Есть такие правила в IPFW00010 divert 8668 log ip from any to any via bge1
00011 divert 8669 log ip from any to any via bge1
00102 allow log ip from any to any dst-port 5190
00110 allow ip from any to any dst-port 8000 via bge0
00120 allow ip from any to any dst-port 8000 via bge1
00130 allow log ip from any to any dst-port 53
00140 allow ip from any to any dst-port 80,443,50100-55050
00150 allow log ip from any to any dst-port 21
00154 allow log ip from any to any dst-port 50100-55050
00155 allow log ip from any to any dst-port 22
00159 allow log ip from any to any dst-port 43
00170 allow log ip from any to any dst-port 10000-65535
00200 allow ip from any to any via lo0
00500 allow log ip from any to any established
00600 allow log icmp from any to any
65535 deny ip from any to any
[root@sys /etc/rc.d]# ifconfig
bge0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 00:0d:60:9a:67:ea
inet 192.168.70.230 netmask 0xffffff00 broadcast 192.168.70.255
media: Ethernet autoselect (1000baseTX <full-duplex>)
status: active
bge1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 00:0d:60:9a:67:eb
inet 109.237.81.98 netmask 0xffffffe0 broadcast 109.237.81.127
inet 109.237.81.99 netmask 0xffffffe0 broadcast 109.237.81.127
media: Ethernet autoselect (1000baseTX <full-duplex>)
status: active
[root@sys /etc/rc.d]# less /etc/natd.conf
instance default
alias_address 109.237.81.98
same_ports yes
port 8668
use_sockets yes
unregistered_only yes
instance natd_99
alias_address 109.237.81.99
same_ports yes
port 8669
use_sockets yes
unregistered_only yes
redirect_port tcp 192.168.70.120:1-65000 1-65000
Добиваюсь отправку ( порт маппинг ) запросов из мира на АйПи 109.237.81.99 внутрь локальной сети на хост 192.168.70.120 и обратно.
bge0 - внутренний
bge1 - внешний. На нем 2 АйПи 109.237.81.98 и 109.237.81.99
Маппинг пытаюсь делать на 109.237.81.99
Вот что в тисипидампе
[root@sys /etc/rc.d]# tcpdump -i bge0 | grep 'ftp'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bge0, link-type EN10MB (Ethernet), capture size 96 bytes
14:06:51.516738 IP c.194.162.static.cyfra.net.47979 > 192.168.70.120.ftp: S 3743502240:3743502240(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
14:06:51.517064 IP 192.168.70.120.ftp > c.194.162.static.cyfra.net.47979: S 3627683011:3627683011(0) ack 3743502241 win 8192 <mss 1460,nop,nop,sackOK>
14:06:54.511972 IP 192.168.70.120.ftp > c.194.162.static.cyfra.net.47979: S 3627683011:3627683011(0) ack 3743502241 win 8192 <mss 1460,nop,nop,sackOK>
14:06:54.521401 IP c.194.162.static.cyfra.net.47979 > 192.168.70.120.ftp: S 3743502240:3743502240(0) win 8192 <mss 1460,nop,wscale 2,nop,nop,sackOK>
14:07:00.518286 IP 192.168.70.120.ftp > c.194.162.static.cyfra.net.47979: S 3627683011:3627683011(0) ack 3743502241 win 8192 <mss 1460,nop,nop,sackOK>
14:07:00.521486 IP c.194.162.static.cyfra.net.47979 > 192.168.70.120.ftp: S 3743502240:3743502240(0) win 8192 <mss 1460,nop,nop,sackOK>
14:07:12.513675 IP 192.168.70.120.ftp > c.194.162.static.cyfra.net.47979: R 3627683012:3627683012(0) win 0
это я делал в браузере ftp://109.237.81.99
192.168.70.120 АйПИ машины в локальной сети
Вот тут я и немогу понять почему не происходит соединение.
Вариант для распечатки
