Исходное сообщение
"Не работает интернет ipfw one_pass" Отправлено sasiska, 31-Июл-17 21:28
> 'ipfw list' при one_pass=1 можно увидеть? В начале правил всякие #${FwCMD} add > deny ip from any to 192.168.0.0/16 in via ${LanOut}/${LanOut2} точно неактивны? Да, спасибо, точно не активны: root@gate:/ # sysctl net.inet.ip.fw.one_pass=1 net.inet.ip.fw.one_pass: 1 -> 1 root@gate:/ # ipfw list 00100 check-state 00200 allow ip from any to any via lo0 00300 deny ip from any to 127.0.0.0/8 00400 deny ip from 127.0.0.0/8 to any 00500 deny ip from any to xx.xx.xx.xx tcpflags !syn,!fin,!ack,rst 00600 deny ip from xx.xx.xx.xx to any tcpflags !syn,!fin,!ack,rst 00700 deny ip from any to xx.xx.xx.xx 00800 deny ip from xx.xx.xx.xx to any 00900 allow ip from any to 10.10.0.0/24 in via em1 01000 deny ip from any to 10.0.0.0/8 in via em1 01100 deny ip from any to 172.16.0.0/12 in via em1 01200 deny ip from any to 0.0.0.0/8 in via em1 01300 deny ip from any to 169.254.0.0/16 in via em1 01400 deny ip from any to 240.0.0.0/4 in via em1 01500 deny icmp from any to any frag 01600 deny icmp from any to 255.255.255.255 in via em1 01700 deny icmp from any to 255.255.255.255 out via em1 01800 deny ip from any to 10.0.0.0/8 in via em2 01900 deny ip from any to 172.16.0.0/12 in via em2 02000 deny ip from any to 0.0.0.0/8 in via em2 02100 deny ip from any to 169.254.0.0/16 in via em2 02200 deny ip from any to 240.0.0.0/4 in via em2 02300 deny icmp from any to 255.255.255.255 in via em2 02400 deny icmp from any to 255.255.255.255 out via em2 02500 deny tcp from any to 11.11.11.12 dst-port 22,80,10050,10051,3128,3129,3130,10000,139,445 via em1 02600 deny icmp from 11.11.11.1 to 192.168.12.4 via em2 02700 nat 1 ip4 from any to any via em1 02800 nat 2 ip4 from any to any via em2 02900 allow ip from any to any via em0 03000 queue 1 ip from any to 192.168.0.0/21 via em1 03100 queue 2 ip from 192.168.0.0/21 to any via em1 03200 queue 3 ip from any to 192.168.0.0/21 via em2 03300 queue 4 ip from 192.168.0.0/21 to any via em2 03400 allow ip from 192.168.7.224/27 to any 03500 allow ip from any to 192.168.7.224/27 03600 allow tcp from me to any out via em1 uid squid keep-state 03700 allow tcp from me to any out via em2 uid squid keep-state 03800 fwd 127.0.0.1,3129 tcp from 192.168.0.0/22 to any dst-port 80,8080 via em1 03900 fwd 127.0.0.1,3129 tcp from 192.168.0.0/22 to any dst-port 80,8080 via em2 04000 fwd 127.0.0.1,3127 tcp from 192.168.0.0/22 to any dst-port 443 via em1 04100 fwd 127.0.0.1,3127 tcp from 192.168.0.0/22 to any dst-port 443 via em2 04200 allow ip from any to any via tun0 04300 allow ip from any to me dst-port 1194 04400 allow ip from 192.168.11.0/24 to me 04500 allow ip from me to 192.168.11.0/24 04600 allow tcp from any to me dst-port 1701 setup keep-state 04700 allow ip from y.y.y.y to me 04800 allow ip from me to y.y.y.y 04900 allow ip from q.q.q.q to me 05000 allow ip from me to q.q.q.q 05100 allow ip from any to w.w.w.w 05200 allow ip from w.w.w.w to any 05300 allow ip from any to e.e.e.e 05400 allow ip from e.e.e.e to any 05500 allow ip from any to r.r.r.r 05600 allow ip from r.r.r.r to any 05700 allow ip from any 60179 to any dst-port 60179 05800 allow ip from any 60179 to any dst-port 60179 05900 allow ip from 192.168.0.40 to any 06000 allow ip from any to 192.168.0.40 06100 allow ip from any to t.t.t.t 06200 allow ip from t.t.t.t to any 06300 allow tcp from any to any established 06400 allow ip from any to any dst-port 9010 via em1 06500 allow ip from any 9010 to any via em1 06600 allow udp from any to any dst-port 53 via em1 06700 allow udp from any 53 to any via em1 06800 allow tcp from any to any dst-port 53 via em1 06900 allow udp from any to any dst-port 53 via em2 07000 allow udp from any 53 to any via em2 07100 allow tcp from any to any dst-port 53 via em2 07200 allow udp from any to any dst-port 123 via em1 07300 allow udp from any to any dst-port 123 via em2 07400 allow tcp from me 21,20 to any dst-port 21,20 via em1 07500 allow tcp from any 21,20 to me dst-port 21,20 via em1 07600 allow ip from any 20,21 to any dst-port 20,21 via em1 07700 allow tcp from any to y.y.y.y dst-port 50000-50100 via em1 07800 allow tcp from any to 192.168.12.4 dst-port 50000-50100 via em2 07900 allow icmp from any to any icmptypes 0,8,11 08000 allow tcp from any to y.y.y.y dst-port 25 via em1 08100 allow tcp from any to 192.168.12.4 dst-port 25 via em2 08200 allow udp from any 87 to any via em1 08300 allow udp from any to any dst-port 87 via em1 08400 allow udp from any 87 to any via em2 08500 allow udp from any to any dst-port 87 via em2 08600 allow tcp from any to any dst-port 1024 via em1 08700 allow tcp from any 1024 to any via em1 08800 allow tcp from any to any dst-port 1024 via em2 08900 allow tcp from any 1024 to any via em2 09000 allow tcp from any to any dst-port 9443 via em1 09100 allow tcp from any 9443 to any via em1 09200 allow tcp from any to any dst-port 9443 via em2 09300 allow tcp from any 9443 to any via em2 09400 allow tcp from any 8010 to any via em1 09500 allow tcp from any to any dst-port 8010 via em1 09600 allow tcp from any 8010 to any via em2 09700 allow tcp from any to any dst-port 8010 via em2 09800 allow tcp from any to y.y.y.y dst-port 143 via em1 09900 allow tcp from any to 192.168.12.4 dst-port 143 via em2 10000 allow tcp from 192.168.0.0/21 to 192.168.0.4 dst-port 110 via em0 10100 allow ip from 192.168.0.0/21 to 192.168.0.0/21 via em0 10200 allow udp from any to any via em0 10300 allow icmp from any to any via em0 10400 allow tcp from 192.168.0.0/21 to any dst-port 21,49000-65535 keep-state 10500 allow tcp from 192.168.0.0/21 to any dst-port 80,443,21,9443,3128,21,20,993,465,587,143,110,995,25,15100,2082,8443,443 in via em0 10600 allow tcp from any 80,443,21,9443,3128,993,465,587,143,110,995,25,15100,2082,8443,443 to 192.168.0.0/21 out via em0 10700 allow tcp from 192.168.0.0/21 to any dst-port 5190 in via em0 10800 allow tcp from any 5190 to 192.168.0.0/21 out via em0 10900 allow tcp from any 3389 to any via em0 11000 allow tcp from any to any dst-port 3389 via em0 11100 allow tcp from 192.168.0.0/21 to any dst-port 9091 in via em0 11200 allow tcp from any 9091 to 192.168.0.0/21 out via em0 11300 deny ip from any to any 65535 allow ip from any to any правило с номером 2500 включено, так как с ван-пассом на 1 часть пакетов, например 80, 3128 и перечисленные порты, видны из внешнего мира, поэтому пришлось закрыть их руками Когда выключаю one pass, то правило 2500 отключал И я не могу понять, почему если трафик загонять на прокси, то проблем нету, но если выпускать минуя squid, то проблемы есть.

Ваше сообщение
Имя*:
EMail:	Для отправки новых сообщений в текущей нити на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email). Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:	>> 'ipfw list' при one_pass=1 можно увидеть? В начале правил всякие #${FwCMD} add >> deny ip from any to 192.168.0.0/16 in via ${LanOut}/${LanOut2} точно неактивны? > Да, спасибо, точно не активны: > root@gate:/ # sysctl net.inet.ip.fw.one_pass=1 > net.inet.ip.fw.one_pass: 1 -> 1 > root@gate:/ # ipfw list > 00100 check-state > 00200 allow ip from any to any via lo0 > 00300 deny ip from any to 127.0.0.0/8 > 00400 deny ip from 127.0.0.0/8 to any > 00500 deny ip from any to xx.xx.xx.xx tcpflags !syn,!fin,!ack,rst > 00600 deny ip from xx.xx.xx.xx to any tcpflags !syn,!fin,!ack,rst > 00700 deny ip from any to xx.xx.xx.xx > 00800 deny ip from xx.xx.xx.xx to any > 00900 allow ip from any to 10.10.0.0/24 in via em1 > 01000 deny ip from any to 10.0.0.0/8 in via em1 > 01100 deny ip from any to 172.16.0.0/12 in via em1 > 01200 deny ip from any to 0.0.0.0/8 in via em1 > 01300 deny ip from any to 169.254.0.0/16 in via em1 > 01400 deny ip from any to 240.0.0.0/4 in via em1 > 01500 deny icmp from any to any frag > 01600 deny icmp from any to 255.255.255.255 in via em1 > 01700 deny icmp from any to 255.255.255.255 out via em1 > 01800 deny ip from any to 10.0.0.0/8 in via em2 > 01900 deny ip from any to 172.16.0.0/12 in via em2 > 02000 deny ip from any to 0.0.0.0/8 in via em2 > 02100 deny ip from any to 169.254.0.0/16 in via em2 > 02200 deny ip from any to 240.0.0.0/4 in via em2 > 02300 deny icmp from any to 255.255.255.255 in via em2 > 02400 deny icmp from any to 255.255.255.255 out via em2 > 02500 deny tcp from any to 11.11.11.12 dst-port 22,80,10050,10051,3128,3129,3130,10000,139,445 > via em1 > 02600 deny icmp from 11.11.11.1 to 192.168.12.4 via em2 > 02700 nat 1 ip4 from any to any via em1 > 02800 nat 2 ip4 from any to any via em2 > 02900 allow ip from any to any via em0 > 03000 queue 1 ip from any to 192.168.0.0/21 via em1 > 03100 queue 2 ip from 192.168.0.0/21 to any via em1 > 03200 queue 3 ip from any to 192.168.0.0/21 via em2 > 03300 queue 4 ip from 192.168.0.0/21 to any via em2 > 03400 allow ip from 192.168.7.224/27 to any > 03500 allow ip from any to 192.168.7.224/27 > 03600 allow tcp from me to any out via em1 uid squid > keep-state > 03700 allow tcp from me to any out via em2 uid squid > keep-state > 03800 fwd 127.0.0.1,3129 tcp from 192.168.0.0/22 to any dst-port 80,8080 via em1 > 03900 fwd 127.0.0.1,3129 tcp from 192.168.0.0/22 to any dst-port 80,8080 via em2 > 04000 fwd 127.0.0.1,3127 tcp from 192.168.0.0/22 to any dst-port 443 via em1 > 04100 fwd 127.0.0.1,3127 tcp from 192.168.0.0/22 to any dst-port 443 via em2 > 04200 allow ip from any to any via tun0 > 04300 allow ip from any to me dst-port 1194 > 04400 allow ip from 192.168.11.0/24 to me > 04500 allow ip from me to 192.168.11.0/24 > 04600 allow tcp from any to me dst-port 1701 setup keep-state > 04700 allow ip from y.y.y.y to me > 04800 allow ip from me to y.y.y.y > 04900 allow ip from q.q.q.q to me > 05000 allow ip from me to q.q.q.q > 05100 allow ip from any to w.w.w.w > 05200 allow ip from w.w.w.w to any > 05300 allow ip from any to e.e.e.e > 05400 allow ip from e.e.e.e to any > 05500 allow ip from any to r.r.r.r > 05600 allow ip from r.r.r.r to any > 05700 allow ip from any 60179 to any dst-port 60179 > 05800 allow ip from any 60179 to any dst-port 60179 > 05900 allow ip from 192.168.0.40 to any > 06000 allow ip from any to 192.168.0.40 > 06100 allow ip from any to t.t.t.t > 06200 allow ip from t.t.t.t to any > 06300 allow tcp from any to any established > 06400 allow ip from any to any dst-port 9010 via em1 > 06500 allow ip from any 9010 to any via em1 > 06600 allow udp from any to any dst-port 53 via em1 > 06700 allow udp from any 53 to any via em1 > 06800 allow tcp from any to any dst-port 53 via em1 > 06900 allow udp from any to any dst-port 53 via em2 > 07000 allow udp from any 53 to any via em2 > 07100 allow tcp from any to any dst-port 53 via em2 > 07200 allow udp from any to any dst-port 123 via em1 > 07300 allow udp from any to any dst-port 123 via em2 > 07400 allow tcp from me 21,20 to any dst-port 21,20 via em1 > 07500 allow tcp from any 21,20 to me dst-port 21,20 via em1 > 07600 allow ip from any 20,21 to any dst-port 20,21 via em1 > 07700 allow tcp from any to y.y.y.y dst-port 50000-50100 via em1 > 07800 allow tcp from any to 192.168.12.4 dst-port 50000-50100 via em2 > 07900 allow icmp from any to any icmptypes 0,8,11 > 08000 allow tcp from any to y.y.y.y dst-port 25 via em1 > 08100 allow tcp from any to 192.168.12.4 dst-port 25 via em2 > 08200 allow udp from any 87 to any via em1 > 08300 allow udp from any to any dst-port 87 via em1 > 08400 allow udp from any 87 to any via em2 > 08500 allow udp from any to any dst-port 87 via em2 > 08600 allow tcp from any to any dst-port 1024 via em1 > 08700 allow tcp from any 1024 to any via em1 > 08800 allow tcp from any to any dst-port 1024 via em2 > 08900 allow tcp from any 1024 to any via em2 > 09000 allow tcp from any to any dst-port 9443 via em1 > 09100 allow tcp from any 9443 to any via em1 > 09200 allow tcp from any to any dst-port 9443 via em2 > 09300 allow tcp from any 9443 to any via em2 > 09400 allow tcp from any 8010 to any via em1 > 09500 allow tcp from any to any dst-port 8010 via em1 > 09600 allow tcp from any 8010 to any via em2 > 09700 allow tcp from any to any dst-port 8010 via em2 > 09800 allow tcp from any to y.y.y.y dst-port 143 via em1 > 09900 allow tcp from any to 192.168.12.4 dst-port 143 via em2 > 10000 allow tcp from 192.168.0.0/21 to 192.168.0.4 dst-port 110 via em0 > 10100 allow ip from 192.168.0.0/21 to 192.168.0.0/21 via em0 > 10200 allow udp from any to any via em0 > 10300 allow icmp from any to any via em0 > 10400 allow tcp from 192.168.0.0/21 to any dst-port 21,49000-65535 keep-state > 10500 allow tcp from 192.168.0.0/21 to any dst-port 80,443,21,9443,3128,21,20,993,465,587,143,110,995,25,15100,2082,8443,443 > in via em0 > 10600 allow tcp from any 80,443,21,9443,3128,993,465,587,143,110,995,25,15100,2082,8443,443 > to 192.168.0.0/21 out via em0 > 10700 allow tcp from 192.168.0.0/21 to any dst-port 5190 in via em0 > 10800 allow tcp from any 5190 to 192.168.0.0/21 out via em0 > 10900 allow tcp from any 3389 to any via em0 > 11000 allow tcp from any to any dst-port 3389 via em0 > 11100 allow tcp from 192.168.0.0/21 to any dst-port 9091 in via em0 > 11200 allow tcp from any 9091 to 192.168.0.0/21 out via em0 > 11300 deny ip from any to any > 65535 allow ip from any to any > правило с номером 2500 включено, так как с ван-пассом на 1 часть > пакетов, например 80, 3128 и перечисленные порты, видны из внешнего мира, > поэтому пришлось закрыть их руками > Когда выключаю one pass, то правило 2500 отключал > И я не могу понять, почему если трафик загонять на прокси, то > проблем нету, но если выпускать минуя squid, то проблемы есть.
	Введите код, изображенный на картинке: