добавляем в pf.confrdr pass on $ext_if proto tcp from any to ($ext_if) port 3389 tag RDP -> 192.168.0.5 port 3389
nat on $int_if tagged RDP -> 192.168.0.1
на внешнем интерфейсе запускаем tshark
router# tshark -i vr0 -V port 3389
Capturing on vr0
Из внешней сети делаем:
[root@router /etc]# telnet 91.197.xxx.xxx 3389
Trying 91.197.213.4...
telnet: connect to address 91.197.xxx.xxx: Connection refused
telnet: Unable to connect to remote host
и видим что думает по этому поводу tshark:
Frame 1 (74 bytes on wire, 74 bytes captured)
Arrival Time: Apr 4, 2009 11:28:02.196371000
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
Ethernet II, Src: Cisco_d2:fd:01 (00:1c:58:d2:fd:01), Dst: D-Link_ec:b6:63 (00:13:46:ec:b6:63)
Destination: D-Link_ec:b6:63 (00:13:46:ec:b6:63)
Address: D-Link_ec:b6:63 (00:13:46:ec:b6:63)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Cisco_d2:fd:01 (00:1c:58:d2:fd:01)
Address: Cisco_d2:fd:01 (00:1c:58:d2:fd:01)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 81.222.xxx.xxx (81.222.xxx.xxx), Dst: 91.197.xxx.xxx (91.197.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0xd733 (55091)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 57
Protocol: TCP (0x06)
Header checksum: 0xfcbc [correct]
[Good: True]
[Bad : False]
Source: 81.222.xxx.xxx (81.222.xxx.xxx)
Destination: 91.197.xxx.xxx (91.197.xxx.xxx)
Transmission Control Protocol, Src Port: 53536 (53536), Dst Port: ms-wbt-server (3389), Seq: 0, Len: 0
Source port: 53536 (53536)
Destination port: ms-wbt-server (3389)
Sequence number: 0 (relative sequence number)
Header length: 40 bytes
Flags: 0x02 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 65535
Checksum: 0x8b53 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1420 bytes
NOP
Window scale: 3 (multiply by 8)
SACK permitted
Timestamps: TSval 5572585, TSecr 0
Frame 2 (60 bytes on wire, 60 bytes captured)
Arrival Time: Apr 4, 2009 11:28:02.196395000
[Time delta from previous captured frame: 0.000024000 seconds]
[Time delta from previous displayed frame: 0.000024000 seconds]
[Time since reference or first frame: 0.000024000 seconds]
Frame Number: 2
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
Ethernet II, Src: D-Link_ec:b6:63 (00:13:46:ec:b6:63), Dst: Cisco_d2:fd:01 (00:1c:58:d2:fd:01)
Destination: Cisco_d2:fd:01 (00:1c:58:d2:fd:01)
Address: Cisco_d2:fd:01 (00:1c:58:d2:fd:01)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_ec:b6:63 (00:13:46:ec:b6:63)
Address: D-Link_ec:b6:63 (00:13:46:ec:b6:63)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Trailer: 000000000000
Internet Protocol, Src: 91.197.xxx.xxx (91.197.xxx.xxx), Dst: 81.222.xxx.xxx (81.222.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0xac86 (44166)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x207e [correct]
[Good: True]
[Bad : False]
Source: 91.197.xxx.xxx (91.197.xxx.xxx)
Destination: 81.222.xxx.xxx (81.222.xxx.xxx)
Transmission Control Protocol, Src Port: ms-wbt-server (3389), Dst Port: 53536 (53536), Seq: 1, Ack: 1, Len: 0
Source port: ms-wbt-server (3389)
Destination port: 53536 (53536)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x14 (RST, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .1.. = Reset: Set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 0
Checksum: 0xfb34 [correct]
[Good Checksum: True]
[Bad Checksum: False]
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 1]
[The RTT to ACK the segment was: 0.000024000 seconds]
На внутреннем интерфейсе tshark молчит.
