есть такой файер
покритикуйте
планируется также поднимать pptp, что нужно добавить в этот конфиг в связи
с этим

#!/bin/sh
fwcmd="/sbin/ipfw"
${fwcmd} -f flush
${fwcmd} -f pipe flush
##############################
oif="rl0"
onet="192.168.214.0"
omask="255.255.255.0"
oip="192.168.214.15"

iif="vr0"
inet="192.168.1.0"
imask="255.255.255.0"
iip="192.168.1.1"

remote_ip="192.168.214.11"
${fwcmd} add 100 pass all from any to any via lo0
${fwcmd} add 200 deny all from any to 127.0.0.0/8
${fwcmd} add 300 deny ip from 127.0.0.0/8 to any

${fwcmd} add deny log icmp from any to ${oip} in via ${oif} frag
#${fwcmd} add pass all from any to any
# ssh for remote_admin
${fwcmd} add pass tcp from ${remote_ip} to ${oip} 22 in via ${oif}
${fwcmd} add pass tcp from ${oip} 22 to ${remote_ip} out via ${oif}

${fwcmd} add allow tcp from any to any established
${fwcmd} add allow ip from ${oip} to any out xmit ${oif}
${fwcmd} add deny log all from ${inet}:${imask} to any in via ${oif}
${fwcmd} add deny log all from ${onet}:${omask} to any in via ${iif}

${fwcmd} add deny log all from any to 10.0.0.0/8 via ${oif}
${fwcmd} add deny log all from 10.0.0.0/8 to any via ${oif}
${fwcmd} add deny log all from any to 172.16.0.0/12 via ${oif}
${fwcmd} add deny log all from 172.16.0.0/12 to any via ${oif}

${fwcmd} add deny log all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny log all from 0.0.0.0/8 to any via ${oif}
${fwcmd} add deny log all from any to 169.254.0.0/16 via ${oif}
${fwcmd} add deny log all from 169.254.0.0/16 to any via ${oif}
${fwcmd} add deny log all from any to 224.0.0.0/4 via ${oif}
${fwcmd} add deny log all from 224.0.0.0/4 to any via ${oif}
${fwcmd} add deny log all from any to 240.0.0.0/4 via ${oif}
${fwcmd} add deny log all from 240.0.0.0/4 to any via ${oif}

${fwcmd} add deny log all from any to 192.168.1.0/24 via ${oif}
${fwcmd} add deny log all from 192.168.1.0/24 to any via ${oif}
#${fwcmd} add deny log all from any to 192.168.0.0/16 in via ${oif}
#${fwcmd} add deny log all from 192.168.0.0/16 to any in via ${oif}

${fwcmd} add divert natd ip from any to any via ${oif}

#www only MyIp, others -> squid
#${fwcmd} add pass tcp from ${MyIp} to any 20,21,22,80,443
#${fwcmd} add pass tcp from any 20,21,22,80,443 to ${MyIp}

#deny ftp,term,squid outif
${fwcmd} add deny tcp from any to any 20,21,22,23,3128 in via ${oif}
#deny www,ftp,term iif
${fwcmd} add deny tcp from any to any 20,21,22,23,80,443 in via ${iif}
${fwcmd} add deny tcp from any to any 8000-8104 in via ${iif}

#pass mail,dns
${fwcmd} add pass tcp from any to any 25,110 via ${oif}
${fwcmd} add pass tcp from any 25,110 to any via ${oif}
${fwcmd} add pass udp from any to any 53 via ${oif}
${fwcmd} add pass udp from any 53 to any via ${oif}

# deny icmp frag
#${fwcwd} add deny log icmp from any to any in via ${oif} frag

${fwcmd} add allow ip from any to any frag

${fwcmd} add allow tcp from any to ${oip} 25 setup
#${fwcmd} add allow tcp from any to ${oip} 53 setup
${fwcmd} add allow tcp from any to ${iip} 110 via ${iif} setup
${fwcmd} add allow tcp from any to ${oip} 49152-65525 setup

${fwcmd} add allow tcp from ${oip} to any 21,22,25,53,80,110,123,443,49152-65535 setup
${fwcmd} add allow udp from ${oip} to any 53

${fwcmd} add deny log tcp from any to any in recv ${oif} setup
${fwcmd} add deny log udp from any to any in recv ${oif}
${fwcmd} add allow icmp from any to ${oip} in via ${oif} icmptype 0,3,4,8,11,12
${fwcmd} add allow icmp from ${oip} to any out via ${oif} icmptype 0,3,8,12
${fwcmd} add allow icmp from ${oip} to any out via ${oif} frag
${fwcmd} add deny log icmp from any to any in via ${oif}

• Покритикуйте фаерволл, evgen, 18:55 , 26-Май-05, (1)