- 论坛徽章:
- 0
|
OPBENBSD+PF做NAT
PF.CONF
:
ext_if="em1"
int_if="em0"
table <spamd> persist
table <spamd-white> persist
set skip on lo
scrub in
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on em1 from any to any -> (em1)
#rdr on em0 inet proto tcp from 61.234.228.139 to any port 80 -> 127.0.0.1 port 3128
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $ext_if proto tcp from <spamd> to port smtp \
-> 127.0.0.1 port spamd
rdr pass on $ext_if proto tcp from !<spamd-white> to port smtp \
-> 127.0.0.1 port spamd
rdr pass on $ext_if proto tcp from any to port 21 \
-> 127.0.0.1 port 8021
anchor "ftp-proxy/*"
#block in
pass out keep state
pass quick on $int_if
antispoof quick for { lo $int_if }
pass in on $ext_if proto tcp to ($ext_if) port ssh keep state
pass in log on $ext_if proto tcp to ($ext_if) port smtp keep state
pass out log on $ext_if proto tcp from ($ext_if) to port smtp keep state
IFCONFIG
:
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33224
groups: lo
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:04:23:b4:42:16
media: Ethernet autoselect (100baseTX full-duplex)
status: active
inet 192.168.88.2 netmask 0xffffff00 broadcast 192.168.88.255
inet6 fe80::204:23ff:feb4:4216%em0 prefixlen 64 scopeid 0x1
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:0e:0c:a1:bd:7a
groups: egress
media: Ethernet autoselect (100baseTX full-duplex)
status: active
inet 222.240.132.149 netmask 0xffffff00 broadcast 222.240.132.255
inet6 fe80::20e:cff:fea1:bd7a%em1 prefixlen 64 scopeid 0x2
inet 222.240.132.150 netmask 0xffffff00 broadcast 222.240.132.255
inet 222.240.132.151 netmask 0xffffff00 broadcast 222.240.132.255
inet 222.240.132.152 netmask 0xffffff00 broadcast 222.240.132.255
inet 222.240.132.153 netmask 0xffffff00 broadcast 222.240.132.255
inet 222.240.132.154 netmask 0xffffff00 broadcast 222.240.132.255
inet 222.240.132.155 netmask 0xffffff00 broadcast 222.240.132.255
inet 222.240.132.156 netmask 0xffffff00 broadcast 222.240.132.255
inet 222.240.132.157 netmask 0xffffff00 broadcast 222.240.132.255
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33224
pfsync0: flags=0<> mtu 1460
groups: carp
enc0: flags=0<> mtu 1536
ROUTE
:
Destination Gateway Flags Refs Use Mtu Interface
default 222.240.132.145 UGS 1 36462524 - em1
61.234/15 192.168.88.1 UGS 0 1456600 - em0
loopback localhost UGRS 0 0 33224 lo0
localhost localhost UH 9 72 33224 lo0
192.168.88/24 link#1 UC 3 0 - em0
192.168.88.1 00:09:11:da:08:ab UHLc 2 0 - em0
192.168.88.2 00:04:23:b4:42:16 UHLc 0 1570 - lo0
192.168.88.6 00:09:11:da:08:ab UHLc 0 12669 - em0
222.51/16 192.168.88.1 UGS 1 47460853 - em0
222.240.132/24 link#2 UC 2 0 - em1
222.240.132.145 00:12:80:b7:b6:00 UHLc 1 30 - em1
nat 00:0e:0c:a1:bd:7a UHLc 0 38 - lo0
222.240.132.150 localhost UGHS 0 92 33224 lo0
222.240.132.151 localhost UGHS 0 24 33224 lo0
222.240.132.152 localhost UGHS 0 6 33224 lo0
222.240.132.153 localhost UGHS 0 30 33224 lo0
222.240.132.154 localhost UGHS 0 32 33224 lo0
222.240.132.155 localhost UGHS 0 104 33224 lo0
222.240.132.156 localhost UGHS 0 32 33224 lo0
222.240.132.157 localhost UGHS 0 25 33224 lo0
BASE-ADDRESS.MCAST localhost URS 0 0 33224 lo0
但是我在客户端下的PING DNS出现下面情况
>> Main# ping 202.103.96.112 32
[host 202.103.96.112, max tries 32, delay 1000 msec]
#0 got ICMP Destination Unreachable from 192.168.88.2.
202.103.96.112: #1 timed out.
#0 got ICMP Destination Unreachable from 192.168.88.2.
202.103.96.112: #2 timed out.
#0 got ICMP Destination Unreachable from 192.168.88.2.
202.103.96.112: #3 timed out.
202.103.96.112: #4 timed out.
202.103.96.112: #5 timed out.
#0 got ICMP Destination Unreachable from 192.168.88.2.
202.103.96.112: #6 timed out.
#0 got ICMP Destination Unreachable from 192.168.88.2.
202.103.96.112: #7 timed out.
202.103.96.112: #8 ok, RTT 4 msec.
202.103.96.112: #9 ok, RTT 5 msec.
202.103.96.112: #10 ok, RTT 3 msec.
202.103.96.112: #11 ok, RTT 4 msec.
202.103.96.112: #12 ok, RTT 4 msec.
202.103.96.112: #13 ok, RTT 3 msec.
202.103.96.112: #14 ok, RTT 4 msec.
请求各位大大紧急帮助 |
|
免费注册
发表于 2006-08-22 23:36
