>set block-policy какие параметры?
>может большую часть конфига покажете ? Вот такой у меня конфиг:
set optimization normal
set block-policy drop
set limit { states 20000, frags 20000, src-nodes 20000 }
set state-policy floating
table <ipblock> persist { } # localnet users out of traffic limit
scrub in on $int_if all no-df fragment reassemble
scrub in on $ext_if all
scrub on $ext_if random-id reassemble tcp
#------------------
# NAT
nat-anchor "pftpx/*"
nat on $ext_if from $int_if:network to any -> ($ext_if)
rdr-anchor "pftpx/*"
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
# squid
rdr on $int_if proto tcp from any to any port 80 -> 127.0.0.1 port 3128
#------------------
# Filter
block all
pass quick on lo0 all
# Antispoffing interfaces
antispoof log for $int_if
antispoof log for $ext_if
block in quick log on $int_if from <ipblock> to any
pass on $int_if from any to any keep state
pass in log on $ext_if inet proto icmp from any to $ext_addr icmp-type echoreq keep state (max 10)
#_Allow_SSH_connections_to_ME
pass in log on $ext_if inet proto tcp from any to $ext_if port 22 modulate state (max 20) flags S/SA
# _FTP
anchor "pftpx/*"
pass out log inet proto tcp from $ext_addr to any port 21 flags S/SA modulate state
# _HTTP
pass out log on $ext_if inet proto tcp from $ext_if to any port 80 flags S/SA modulate state
pass out log on $ext_if inet proto tcp from $ext_if to any port 443 flags S/SA modulate state
# _CVSUP
pass out on $ext_if inet proto tcp from $ext_if to any port 5999 flags S/SA modulate state
# _DNS
pass out log on $ext_if inet proto { tcp, udp } from $ext_if to any port 53 flags S/SA keep state
# _SSH
pass out log on $ext_if inet proto tcp from $ext_if to any port 22 flags S/SA modulate state
Вариант для распечатки
Информационная безопасность (Public)
(ok) on 29-Апр-08, 17:28 
