>Доступ к консоли есть? natd работает? правила с divert'ами покажите. Да доступ к консоли есть. natd работает. сейчас включил firewall в режим open.
проработало все это 40-50 минут и бабах. Пинга нет.
сейчас rc.conf выглядит так.
defaultrouter="193.201.118.149"
gateway_enable="YES"
hostname="elios.ipc.ru"
ifconfig_ed0="inet 193.201.118.150 netmask 255.255.255.252"
ifconfig_sk0="inet 192.168.0.1 netmask 255.255.255.0"
natd_enable="YES"
natd_interface="ed0"
natd_flags=""
linux_enable="NO"
usbd_enable="NO"
sendmail_enable="NONE"
firewall_enable="YES"
firewall_type="open"
firewall_script="/etc/rc.firewall"
firewall_logging="YES"
sshd_enable="YES"
#natd_flags="-m -u"
squid_enable="YES"
это из rc.firewall
#!/bin/sh -
# Suck in the configuration variables.
if [ -z "${source_rc_confs_defined}" ]; then
if [ -r /etc/defaults/rc.conf ]; then
. /etc/defaults/rc.conf
source_rc_confs
elif [ -r /etc/rc.conf ]; then
. /etc/rc.conf
fi
fi
############
setup_loopback () {
${fwcmd} add 100 pass all from any to any via lo0
${fwcmd} add 200 deny all from any to 127.0.0.0/8
${fwcmd} add 300 deny ip from 127.0.0.0/8 to any
}
if [ -n "${1}" ]; then
firewall_type="${1}"
fi
#
case ${firewall_quiet} in
[Yy][Ee][Ss])
fwcmd="/sbin/ipfw -q"
;;
*)
fwcmd="/sbin/ipfw"
;;
esac
#
${fwcmd} -f flush
############
case ${firewall_type} in
[Oo][Pp][Ee][Nn]|[Cc][Ll][Ii][Ee][Nn][Tt])
case ${natd_enable} in
[Yy][Ee][Ss])
if [ -n "${natd_interface}" ]; then
${fwcmd} add 50 divert natd all from any to any via ${natd_interface}
fi
;;
esac
esac
############
case ${firewall_type} in
[Oo][Pp][Ee][Nn])
setup_loopback
${fwcmd} add 65000 pass all from any to any
;;
[Cc][Ll][Ii][Ee][Nn][Tt])
# set these to your network and netmask and ip
net="192.0.2.0"
mask="255.255.255.0"
ip="192.0.2.1"
setup_loopback
${fwcmd} add pass all from ${ip} to ${net}:${mask}
${fwcmd} add pass all from ${net}:${mask} to ${ip}
${fwcmd} add pass tcp from any to any established
${fwcmd} add pass all from any to any frag
${fwcmd} add pass tcp from any to ${ip} 25 setup
${fwcmd} add pass tcp from ${ip} to any setup
${fwcmd} add deny tcp from any to any setup
${fwcmd} add pass udp from ${ip} to any 53 keep-state
${fwcmd} add pass udp from ${ip} to any 123 keep-state
;;
[Ss][Ii][Mm][Pp][Ll][Ee])
oif="ed0"
onet="192.0.2.0"
omask="255.255.255.240"
oip="192.0.2.1"
iif="ed1"
inet="192.0.2.16"
imask="255.255.255.240"
iip="192.0.2.17"
setup_loopback
${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}
${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
case ${natd_enable} in
[Yy][Ee][Ss])
if [ -n "${natd_interface}" ]; then
${fwcmd} add divert natd all from any to any via ${natd_interface}
fi
;;
esac
${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}
${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}
${fwcmd} add pass tcp from any to any established
${fwcmd} add pass all from any to any frag
${fwcmd} add pass tcp from any to ${oip} 25 setup
${fwcmd} add pass tcp from any to ${oip} 53 setup
${fwcmd} add pass udp from any to ${oip} 53
${fwcmd} add pass udp from ${oip} 53 to any
${fwcmd} add pass tcp from any to ${oip} 80 setup
${fwcmd} add deny log tcp from any to any in via ${oif} setup
${fwcmd} add pass tcp from any to any setup
${fwcmd} add pass udp from ${oip} to any 53 keep-state
${fwcmd} add pass udp from ${oip} to any 123 keep-state
;;
[Cc][Ll][Oo][Ss][Ee][Dd])
setup_loopback
;;
[Uu][Nn][Kk][Nn][Oo][Ww][Nn])
;;
*)
if [ -r "${firewall_type}" ]; then
${fwcmd} ${firewall_flags} ${firewall_type}
fi
;;
esac
все коменты обрезал как мог.
