Hello Dragos,
Thursday, November 10, 2005, 2:24:01 AM, you wrote:
DM> Salutare lista,
DM> Am urmatoarea situatie ..un mic network de 6 calculatoare un switch si
DM> un server cu freebsd 6.0 pe el, am recompilat kernel si am pus :
DM> device pf
DM> device pflog
DM> device pfsync
DM> options ALTQ
DM> options ALTQ_CBQ
DM> options ALTQ_RED
DM> options ALTQ_RIO
DM> options ALTQ_HFSC
DM> options ALTQ_PRIQ
DM> options ALTQ_NOPCC
DM> adaug si faptul ca rl0 este extern si rl1 intern.
DM> In /etc/rc.conf am urmatoarele linii:
DM> ************
DM> hostname="router"
DM> gateway_enable="YES"
DM> linux_enable="YES"
DM> sshd_enable="YES"
DM> ifconfig_rl0="x.x.x.x netmask 255.255.255.128 broadcast x.x.x.127"
DM> ifconfig_rl1="192.168.10.1 netmask 255.255.255.0"
DM> defaultrouter="x.x.x.1"
DM> pf_enable="YES"
DM> pf_rules="/etc/pf.conf"
DM> pf_flags=""
DM> pflog_logfile="/var/log/pflog"
DM> pflog_files=""
DM> **************
DM> /etc/sysctl.conf arat asa:
DM> *********
DM> net.inet.ip.forwarding=1
DM> ***********
DM> /etc/pf.conf arata asa:
DM> *************
DM> nat on rl0 from rl1:network to any -> (rl0)
DM> *******************
DM> /etc/resolv.conf
DM> ********
DM> nameserver y.y.y.y
DM> ********
DM> Daca incerc sa dau ping in 192.168.10.2 imi zice Permision denied, daca
DM> incerc ping in extern imi zice hostname lookup failrue!
DM> Va rog sa ma ajutati si pe mine si sa imi ziceti unde am gresit....eu
DM> zic ca am facut totul ca la carte.
DM> Multumesc anticipat!
DM> Dragos D.
DM> ________________________________________________________
DM> To unsubscribe send a mail to [EMAIL PROTECTED]
uite cum folosesc eu.... shi merge bine merci
rc.conf
******************
ifconfig_rl0="inet 192.168.1.1"
ifconfig_xl0="inet 192.168.0.2"
gateway_enable="yes"
usbd_enable="YES"
sshd_enable="yes"
apache_enable="yes"
ppp_enable="yes"
ppp_mode="dial"
ppp_profile="rtl"
mysql_enable="yes"
pf_enable="yes"
pf.conf
*************************
ext_if="tun0" # replace with actual external interface name i.e., dc0
int_if="rl0" # replace with actual internal interface name i.e., dc1
eu="192.168.1.50"
tcp_services = "{ 22, 80 }"
icmp_types = "echoreq"
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
#scrub
scrub in all
#nat/rdr
nat on $ext_if from $int_if:network to any -> ($ext_if)
rdr on $ext_if proto {tcp,udp} from any to any port 7270:7280 -> $eu \
port 7270:7280
#rulset
block all
pass quick on lo0 all
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
pass in on $ext_if inet proto tcp from any to ($ext_if) \
port $tcp_services flags S/SA keep state
pass in on $ext_if proto {tcp, udp} from any to $eu \
port 7270:7280 flags S/SA keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in on $int_if from $int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto { udp, icmp } all keep state
________________________________________________________
To unsubscribe send a mail to [EMAIL PROTECTED]
