Muxyul
Newbie | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
не получатся прокинуть порт в pf.conf, OS FreeBSD 7.1
тритий день бьюсь... во фре я не очень, сервак достался по наследству
нужно пробросить порт 3389 на локальную машину 192.168.5.5
порты для веб-сервера и почты, проброшенные до меня, работают
вот конфиг:
Код:
ext_if="xl0"
int_if="xl1"
tcp_services="{ 7777, auth, domain, http, https, 21, 20, 3389}"
client_out = "{ ftp-data, ftp, ssh, 7777, domain, 110, 25, auth, nntp, http, https, 446, cvspserver, 2628, cvsup, 8000, 8080, 3389}"
webserver = "192.168.5.2"
webports = "{ http, https }"
emailserver = "192.168.5.2"
emails = "{ smtp, pop3, imaps, pop3s }"
#emails = "{ smtp, pop3, imap, imap3, imaps, pop3s }"
# --------------------------------------------------------------------
icmp_types = "echoreq"
#int_net = "192.168.5.0/24"
int_net = "{ 127.0.0.0/8, 192.168.5.0/24 }"
ext_ip="79.122.193.78"
ftp_ip = "192.168.5.1"
NoRouteIPs = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
#priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
#-----------------------------------------------------------------------------
# options
#-----------------------------------------------------------------------------
#set fingerprints "/etc/pf.os.test"
#set timeout interval 10
#set timeout frag 30
#set limit { frags 5000, states 2500 }
set optimization high-latency
set block-policy drop
set state-policy if-bound
#set skip on lo0
set skip on xl1
set loginterface $ext_if
# scrub
scrub in all
#-----------------------------------------------------------------------------
# Redirect rules
#-----------------------------------------------------------------------------
#сЛПТС ДМС ftp-proxy
nat-anchor "ftp-proxy/*"
#no rdr on lo0 from any to any
#no nat on $int_if proto tcp from $int_if to $int_net
#nat on $ext_if from $int_net to any -> ($ext_if)
nat on $ext_if from $int_if:network to any -> ($ext_if)
rdr-anchor "ftp-proxy/*"
rdr on $ext_if proto tcp from any to any port $webports -> $webserver
rdr on $ext_if proto tcp from any to any port $emails -> $emailserver
rdr on $ext_if proto tcp from any to any port 3389 -> 192.168.5.5 port 3389
rdr on $ext_if proto tcp from any to any port 5650 -> 192.168.5.11
rdr on $ext_if proto tcp from any to 79.122.193.78 port 7071 -> $emailserver
rdr on $ext_if proto tcp from any to 79.122.193.78 port 9999 -> 192.168.5.234 port 80
rdr on $ext_if proto tcp from any to 79.122.193.78 port 9000 -> 192.168.5.234
rdr on $ext_if proto tcp from 193.200.10.26 to any port 9040 -> 192.168.5.201
rdr on $ext_if proto tcp from 193.200.10.26 to any port 9080 -> 192.168.5.201
rdr on $ext_if proto tcp from 193.200.10.26 to any port 9443 -> 192.168.5.201
rdr on $ext_if proto tcp from 193.200.10.26 to any port 443 -> 192.168.5.201
rdr on $ext_if proto tcp from 193.200.10.26 to any port 80 -> 192.168.5.201
rdr on $ext_if proto tcp from 193.200.10.18 to any port 9040 -> 192.168.5.201
rdr on $ext_if proto tcp from 193.200.10.18 to any port 9080 -> 192.168.5.201
rdr on $ext_if proto tcp from 193.200.10.18 to any port 9443 -> 192.168.5.201
rdr on $ext_if proto tcp from 193.200.10.18 to any port 443 -> 192.168.5.201
rdr on $ext_if proto tcp from 193.200.10.18 to any port 80 -> 192.168.5.201
#GSM mashine Dmitry
rdr on $ext_if proto tcp from 195.151.251.101 to any port 30583 -> 192.168.5.27
#rdr pass on $int_if proto tcp to port { http, https } -> 192.168.5.1 port 3128
rdr on $int_if proto tcp from $int_if:network port http to $ext_if port 80 -> 192.168.5.1 port 3128
rdr on $int_if proto tcp from $int_if:network port https to $ext_if port 80 -> 192.168.5.1 port 3128
#-----------------------------------------------------------------------------
# Filter rules
#-----------------------------------------------------------------------------
# block all by default
block all
block on $ext_if all
#pass on lo0 all keep state
pass from { lo0, $int_if:network } to any keep state
antispoof quick for $int_if inet
# pass all traffic to and from the local network
####################################################
#pass in on $int_if from $int_net to any
#pass out on $int_if from any to $int_net
pass out all keep state
# пВЕУРЕЮЙЧБЕН ДПУФХР Л ОБЫЕНХ РПЮФПЧПНХ УЕТЧЕТХ
#
pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services flags S/SA keep state
#FTP
anchor "ftp-proxy/*"
# Allow incoming email
pass in on $ext_if proto tcp from any to $webserver port 80 flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $emailserver port $emails flags S/SA synproxy state
pass in on $ext_if proto tcp from any to 192.168.5.5 port 3389 flags S/SA synproxy state
pass out on $ext_if proto tcp from $emailserver to any port smtp flags S/SA synproxy state
pass out on $ext_if proto tcp from 192.168.5.5 to any port 3389 flags S/SA synproxy state
pass inet proto tcp to any port 7071 keep state
#pass quick inet proto tcp to any port 7071 keep state
pass in on $ext_if proto tcp from any to 192.168.5.234 flags S/SA synproxy state
###########################################################################
pass in quick on $ext_if inet proto tcp from 193.200.10.18 to 192.168.5.201
pass in quick on $ext_if inet proto tcp from 193.200.10.26 to 192.168.5.201
pass in quick on $ext_if inet proto tcp from 195.151.251.101 port 30583 to 192.168.5.27 port 30583
###########################################################################
pass quick inet proto tcp from $int_if:network to any port $client_out flags S/SA keep state
###########################################################################
#pass out on $ext_if inet proto tcp from any to any port 7777 keep state
###########################################################################
# рТБЧЙМП ОЙЦЕ ТБВПФБЕФ У ЛПНБОДПК traceroute ОБ ЧУЕИ Unix
# allow out the default range for traceroute(8):
# "base+nhops*nqueries-1" (33434+64*3-1)
pass out on $ext_if inet proto udp from any to any port 33433 >< 33626 keep state
###########################################################################
pass in inet proto icmp all icmp-type $icmp_types keep state
|
помогите пожалуйста
Добавлено:
в этот конфиг добалил 3 строчки, а остальное вообще не трогал
Код: rdr on $ext_if proto tcp from any to any port 3389 -> 192.168.5.5 port 3389
pass in on $ext_if proto tcp from any to 192.168.5.5 port 3389 flags S/SA synproxy state
pass out on $ext_if proto tcp from 192.168.5.5 to any port 3389 flags S/SA synproxy state |
|
Всего записей: 7 | Зарегистр. 24-07-2008 | Отправлено: 07:11 15-07-2011 | Исправлено: Muxyul, 07:19 15-07-2011 |
|
