🚀 go-pugleaf

bulba008 pisze:
>> To dla Ciebie bedzie najlepsze:
>> http://openbsd.org/faq/pf/pl/index.html
>>
> Dobra skleilem cos takiego, gdzie cos poprawic? Moze cos jest 
> nadmiarowe. Jedyny problem do brak dostepu do serwera ftp na tym samym 
> kompie co jest bramka do netu z kompoterow z sieci lokalnej
> 
> ## MAKRA -----------------------------------------------------------------
> 
> ext_if = "bge0"
> int_if = "bge1"
> tcp_services = "{ 22, 25, 37, 52, 53, 80, 110, 113, 123, 143, 443, 5901, 
> 6001 }"
> udp_services = "{ 37, 53, 80, 110, 123 }"
> icmp_types = "echoreq"
> natone=int_if
> privnets="{ 127.0.0.0/8, 192.168.1.0/24 }"
> 
> 
> ## USTAWIENIA
> 
> set block-policy return
> 
> set loginterface $ext_if
> 
> set skip on lo
> 
> 
> ## NATOWANIE
> 
> nat on $ext_if from $int_if to any -> $ext_if
> 
> nat-anchor "ftp-proxy/*"
> 
> ## PRZEKIEROWANIA
> 
> rdr-anchor "ftp-proxy/*"
> 
> rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
> 
> rdr on $int_if inet proto tcp from any to any port www -> 127.0.0.1 port 
> 3128
> 
> 
> ## FILTROWANIE
> 
> block in
> 
> pass out keep state
> 
> anchor "ftp-proxy/*"
> 
> antispoof quick for { lo $int_if }
> 
> pass in on $int_if inet proto tcp from any to 127.0.0.1 port 3128 keep 
> state
> 
> pass in on $ext_if proto tcp from any to any port 21 keep state
> 
> pass in on $ext_if proto tcp from any to any port > 49151 \
>    keep state
> pass in on $ext_if inet proto tcp from any to $ext_if \
>    port $tcp_services flags S/SA keep state
> 
> pass in on $ext_if inet proto udp from any to $ext_if \
>    port $udp_services keep state
> 
> pass in inet proto icmp all icmp-type $icmp_types keep state
> 
> pass in quick on $int_if
> 
> pass out on $ext_if inet proto tcp from any to any port www keep state
> 
> pass quick on lo all

Prosze tylko o sprawdzenie tej konfiguracji, ew cos dodac, uproscic.