any to me dst-port 8081,8082

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me

${f} add 300 skipto 4500 ip from any to any in

${f} add 280 fwd 127.0.0.1,8081 tcp from "table(35)" to not me dst-port 80 in
${f} add 290 fwd 127.0.0.1,8082 tcp from not "table(0)" to not me dst-port 80 in

${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 tee 1 ip from any to any
${f} add 450 tee 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 tee 1 ip from any to any
${f} add 540 allow ip from any to any


${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723

${f} add 2100 deny ip from any to any

${f} add 32490 deny ip from any to any

[Efendy]

ipfw add 1 allow ip from any to any
работает?
нет:
tcpdump -ifxp0 -n
айпишники локальные в дампе? да - нат не работает.

[SerjioMati]

16:00:31.403246 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 102304:102820, ack 1465, win 32, length 516
16:00:31.604825 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 102820, win 256, length 0
16:00:32.081739 IP 173.194.65.113.80 > 193.142.219.110.64109: Flags [S.], seq 2206137434, ack 919262447, win 14300, options [mss 1430,nop,nop,sackOK], length 0
16:00:32.114599 ARP, Request who-has 192.168.88.247 tell 192.168.88.109, length 46
16:00:32.116726 IP 192.168.2.1 > 224.0.0.1: igmp query v2
16:00:32.116740 IP 192.168.2.1 > 224.0.0.1: igmp query v2
16:00:32.403282 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 102820:103464, ack 1465, win 32, length 644
16:00:32.405849 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [P.], seq 1465:1549, ack 103464, win 254, length 84
16:00:32.405885 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [P.], seq 1549:1601, ack 103464, win 254, length 52
16:00:32.405904 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [.], ack 1601, win 32, length 0
16:00:32.406014 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 103464:103500, ack 1601, win 32, length 36
16:00:32.539146 IP 192.168.88.109 > 224.0.0.252: igmp v2 report 224.0.0.252
16:00:32.539268 IP 192.168.88.109 > 224.0.0.252: igmp v2 report 224.0.0.252
16:00:32.604785 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 103500, win 253, length 0
16:00:32.623269 IP 10.10.0.15 > 239.255.255.250: igmp v2 report 239.255.255.250
16:00:32.623305 IP 10.10.0.15 > 239.255.255.250: igmp v2 report 239.255.255.250
16:00:33.038965 ARP, Request who-has 192.168.88.247 tell 192.168.88.109, length 46
16:00:33.039087 ARP, Request who-has 192.168.88.247 tell 192.168.88.109, length 46
16:00:33.231296 IP 93.186.224.245.80 > 193.142.219.110.64965: Flags [S.], seq 1108184445, ack 911130356, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 2], length 0
16:00:33.403390 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 103500:104896, ack 1601, win 32, length 1396
16:00:34.038889 ARP, Request who-has 192.168.88.247 tell 192.168.88.109, length 46
16:00:34.128995 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 103500:104896, ack 1601, win 32, length 1396
16:00:34.334635 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 104896, win 256, length 0
16:00:34.403249 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 104896:105380, ack 1601, win 32, length 484
16:00:34.475488 IP 173.194.65.113.80 > 193.142.219.110.64109: Flags [S.], seq 2206137434, ack 919262447, win 14300, options [mss 1430,nop,nop,sackOK], length 0
16:00:34.488103 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
16:00:34.604621 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 105380, win 254, length 0
16:00:34.698296 IP 193.142.219.110.64965 > 93.186.224.245.80: Flags , seq 911130355, win 8192, options [mss 1460,nop,nop,sackOK], length 0
16:00:34.755461 IP 93.186.224.245.80 > 193.142.219.110.64965: Flags [S.], seq 1108184445, ack 911130356, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 2], length 0
16:00:34.862477 ARP, Request who-has 192.168.88.108 tell 192.168.88.1, length 46
16:00:35.237890 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
16:00:35.403369 ARP, Request who-has 193.142.219.109 tell 193.142.219.110, length 28
16:00:35.403376 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 105380:106424, ack 1601, win 32, length 1044
16:00:35.403645 ARP, Reply 193.142.219.109 is-at 00:0c:42:b0:a8:12, length 46
16:00:35.605617 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 106424, win 256, length 0
16:00:35.862510 ARP, Request who-has 192.168.88.108 tell 192.168.88.1, length 46
16:00:35.987872 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
16:00:36.403276 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 106424:107052, ack 1601, win 32, length 628
16:00:36.604990 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 107052, win 254, length 0
16:00:36.862566 ARP, Request who-has 192.168.88.108 tell 192.168.88.1, length 46
16:00:37.403223 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 107052:107408, ack 1601, win 32, length 356
16:00:37.604439 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 107408, win 252, length 0
16:00:38.114190 ARP, Request who-has 192.168.88.247 tell 192.168.88.109, length 46
16:00:38.403260 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 107408:107764, ack 1601, win 32, length 356
16:00:38.604341 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 107764, win 251, length 0
16:00:39.038526 ARP, Request who-has 192.168.88.247 tell 192.168.88.109, length 46
16:00:39.061921 ARP, Request who-has 10.10.0.17 tell 10.10.0.1, length 46
16:00:39.269597 IP 173.194.65.113.80 > 193.142.219.110.64109: Flags [S.], seq 2206137434, ack 919262447, win 14300, options [mss 1430,nop,nop,sackOK], length 0
16:00:39.403272 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 107764:108360, ack 1601, win 32, length 596
16:00:39.604751 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 108360, win 256, length 0
16:00:40.038463 ARP, Request who-has 192.168.88.247 tell 192.168.88.109, length 46
16:00:40.038619 IP 192.168.88.109 > 224.0.0.253: igmp v2 report 224.0.0.253
16:00:40.403247 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 108360:108796, ack 1601, win 32, length 436
16:00:40.604692 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 108796, win 254, length 0
16:00:41.007328 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
16:00:41.403230 ARP, Request who-has 193.142.219.109 tell 193.142.219.110, length 28
16:00:41.403236 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 108796:109168, ack 1601, win 32, length 372
16:00:41.403502 ARP, Reply 193.142.219.109 is-at 00:0c:42:b0:a8:12, length 46
16:00:41.604155 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 109168, win 253, length 0
16:00:41.757078 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
16:00:41.843453 IP 193.142.219.110.51428 > 173.194.65.138.80: Flags , seq 1474908428, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:00:42.350817 IP 173.194.65.138.80 > 193.142.219.110.51428: Flags [S.], seq 1981962674, ack 1474908429, win 14300, options [mss 1430,nop,nop,sackOK,nop,wscale 6], length 0
16:00:42.403343 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 109168:110036, ack 1601, win 32, length 868
16:00:42.507116 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
16:00:42.605554 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 110036, win 256, length 0
16:00:42.961935 IP 173.194.65.138.80 > 193.142.219.110.51428: Flags [S.], seq 1981962674, ack 1474908429, win 14300, options [mss 1430,nop,nop,sackOK,nop,wscale 6], length 0
16:00:43.202934 ARP, Request who-has 192.168.88.108 tell 192.168.88.1, length 46
16:00:43.403279 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 110036:110664, ack 1601, win 32, length 628
16:00:43.605029 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 110664, win 254, length 0
16:00:43.759886 IP 193.142.219.110.53549 > 193.142.219.122.53: 44779+ [1au] A? dsn0.d.skype.net. (45)
16:00:43.760193 IP 193.142.219.110.65476 > 193.142.219.122.53: 5331+ [1au] NS? . (28)
16:00:43.789913 IP 193.142.219.122.53 > 193.142.219.110.65476: 5331 14/0/23 NS h.root-servers.net., NS i.root-servers.net., NS b.root-servers.net., NS g.root-servers.net., NS e.root-servers.net., NS a.root-servers.net., NS k.root-servers.net., NS j.root-servers.net., NS d.root-servers.net., NS l.root-servers.net., NS c.root-servers.net., NS m.root-servers.net., NS f.root-servers.net., RRSIG (857)
16:00:43.905025 IP 193.142.219.122.53 > 193.142.219.110.53549: 44779 9/10/11 CNAME dsn0.skype-dsn.akadns.net., A 111.221.77.148, A 157.55.56.149, A 157.55.130.144, A 157.55.130.150, A 157.55.235.160, A 157.55.235.161, A 157.56.52.13, A 65.55.223.27 (601)
16:00:43.905928 IP 193.142.219.110.55267 > 8.8.4.4.53: 5748+ [1au] A? dsn0.skype-dsn.akadns.net. (54)
16:00:43.969176 IP 8.8.4.4.53 > 193.142.219.110.55267: 5748 8/0/1 A 157.55.130.158, A 213.199.179.149, A 111.221.77.143, A 157.55.130.162, A 213.199.179.160, A 157.55.130.152, A 213.199.179.145, A 157.55.56.153 (182)
16:00:43.969886 ARP, Request who-has 10.10.0.15 tell 10.10.0.1, length 46
16:00:43.970010 ARP, Request who-has 10.10.0.15 tell 10.10.0.1, length 46
16:00:44.161800 IP 173.194.65.138.80 > 193.142.219.110.51428: Flags [S.], seq 1981962674, ack 1474908429, win 14300, options [mss 1430,nop,nop,sackOK,nop,wscale 6], length 0
16:00:44.202964 ARP, Request who-has 192.168.88.108 tell 192.168.88.1, length 46
16:00:44.202984 ARP, Request who-has 192.168.88.108 tell 192.168.88.1, length 46
16:00:44.343616 ARP, Request who-has 10.10.0.17 tell 10.10.0.1, length 46
16:00:44.403533 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [.], seq 110664:112124, ack 1601, win 32, length 1460
16:00:44.403550 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 112124:112668, ack 1601, win 32, length 544
16:00:44.406821 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 112668, win 256, length 0
16:00:44.408133 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [P.], seq 1601:1685, ack 112668, win 256, length 84
16:00:44.408145 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [P.], seq 1685:1737, ack 112668, win 256, length 52
16:00:44.408162 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [.], ack 1737, win 32, length 0
16:00:44.408253 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 112668:112704, ack 1737, win 32, length 36
16:00:44.606418 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 112704, win 256, length 0
16:00:44.854132 IP 193.142.219.110.51428 > 173.194.65.138.80: Flags , seq 1474908428, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
16:00:44.932254 IP 173.194.65.138.80 > 193.142.219.110.51428: Flags [S.], seq 1981962674, ack 1474908429, win 14300, options [mss 1430,nop,nop,sackOK,nop,wscale 6], length 0
16:00:45.203009 ARP, Request who-has 192.168.88.108 tell 192.168.88.1, length 46
16:00:45.403392 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 112704:114084, ack 1737, win 32, length 1380
16:00:45.606382 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 114084, win 251, length 0
16:00:45.759332 ARP, Request who-has 10.10.0.15 tell 10.10.0.1, length 46
16:00:46.403237 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 114084:114440, ack 1737, win 32, length 356
16:00:46.553105 IP 173.194.65.138.80 > 193.142.219.110.51428: Flags [S.], seq 1981962674, ack 1474908429, win 14300, options [mss 1430,nop,nop,sackOK,nop,wscale 6], length 0
16:00:46.604278 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 114440, win 256, length 0
16:00:47.007546 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
16:00:47.403262 ARP, Request who-has 193.142.219.109 tell 193.142.219.110, length 28
16:00:47.403268 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 114440:114988, ack 1737, win 32, length 548
16:00:47.403537 ARP, Reply 193.142.219.109 is-at 00:0c:42:b0:a8:12, length 46
16:00:47.604734 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 114988, win 254, length 0
16:00:47.757366 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
16:00:48.403270 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 114988:115536, ack 1737, win 32, length 548
16:00:48.447729 IP 192.168.88.1.5678 > 255.255.255.255.5678: UDP, length 99
16:00:48.447752 CDPv1, ttl: 120s, Device-ID 'Loza (EuroNet)', length 75
16:00:48.507337 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
16:00:48.604685 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 115536, win 252, length 0
16:00:49.380739 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
16:00:49.404043 IP 193.142.219.110.22 > 193.142.219.109.54850: Flags [P.], seq 115536:116164, ack 1737, win 32, length 628
16:00:49.606100 IP 193.142.219.109.54850 > 193.142.219.110.22: Flags [.], ack 116164, win 256, length 0
16:00:50.130426 IP 10.10.0.17.137 > 10.10.0.255.137: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST

[SerjioMati]

ipfw add 1 allow ip from any to any
работает?

Ні не працює

[SerjioMati]

виконав команду /etc/rc.d/ipfw stop
і запрацював інет

[SerjioMati]

Коли включаю firewall (/etc/rc.d/ipfw start) то виключається інтернет у кліентів..коли його виключаю то включаєть..але тоді включається всіх користувачів які заплатили і не заплатили..в чому може бути проблема?

cat /etc/rc.firewall
#!/bin/sh -
f='/sbin/ipfw'

ifOut='fxp0'

${f} -f flush

${f} add 50 allow tcp from any to me 22
${f} add 51 allow tcp from me 22 to any
${f} add 55 allow tcp from any to me dst-port 8081,8082

${f} add 110 allow ip from any to any via lo0
${f} add 120 skipto 1000 ip from me to any
${f} add 130 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${f} add 160 skipto 2000 ip from any to me

${f} add 200 skipto 500 ip from any to any via ${ifOut}

${f} add 300 skipto 4500 ip from any to any in

${f} add 270 deny tcp from not "table(0)" to 90.183.101.0/24
${f} add 280 fwd 127.0.0.1,8081 tcp from "table(35)" to not me dst-port 80 in
${f} add 290 fwd 127.0.0.1,8082 tcp from not "table(0)" to not me dst-port 80 in

${f} add 400 skipto 450 ip from any to any recv ${ifOut}
${f} add 420 tee 1 ip from any to any
${f} add 450 tee 2 ip from any to any
${f} add 490 allow ip from any to any

${f} add 500 skipto 32500 ip from any to any in
${f} add 510 tee 1 ip from any to any
${f} add 540 allow ip from any to any

${f} add 1000 allow udp from any 53,7723 to any
${f} add 1010 allow tcp from any to any setup keep-state
${f} add 1020 allow udp from any to any keep-state
${f} add 1100 allow ip from any to any

${f} add 2000 check-state
${f} add 2010 allow icmp from any to any
${f} add 2020 allow tcp from any to any 80,443
#${f} add 2050 deny ip from any to any via ${ifOut}
${f} add 2060 allow udp from any to any 53,7723

${f} add 2100 deny ip from any to any

${f} add 32490 deny ip from any to any

[0xbad0c0d3]

В том, что ядро не запущено, скорее всего

[SerjioMati]

авторизатор то зелений

[elite]

объединил все темы serhiy141 в одну

[ser970]

авторизатор то зелений

если есть ssh то постучи в аську - помогу