用freebsd的ipfilter做防火墙的问题？

yyweng

freebsd下的ipfilter只要没有一个网段长时间没有流量。当再次上外网时，就不能.上网，只要同一个网段内的一台计算机ping一下电信的网关，就可以上网了。我是用固定IP上网。下面是ipf.rules的配置：
pass in all
pass out all
block in quick from 10.43.168.215/32 to any keep state
block in quick from 10.43.168.137/32 to any keep state
block in quick from 10.43.168.136/32 to any keep state
block in quick from 10.43.168.232/32 to any keep state
block in quick from 10.43.168.236/32 to any keep state
block in quick from 10.43.168.243/32 to any keep state
block in quick from 10.43.168.225/32 to any keep state
block in quick from 10.43.168.235/32 to any keep state
block in quick from 10.43.168.223/32 to any keep state
block in quick from 10.43.168.139/32 to any keep state
block in quick from 10.43.168.110/32 to any keep state
block in log quick all with short
block in log quick all with ipopts
block in log quick all with frag
block in log quick all with opt lsrr
pass out on vr0 all
pass in on vr0 all
pass out on rl0 all
pass in on rl0 all
block out on bfe0 all
pass out log on bfe0 proto tcp/udp all keep state
pass out log on bfe0 proto icmp all keep state
pass in quick on bfe0 proto tcp from any to any port=53 keep state
pass in quick on bfe0 proto tcp from any to any port=ftp flags S/SA keep state
pass in quick on bfe0 proto tcp from any to any port=ftp-data flags S/SA keep state
pass in quick on bfe0 proto tcp from any to any port 30000 >< 50001 flags S/SA keep state

[ 本帖最后由 yyweng 于 2008-5-8 15:12 编辑 ]

yyweng

当发生这个问题时，我可以ping通本网段的网关，和其他网段。用putty可以登陆到防火墙上，并且防火墙可以访问外网。但客户端必须ping电信的网关地地址，感觉想是要激活连接本网段网关的网卡似的。

feillex

网络结构是怎样的？

yyweng

网络结构，此防火墙有3块网卡(bfe0,vr0,rl0),bfe0连接到公网，vr0连接10.43.168.0/24网段，rl0下面连接10.143.162.0/24的网段。

yyweng

谁来帮我解决一下这个问题啊。求你们了。。。。。

yyweng

求求你们了

feillex

1. 
   
2. block out on bfe0 all
   
3. pass out log on bfe0 proto tcp/udp all keep state
   
4. pass out log on bfe0 proto icmp all keep state
   

复制代码

有了第一条，后边两条没用啊。
去掉第一条试试

yyweng

我去掉了block out on bfe0 all还是不行，但我发现一个问题，我们客户端上不了后，我到防火墙上去后ping域名时，也不行，只有ping下电信的网关就可以了。就是感觉没有流量出去后，就感觉出去的端口变为待机状态，要PING一下电信的网关才能将它激活。请高手指点一下。谢谢。求你们了。。。。。。

yyweng

有人吗，帮个忙吧。求你们了。。。。。。。。

feillex

监控防火墙日志。看看客户端无法上网时，是那条规则起作用。