/etc/rc.confgateway_enable="YES"
linux_enable="YES"
mousechar_start="3"
sendmail_enable="NONE"
icmp_drop_redirect="YES"
squid_enable="YES"
tcp_extension="NO"
mpd_enable="YES"
sshd_enable="YES"
firewall_enable="YES"
firewall_script="/etc/rc.fw"
ipsec_enable="YES"
ipsec_file="/etc/ipsec.conf"
racoon_enable="YES"
rinetd_enable="YES"
hostname="freebsd"
ifconfig_vr0="inet 192.168.0.254 netmask 255.255.255.0"
ifconfig_rl0="inet 1.1.1.1 netmask 255.255.255.252" # outside net
defaultrouter="192.168.0.254"
ppp_enable="YES"
ppp_mode="ddial"
ppp_nat="YES"
ppp_profile="ukrtelecom"
gif_interfaces="gif1"
#filial
gifconfig_gif1="1.1.1.1 2.2.2.2"
ifconfig_gif1="inet 192.168.0.254 192.168.1.254 netmask 255.255.255.0 mtu 1500"
static_routes="filial"
route_filial="-net 192.168.1.0/24 192.168.1.254"
/etc/rc.fw
ipfw -f flush
ipfw add allow all from any to any via lo0
ipfw add allow all from any to any via vr0
ipfw add deny all from any to 127.0.0.0/8
ipfw add deny all from 127.0.0.0/8 to any
## mpd
ipfw add allow all from any to any 1723
ipfw add allow all from any 1723 to any
ipfw add allow gre from any to any
host="1.1.1.1"
filial="2.2.2.2"
## ssh
ipfw add allow all from any to ${host} 22,1978,3389,80
ipfw add allow all from ${host} 22,1978,3389,80 to any
ipfw add allow all from ${host} to ${filial}
ipfw add allow all from ${filial} to ${host}
ipfw add allow esp from any to any
ipfw add allow log udp from any 500 to any
ipfw add allow log all from any to any via gif1
ipfw add allow log all from any to any via ng0
ipfw add allow log all from any to any via ng1
ipfw add allow log all from any to any via ng2
ipfw add allow log all from any to any via ng3
ipfw add allow log all from any to any via ng4
ipfw add allow log all from any to any via ng5
ipfw add allow log all from any to any via ng6
ipfw add allow log all from any to any via ng7
ipfw add allow log all from any to any via ng8
ipfw add allow log all from any to any via ng9
ipfw add allow log all from any to any via ng10
# router
ipfw add allow all from ${host} to any 80,8080,8085,443,53,5190,20,21,500,3389,25,110,2082,2095,995,22,5900,123
ipfw add allow all from any 80,8080,8085,443,53,5190,20,21,500,3389,25,110,2082,2095,995,22,5900,123 to ${host}
ipfw add allow icmp from any to any
ipfw add deny log all from any to any
/etc/ipsec.conf
flush;
spdflush;
#Filial
spdadd 1.1.1.1/32 2.2.2.2/32 ipencap -P out ipsec esp/tunnel/1.1.1.1-2.2.2.2/require;
spdadd 2.2.2.2/32 1.1.1.1/32 ipencap -P in ipsec esp/tunnel/2.2.2.2-1.1.1.1/require;
Вариант для распечатки
