>>а ещё при перезагрузке скриптов выдаёт
>>-q=-q : not found FreeBSD
>>и всё перезагружается нормально
>>
>>в логах всё чисто, бред какойто :(
>
>почему бред - все прозрачно, видимо проблема в NAT Я снаружи конекчусь внутрь по rdp на виндовую машину, всё пробрасывает , изнутри инет отлично работат, вот настройкa pf
ext_if="ed0" # replace with actual external interface name i.e., dc0
int_if="fxp0" # replace with actual internal interface name i.e., dc1
internal_net="192.168.0.0/24"
external_addr="X.X.X.X"
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
tcp_services="{domain,ftp,smtp,rdp,777,http}"
#tcp_allow_outgoing="{5190,777,ftp,,443,563,80,smtp,20, 21,smtp,http}"
udp_services="{domain}"
icmp_types="echoreq"
servin = "192.168.0.250"
#table <disable_inet> persist file "/usr/local/etc/disable_internet"
#set timeout { icmp.first 20, icmp.error 10 }
#set timeout { other.first 60, other.single 30, other.multiple 60 }
#set timeout { adaptive.start 0, adaptive.end 0 }
#set limit { states 10000, frags 5000 }
#set loginterface $ext_if
#set optimization normal
#set block-policy drop
#set require-order yes
#set fingerprints "/etc/pf.os"
###############################################################################
############# BEGIN RULES ###############
############# NORMALIZACIJA ###############
###############################################################################
#1.1Vhodjashjie fragmenti nakaplivajutsja i peredajutsja daljshe filjtru
#scrub in on $ext_if all fragment reassemble min-ttl 20 max-mss 1440
#1.2Ubiraet opciju don't fragment iz ip-zagalovka
#scrub in on $ext_if all no-df
#1.3 Ni odnoj iz storon ne pozvoljaetsja umenjshitj IP TTL TTL dlja vseh paketov ustanavlivaetsja v maksimum
#scrub on ed0 all reassemble tcp
#2. NAT
rdr on $ext_if proto tcp from any to $external_addr port rdp -> $servin
rdr on $int_if proto tcp from $internal_net to any port http -> localhost port 3128
rdr on $ext_if proto tcp from any to $external_addr port smtp -> $servin
nat on $ext_if from $internal_net to any -> ($ext_if)
#pass in on $ext_if proto tcp from any to $external_addr port > 49151 keep state
#pass in quick on $ext_if proto tcp from any to $external_addr port 20 keep state
#pass in quick on $ext_if proto tcp from any to $external_addr port 21 keep state
#3.0 Block all traffik on external interface
block all
#pass all
### ALLOW LOCALHOST
pass on lo all
# activate spoofing protection for the internal interface.
antispoof quick for $int_if inet
#3.1 PORT SCANNERS FOR OS DETECTING
#block in quick proto tcp from any to $external_addr flags SF/SFRA
#block in quick proto tcp from any to $external_addr flags SFUP/SFRAU
#block in quick proto tcp from any to $external_addr flags FPU/SFRAUP
#block in quick proto tcp from any to $external_addr flags F/SFRA
#block in quick proto tcp from any to $external_addr flags U/SFRAU
#block in quick proto tcp from any to $external_addr flags P/P
#3.1 don't allow anyone to spoof non-routeble adresses
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
# Block from not alow internet users
#block in quick on $int_if from <disable_internet> to any
# Allow all with local net
pass in on $int_if from $internal_net to any keep state
pass out on $int_if from any to $internal_net keep state
#Enable incoming keep state trafic
pass in on $ext_if inet proto tcp from any to $ext_if port $tcp_services flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $servin port rdp \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $servin port smtp \
flags S/SA synproxy state
pass in on $ext_if proto udp from any to ($ext_if) \
port $udp_services
pass in inet proto icmp all icmp-type $icmp_types keep state
# Allow to outgoing traffic to inet
#pass out on $ext_if proto tcp from $ext_if to any port $tcp_allow_outgoing #proto tcp all #port $tcp_allow_ou
#tgoing modulate state flags S/SA
pass out on $ext_if proto tcp all keep state
pass out on $ext_if proto { udp, icmp } all keep state
В другом месте всё толже самое - и всё ок
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
(??) on 04-Май-06, 14:39 
