OpenForum RSS: �� PF

�� PF (gat)

Thu, 15 Oct 2009 17:28:46 GMT

�� ,�� -- block log on $wan_if from ! $msk

###########################################################################

set block-policy drop
set state-policy floating
#set loginterface $wan_if
set limit { frags 100000, states 100000 }
set optimization normal
set skip on { lo0 $lan_if}
################################################################################
#
scrub in log all
#
nat on $wan_if from $lan to any -> ($wan_if)
no nat from $lan to $msk

###############################################################################################

antispoof quick for $wan_if

#block log all
block log on $wan_if from ! $msk

#################################################################

pass out log on $wan_if proto tcp to any port $tcp_ports keep state
pass out log on $wan_if proto udp to any port $udp_ports keep state

pass log from {$ip_ak $msk} to any
pass log t

�� PF (gat)

Thu, 15 Oct 2009 15:34:52 GMT

>��
> $wan_if
>�� ??????

wan_if="rl0"
lan_if="rl1"

�� PF (Alexpn)

Thu, 15 Oct 2009 14:04:56 GMT

��
$wan_if
�� ??????

�� PF (gat)

Thu, 15 Oct 2009 13:22:09 GMT

pass from {$ip_ak $msk} to any
pass to {$ip_ak $msk}

�� .

� �� in wan, ��

tcpdump: WARNING: pflog0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 96 bytes
000000 rule 1/0(match): block in on rl0: 192.168.0.6.3389 > 192.168.2.200.55985: tcp 32 [bad hdr length 0 - too short, < 20]
2. 108460 rule 1/0(match): block in on rl0: 93.157.177.16.60519 > 255.255.255.255.1947: UDP, length 40
1. 022291 rule 1/0(match): block in on rl0: 192.168.0.6.3389 > 192.168.2.200.55985: tcp 32 [bad hdr length 0 - too short, < 20]
6. 562174 rule 1/0(match): block in on rl0: 192.168.0.6.3389 > 192.168.2.200.55985: tcp 32 [bad hdr length 0 - too short, < 20]

�� 192,168,2,200 �� 192,168,0,6

, � ��

�� PF (agu2)

Thu, 15 Oct 2009 12:00:55 GMT

�� PF � �� (� �� ):

ip_tun1="IP1"
Ip_tun2="IP2"

pass out quick on $ext proto udp from $ip_tun1 port = isakmp to $ip_tun2 port = isakmp
pass out quick on $ext proto esp from $ip_tun1 to $ip_tun2
pass out quick on $ext proto ipencap from $ip_tun1 to $ip_tun2

pass in quick on $ext proto udp from $ip_tun2 port = isakmp to $ip_tun1 port = isakmp
pass in quick on $ext proto esp from $ip_tun2 to $ip_tun1
pass in quick on $ext proto ipencap from $ip_tun2 to $ip_tun1

OpenForum RSS: ��������� PF

��������� PF (gat)

��������� PF (gat)

��������� PF (Alexpn)

��������� PF (gat)

��������� PF (agu2)

OpenForum RSS: �� PF

�� PF (gat)

�� PF (gat)

�� PF (Alexpn)

�� PF (gat)

�� PF (agu2)