- 论坛徽章:
- 0
|
系统freebsd5.3&pf,已经正常运行,规则如下:
#define ext_if_cnc ext_if_ct int_if and so on
ext_if_cnc="xl0"
cnc_ip="***"
ext_if_ct="fxp0"
ct_ip="***"
int_if="vr0"
int_ip="192.168.0.1"
int_net="192.168.0.1/24"
webserver=""
#table
#options
set timeout interval 10
set timeout frag 30
set limit { frags 5000, states 2500 }
set optimization high-latency
set block-policy return
set loginterface $int_if
#set fingerprints /etc/pf.os
set state-policy if-bound
#scrub
scrub in all
#NAT(net,rdr)
nat on $ext_if_cnc from $int_if:network to any ->; ($ext_if_cnc)
nat on $ext_if_ct from $int_if:network to any ->; ($ext_if_ct)
rdr on $int_if proto tcp from $int_if:network to any port 21 ->; 127.0.0.1 port 8021
#rules contral
pass in quick on lo0 all
pass out quick on lo0 all
pass in quick on $int_if proto {udp,icmp} from any to any keep state
pass in quick on $int_if proto 4 from any to any keep state
pass in quick on $int_if proto tcp from any to any flags S/SA keep state
block drop in quick on $int_if from any to 10.0.0.0/8
block drop in quick on $int_if from any to 172.0.0.0/16
block drop in quick on $int_if from any to 192.168.0.0/16
block drop in quick on $int_if proto tcp from any to any port = 135
block drop in quick on $int_if proto tcp from any to any port = 137
block drop in quick on $int_if proto tcp from any to any port = 138
block drop in quick on $int_if proto tcp from any to any port = 139
pass in quick on $int_if all keep state
pass out quick on $int_if all keep state
pass out quick on $ext_if_cnc all keep state
pass out quick on $ext_if_ct all keep state
block drop in quick on { $ext_if_cnc, $ext_if_ct } all
我的inetd.conf的ftp-proxy也已经打开了..
现在的问题是内网ftp不能正常使用,并且有些游戏不能玩(比如：大话西游)
还有就是rstp,mms等不能使用,
我不知道自己的错误在那里,查资料好多都是打开了tcp,udp,icmp就可以了,可是我的应该是已经打开了,其他的问题呢??
谢谢指教.. |
|
免费注册
发表于 2005-04-12 22:22
