>А как быть с ftp
#!/bin/sh
ournet="192.168.0.0/24"
ourprefix="192.168.0"
ipout="*.*.*.*"
ipuser="192.168.0.*"
ifout="xl0"
ifuser="xl1"
# CLEAR RULES
ipfw -q flush
ipfw -f pipe flush
ipfw -f queue flush
# BEGIN FIREWALLING
ipfw add 10 check-state
# DENY PART I
ipfw add 11 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
ipfw add 12 reject ip from ${ournet} to any in via ${ifout}
ipfw add 14 deny all from any to 255.255.255.255
ipfw add 16 deny udp from any to any 137,138
# THIS MUST BE
ipfw add 30 allow all from any to any via lo
ipfw add 31 allow ip from me to any keep-state
#----------------- FOREIGN IN --------------------------------
# OUTSIDE FTP, FTPDATA
ipfw add 43 allow tcp from any to me 20,21,49153 in via ${ifout}
#----------------- LOCAL SECTION ----------------------------
# LOCAL DNS, NTP
ipfw add 50 allow udp from ${ournet} to me 53,123 in via ${ifuser}
# LOCAL FTP, SSH, HTTP, FTPDATA
ipfw add 55 allow tcp from ${ournet} to me 20,21,22,8000,49153 in via ${ifuser}
#----------------- FORWARD SECTION -------------------------
# SQUID
ipfw add 59 fwd 127.0.0.1,3129 tcp from ${ournet} to any 80 out via ${ifout}
# NATD
ipfw add 60 divert natd all from any to any via ${ifout}
#------------------ USER SECTION ----------------------------
# LOCAL ICMP
ipfw add 70 allow icmp from ${ournet} to any in via ${ifuser}
ipfw add 71 allow icmp from any to ${ournet}
# LOCAL ICQ
ipfw add 80 allow tcp from ${ournet} to any 5190 in via ${ifuser}
ipfw add 81 allow tcp from any 5190 to ${ournet}
#--------------------------------------------------------------
# USER DUMMYNET OUT
ipfw pipe 1 config bw 128Kbit/s
ipfw queue 1 config pipe 1 weight 50 queue 20 mask src-ip 0xffffffff
# USER DUMMYNET IN
ipfw pipe 2 config bw 128Kbit/s
ipfw queue 2 config pipe 2 weight 50 queue 40 mask dst-ip 0xffffffff
# DUMMYNET USER
ipfw add 59901 queue 1 ip from ${ournet} to any in via ${ifuser}
ipfw add 59902 queue 2 ip from any to ${ournet}
#--------------------------------------------------------------
# OUTSIDE ICMP
ipfw add 59998 allow icmp from any to me in via ${ifout}
# GLOBAL OUT
ipfw add 59999 allow ip from ${ipout} to any out via ${ifout}
# DENY ANYTHING ELSE WITH LOGGING
ipfw add 60000 deny ip from any to anyправило за номером 43 и vsftpd. proftpd тоже сойдет: нужен ftp сервер с отстраиваемыми номерами портов.
|
