Система FreeBSD 5.21
Почему не могу залесть на https.
На ssh, http, pop и т.д. без проблем.
Вот файл rc.firewall
#!/bin/sh
ipfw='/sbin/ipfw -q'
ournet='192.168.0.1/24'
uprefix='192.168.0'
ifout='ed1'
ifuser='ed0'
${ipfw} flush
${ipfw} add 100 check-state
${ipfw} add 200 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${ipfw} add 210 reject ip from ${ournet} to any in via ${ifout}
${ipfw} add 215 deny all from not ${ournet} any to me 23
${ipfw} add 220 deny all from not ${ournet} any to me 22
${ipfw} add 230 deny all from not ${ournet} any to me 3128, 8080
${ipfw} add 240 deny all from not ${ournet} any to me ftp, ftps
${ipfw} add 250 deny all from not ${ournet} any to me http, https
${ipfw} add 300 allow ip from any to any via lo
${ipfw} add 310 allow tcp from me to any keep-state via ${ifout}
${ipfw} add 320 allow icmp from any to any
${ipfw} add 330 allow udp from me to any domain keep-state
${ipfw} add 340 allow udp from any to me domain
${ipfw} add 350 allow ip from me to any
${ipfw} add 400 divert natd all from ${ournet} to any out via ${ifout}
${ipfw} add 500 fwd 127.0.0.1,3128 tcp from ${ournet} to any http in via ${ifuse
${ipfw} add 2500 allow tcp from any to any pop3, smtp
${ipfw} add 2510 allow tcp from any pop3, smtp to any
${ipfw} add 2600 allow tcp from any to any ftp, aol
${ipfw} add 2610 allow tcp from any ftp, aol to any
${ipfw} add 2700 allow tcp from any to any ssh
${ipfw} add 2710 allow tcp from any ssh to any
${ipfw} add 2800 allow tcp from any to any 15118, 15111
${ipfw} add 2810 allow tcp from any 15118, 15111 to any
${ipfw} add 2900 allow tcp from ${ournet} to any 4899
${ipfw} add 2910 allow tcp from ${ournet} 4899 to any
${ipfw} add 3002 allow ip from ${uprefix}.100 to any
${ipfw} add 3002 allow ip from any to ${uprefix}.100
${ipfw} add 65535 deny ip from any to any
Я добавлял правило на allow хттпс до диверта и после него. Но результата никакого.
Тогда добавил правло 65000 можно всё для всех. Эффекта ноль.
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
(ok) on 12-Апр-06, 21:18 
