Столкнулся с проблемой, что надо перейти от pf к ipfw. Проблема в том, что с ipfw я мало работал и толкового мануала в хендбуке не нашел. (Точнее нашел, но он не переведен).
Помогите перевести правила pf в ipfw:
- Код: Выделить всё
$ cat pf.conf
table <rfcnets> {10.0.0.0/8, !192.168.1.0/24, 192.168.0.0/16, !172.16.0.0/24, 172.16.0.0/12 }
table <vpn> persist
#table <vpn> {172.16.0.0/24}
table <me> { self, 172.16.0.1}
# Options: tune the behavior of pf, default values are given.
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 5 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 50000, frags 5000 }
set loginterface none
#set optimization normal
set block-policy drop
set require-order yes
set fingerprints "/etc/pf.os"
#set state-policy if-bound
# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all
nat on em0 from 172.16.0.0/16 to any -> em0
pass quick on lo from any to any
block in quick on em0 from <rfcnets> to any
# icmp
pass in quick inet proto icmp from any to <me> icmp-type echoreq keep state
# ssh
pass in quick proto tcp from any to <me> port ssh flags S/SA keep state
# http,https
pass in quick proto tcp from any to 10.10.0.2 port {443, 80} flags S/SA keep state
# dns
pass in quick proto {tcp, udp} from any to <me> port domain flags S/SA keep state
# pptp
pass in quick proto tcp from any to <me> port 1723 flags S/SA keep state
# GRE наружу
pass in quick proto gre from any to <me> keep state
pass in quick proto tcp from any to <me> port 11758 flags S/SA keep state
# MPD
pass in quick proto tcp from any to <me> port 5006 flags S/SA keep state
#SNMP
pass in quick proto udp from 10.10.10.99 to <me> port 161 keep state
block in quick from any to <me>
block quick from 172.16.0.0/16 to 172.16.0.0/16
pass in quick inet from <vpn> to any
pass in quick inet from any to <vpn>
block in quick all
block out quick on em0 from <rfcnets> to any
pass out quick from <me> to any keep state
pass out quick from <rfcnets> to <rfcnets>
pass out quick from any to <vpn>
pass out quick from <vpn> to any
block out quick all
Если не трудно - отпишите на явные баги.
Заранее благодарен.
ЗЫ em0 - внешний ифейс, em1 - внутренний.
