Добрый день!
Достался мне в наследство маршрутизатор на опенБЗД с файерволом PF. Вроде как в настройках не сильно закавыристый, но никак не могу разрешить пинговать внешние ресурсы с внутренней сети. С маршрутизатора всё пингуется, а из офисных машин глухо. Доменные имена определяет в айп.
В файле настройки есть такие строки:
pass in inet proto icmp all icmp-type $icmp_types keep state
pass out inet proto icmp all icmp-type $icmp_types keep state
(ping 8.8.8.8 - Ответ от 192.168.0.1: Заданный порт недоступен)Помогите найти в чём проблема.
Полный набор правил:
####################################################################################
ext_if = "rl0"
int_if = "rl1"
port_nat_tcp = "{22,9014,9015,7002,8443,1863,1930,1931,1932,1933,1934}"
port_nat_udp = "{5938,500,4500,10000}"
local_services = "{8000, 3333, ftp, ftp-data, ssh, smtp, 465, http, 8025, 993, 8080}"
allow_mysql = "{77.77.77.77, 127.0.0.1}"
mysql_service = "{3306}"
rfc1918nets = "{127.0.0.1/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 192.168.1.0/24}"
my_lan= "192.168.0.0/24"
wifi="192.168.0.252"
icmp_types = "echoreq"
allow_pop3 = "{11.11.11.11, 22.22.22.22, 33.33.33.33}"
allow_smtp = "{smtp.lucky.net}"
sql_allow_in = "{11.11.11.11,22.22.22.22,33.33.33.33,44.44.44.44,55.55.55.55,66.66.66.66,88.88.88.88,99.99.99.99,00.00.00.00)
sql_allow_in2 = "{11.11.11.11,22.22.22.22,33.33.33.33}"
ext_servers = "{11.11.11.11,22.22.22.22}"
table <spamd-white> persist
table <whitelist> persist file "/etc/exim/whiteip"
table <whitelist> persist file "/etc/exim/spfip"
table <officeips> persist file "/etc/pf/office"
table <nat_user> persist file "/etc/pf/nat_user"
#options
set block-policy return
set loginterface $ext_if
set loginterface $int_if
set skip on lo
#nat/rdr
pass out quick on $ext_if proto tcp from <officeips> to any port $port_nat_tcp nat-to $ext_if
pass out quick on $ext_if proto udp from <officeips> to any port $port_nat_udp nat-to $ext_if
pass out quick on $ext_if proto {tcp,udp} from any to $ext_servers nat-to $ext_if
pass out quick on $ext_if proto {tcp,udp} from $wifi to any nat-to $ext_if
pass out quick on $ext_if proto {tcp,udp} from <nat_user> to any nat-to $ext_if
#pop3+smtp
pass out quick on $ext_if proto tcp from <officeips> to $allow_pop3 port 110 nat-to ($ext_if:0)
#camrecorders
pass out quick on $ext_if from 192.168.0.150 to any nat-to $ext_if
pass out quick on $ext_if from 192.168.0.151 to any nat-to $ext_if
#ext redirects
#pass in on $ext_if proto tcp from any to $ext_if port 20010 rdr-to 192.168.0.10 port 3389
pass in quick on $ext_if proto tcp from any to $ext_if port 20010 rdr-to 192.168.0.10 port 4899
pass in quick on $ext_if proto tcp from any to $ext_if port 20070 rdr-to 192.168.0.210 port 4899
pass in quick on $ext_if proto tcp from any to $ext_if port 20150 rdr-to 192.168.0.150 port 4899
pass in quick on $ext_if proto tcp from any to $ext_if port 20003 rdr-to 192.168.0.3 port 4899
pass in quick on $ext_if proto tcp from any to $ext_if port 20060 rdr-to 192.168.0.60 port 4899
pass in quick on $ext_if proto tcp from any to $ext_if port 20072 rdr-to 192.168.0.72 port 4899
#samoturtest 192.168.0.201
pass in quick on $ext_if proto tcp from any to $ext_if port 20201 rdr-to 192.168.0.201 port 3389
pass in quick on $ext_if proto tcp from any to $ext_if port 3389 rdr-to 192.168.0.201 port 17543
pass in quick on $ext_if proto udp from any to $ext_if port 5116 rdr-to 192.168.0.201 port 5116
pass in quick on $ext_if proto tcp from $sql_allow_in to $ext_if port 41408 rdr-to 192.168.0.200 port 1433
pass in quick on $ext_if proto tcp from $sql_allow_in2 to $ext_if port 1433 rdr-to 192.168.0.200 port 1433
#videonablyudenie.
pass in quick on $ext_if proto tcp from any to $ext_if port 1500 rdr-to 192.168.0.150 port 1500
pass in quick on $ext_if proto tcp from any to $ext_if port 1501 rdr-to 192.168.0.151 port 1501
#camrecorder1
pass in quick on $ext_if proto tcp from any to $ext_if port 51211 rdr-to 192.168.0.151 port 80
#SPAMD
#custom whitelist
pass in quick on $ext_if proto tcp from <whitelist> to $ext_if port smtp rdr-to ($ext_if) port smtp
pass in quick on $ext_if proto tcp from ! <spamd-white> os Windows to $ext_if port smtp rdr-to (lo0) port spamd
==============================================================================================================================
#filter
anchor "ftp-proxy/*"
block all
pass in inet proto icmp all icmp-type $icmp_types keep state
pass out inet proto icmp all icmp-type $icmp_types keep state
pass out keep state
antispoof quick for {lo}
#services
pass on $int_if inet proto tcp from any to $ext_servers
pass in on $ext_if inet proto tcp from any to $ext_if port $local_services
pass in on $ext_if inet proto tcp from $allow_mysql to $ext_if port $mysql_service
pass in on $ext_if proto udp from any to $ext_if port {domain}
pass in on $ext_if proto tcp from any to $ext_if port {domain}
pass in on $ext_if proto tcp from any to any port > 49151 keep state.
#allow redirect
pass in on $ext_if inet proto tcp from any to 192.168.0.3 port 4899 flags S/SA synproxy state
############################allow redirect SAMOTUR TEST
pass in on $ext_if inet proto tcp from any to 192.168.0.200 port 3389 flags S/SA synproxy state
pass in on $ext_if inet proto tcp from any to 192.168.0.201 port {4899, 17543, 3389} flags S/SA synproxy state
pass in on $ext_if inet proto udp from any to 192.168.0.201 port 5116
pass in on $ext_if inet proto tcp from any to 192.168.0.201 port 4899 flags S/SA synproxy state
pass in on $ext_if proto tcp from any to ($ext_if) port ssh flags S/SA keep state (max-src-conn-rate 3/30, overload <ssh-bruteforce> fl
pass in on $ext_if proto tcp from any to ($ext_if) port ftp
block on $ext_if from $rfc1918nets to any
block drop in quick on $ext_if from <ssh-bruteforce>
pass in on $int_if from <officeips> to any
pass on $ext_if from 11.11.11.11 to any
Вариант для распечатки
(ok) on 03-Апр-15, 01:46 
