Linux за българи: Форуми

# ifconfig -a
bge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
        ether 00:30:05:97:86:23
        inet 192.168.0.1 netmask 0xffffff00 broadcast 192.168.0.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
fxp0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=2009<RXCSUM,VLAN_MTU,WOL_MAGIC>
        ether 00:d0:b7:29:2d:aa
        media: Ethernet autoselect (none)
        status: no carrier
fxp1: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=2009<RXCSUM,VLAN_MTU,WOL_MAGIC>
        ether 00:90:27:7d:09:da
        media: Ethernet autoselect (none)
        status: no carrier
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=3<RXCSUM,TXCSUM>
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
        inet6 ::1 prefixlen 128
        inet 127.0.0.1 netmask 0xff000000
        nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
enc0: flags=0<> metric 0 mtu 1536
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33200

hostname="gw.xxxxxx.com"
amavisd_enable="YES"
apache22_enable="YES"
clamav_clamd_enable="YES"
freshclam_flags="--daemon --checks=6"
clamav_freshclam_enable="YES"
dovecot_enable="YES"
firewall_enable="YES"
firewall_type="open"

#ppp_enable="YES"
#ppp_mode="ddial"
#ppp_nat="NO"
#ppp_profile="spnet"
defaultrouter="192.168.0.200"
ifconfig_bge0="inet 192.168.0.1 netmask 255.255.255.0"
#ifconfig_fxp0="inet 192.168.0.201 netmask 255.255.255.0"
#ifconfig_fxp1="up"

gateway_enable="YES"
mailgraph_enable="YES"
mailgraph_user="root"
mysql_dbdir="/usr/db/mysql/mysql"
mysql_enable="YES"
named_enable="YES"
pf_enable="YES"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
postfix_enable="YES"
slapd_enable="YES"
sshd_enable="YES"
saver="green"
scrnmap="NO"
mousechar_start="3"
hald_enable="YES"
dbus_enable="YES"
blanktime="500"
ntpdate_enable="YES"
pureftpd_enable="YES"
samba_enable="YES"

ext_if="tun0"
int_if="bge0"
internal_net="192.168.0.0/16"
Services = "{ 21, 22, 25, 50, 53, 80, 443, 465, 500, 993, 4500 }"
# hosts from private net
host1 = "192.168.0.200" ## test

# hosts with Internet access
ALLOWED = "{" $host1 "}" ## test

set skip on { lo0 }

set state-policy if-bound
set block-policy drop

# Nat
nat on $ext_if from any -> ($ext_if:0)
nat on $ext_if from $ALLOWED to any -> $ext_if ## test

pass quick on lo0 all
pass quick on $int_if all
pass quick proto icmp keep state allow-opts
pass quick proto ah keep state allow-opts
pass quick proto esp keep state allow-opts
pass quick proto ipencap keep state allow-opts

pass in quick on $int_if inet from $ALLOWED to any keep state ## test
pass out quick on $int_if inet from any to any keep state ## test
#block in on $ext_if

pass out quick on $ext_if from any to any flags any keep state allow-opts

pass in quick on $ext_if from <secure> to ($ext_if) keep state allow-opts
pass in on $ext_if proto { tcp, udp } to ($ext_if) port $Services keep state allow-opts

pass on $int_if all no state allow-opts
pass quick on $int_if all no state allow-opts