Система 4.7-RELEASE-p9 FreeBSD.
Ядро откомпилировано с такими опциями:
options         IPFIREWALL              #firewall
options         IPFIREWALL_VERBOSE      #print information about
                                        # dropped packets
options         IPFIREWALL_FORWARD      #enable transparent proxy support
options         IPFIREWALL_VERBOSE_LIMIT=100    #limit verbosity
options         IPFIREWALL_DEFAULT_TO_ACCEPT    #allow everything by default
options         IPV6FIREWALL            #firewall for IPv6
options         IPV6FIREWALL_VERBOSE
options         IPV6FIREWALL_VERBOSE_LIMIT=100
options         IPV6FIREWALL_DEFAULT_TO_ACCEPT
options         IPDIVERT                #divert sockets
options         IPFILTER                #ipfilter support
options         IPFILTER_LOG            #ipfilter logging
Как мне сделать закрытый firewall. Дело в том что если я после всех правил делаю:
$ipfw add 65000 deny all from any to any
У меня все перестает работать. Я так понимаю мне надо включить логи ipfw, что бы видеть что откуда и через какие порты идет, и потом открыть то что нужно. Но я не знаю как это сделать.
Правила у меня вот такие:
01010 allow ip from any to any via lo0
01020 deny ip from any to 127.0.0.0/8
01030 deny ip from 127.0.0.0/8 to any
01040 count ip from any to 10.88.0.2 in recv cx0
01050 count ip from 10.88.0.2 to any
01060 count ip from 10.88.0.2 to 10.88.0.1
01070 count ip from any to any in recv ed0
01080 count ip from any to any out xmit ed0
01090 deny udp from any to any 137-139 in recv cx0
01100 deny tcp from any to any 137-139 in recv cx0
01110 deny ip from any to 212.109.53.32/29 out xmit cx0
01120 count ip from any to any out xmit cx0
01130 count ip from any to any in recv cx0
01140 count ip from any to any in recv cx1
01150 allow tcp from 10.0.0.0/8 to 10.0.0.0/8 80
01160 allow tcp from 10.0.0.0/8 to 212.109.53.32 80
01170 allow tcp from 10.0.0.0/8 to 212.109.43.162 80
01180 allow tcp from 212.109.43.162 to any 80
01190 count tcp from 10.33.0.21 to not 10.0.0.0/8 80
01200 count tcp from 10.55.0.12 to not 10.0.0.0/8 80
01210 count tcp from 10.33.0.24 to not 10.0.0.0/8 80
01220 count tcp from 10.33.0.3 to not 10.0.0.0/8 80
01230 count tcp from 10.44.0.30 to not 10.0.0.0/8 80
01240 count tcp from 10.44.0.4 to not 10.0.0.0/8 80
01250 count tcp from 10.55.0.10 to not 10.0.0.0/8 80
01260 count tcp from 10.33.0.100 to not 10.0.0.0/8 80
01270 count tcp from 10.44.0.5 to not 10.0.0.0/8 80
01280 count tcp from 10.33.0.22 to not 10.0.0.0/8 80
01290 count tcp from 10.33.0.40 to not 10.0.0.0/8 80
01300 fwd 10.33.0.1,3129 tcp from 10.0.0.0/8 to not 10.0.0.0/8 80
01310 divert 8998 ip from 10.0.0.0/8 to any out xmit cx0
01320 divert 9889 tcp from any 22 to 212.109.53.33 in recv cx0
01330 divert 9889 ip from any to 212.109.53.33 in recv cx0
01340 count ip from 10.33.0.21 to any out xmit cx0
01350 count ip from not 10.0.0.0/8 to 10.33.0.21 via rl0
01360 allow ip from 10.33.0.21 to not 10.0.0.0/8
01370 allow ip from 10.33.0.21 to 10.0.0.0/8
01380 allow ip from any to 10.33.0.21 in recv cx0
01390 allow ip from not 10.0.0.0/8 to 10.33.0.21
01400 allow ip from 10.0.0.0/8 to 10.33.0.21
01410 allow ip from any to 10.33.0.21
01420 count ip from 10.55.0.12 to any out xmit cx0
01430 count ip from not 10.0.0.0/8 to 10.55.0.12 via rl0
01440 allow ip from 10.55.0.12 to not 10.0.0.0/8
01450 allow ip from 10.55.0.12 to 10.0.0.0/8
01460 allow ip from any to 10.55.0.12 in recv cx0
01470 allow ip from not 10.0.0.0/8 to 10.55.0.12
01480 allow ip from 10.0.0.0/8 to 10.55.0.12
01490 allow ip from any to 10.55.0.12
01500 count ip from 10.33.0.24 to any out xmit cx0
01510 count ip from not 10.0.0.0/8 to 10.33.0.24 via rl0
01520 allow ip from 10.33.0.24 to not 10.0.0.0/8
01530 allow ip from 10.33.0.24 to 10.0.0.0/8
01540 allow ip from any to 10.33.0.24 in recv cx0
01550 allow ip from not 10.0.0.0/8 to 10.33.0.24
01560 allow ip from 10.0.0.0/8 to 10.33.0.24
01570 allow ip from any to 10.33.0.24
01580 count ip from 10.33.0.3 to any out xmit cx0
01590 count ip from not 10.0.0.0/8 to 10.33.0.3 via rl0
01600 allow ip from 10.33.0.3 to not 10.0.0.0/8
01610 allow ip from 10.33.0.3 to 10.0.0.0/8
01620 allow ip from any to 10.33.0.3 in recv cx0
01630 allow ip from not 10.0.0.0/8 to 10.33.0.3
01640 allow ip from 10.0.0.0/8 to 10.33.0.3
01650 allow ip from any to 10.33.0.3
01660 count ip from 10.44.0.30 to any out xmit cx0
01670 count ip from not 10.0.0.0/8 to 10.44.0.30 via rl0
01680 allow ip from 10.44.0.30 to not 10.0.0.0/8
01690 allow ip from 10.44.0.30 to 10.0.0.0/8
01700 allow ip from any to 10.44.0.30 in recv cx0
01710 allow ip from not 10.0.0.0/8 to 10.44.0.30
01720 allow ip from 10.0.0.0/8 to 10.44.0.30
01730 allow ip from any to 10.44.0.30
01740 count ip from 10.44.0.4 to any out xmit cx0
01750 count ip from not 10.0.0.0/8 to 10.44.0.4 via rl0
01760 allow ip from 10.44.0.4 to not 10.0.0.0/8
01770 allow ip from 10.44.0.4 to 10.0.0.0/8
01780 allow ip from any to 10.44.0.4 in recv cx0
01790 allow ip from not 10.0.0.0/8 to 10.44.0.4
01800 allow ip from 10.0.0.0/8 to 10.44.0.4
01810 allow ip from any to 10.44.0.4
01820 count ip from 10.55.0.10 to any out xmit cx0
01830 count ip from not 10.0.0.0/8 to 10.55.0.10 via rl0
01840 allow ip from 10.55.0.10 to not 10.0.0.0/8
01850 allow ip from 10.55.0.10 to 10.0.0.0/8
01860 allow ip from any to 10.55.0.10 in recv cx0
01870 allow ip from not 10.0.0.0/8 to 10.55.0.10
01880 allow ip from 10.0.0.0/8 to 10.55.0.10
01890 allow ip from any to 10.55.0.10
01900 count ip from 10.33.0.100 to any out xmit cx0
01910 count ip from not 10.0.0.0/8 to 10.33.0.100 via rl0
01920 allow ip from 10.33.0.100 to not 10.0.0.0/8
01930 allow ip from 10.33.0.100 to 10.0.0.0/8
01940 allow ip from any to 10.33.0.100 in recv cx0
01950 allow ip from not 10.0.0.0/8 to 10.33.0.100
01960 allow ip from 10.0.0.0/8 to 10.33.0.100
01970 allow ip from any to 10.33.0.100
01980 count ip from 10.44.0.5 to any out xmit cx0
01990 count ip from not 10.0.0.0/8 to 10.44.0.5 via rl0
02000 allow ip from 10.44.0.5 to not 10.0.0.0/8
02010 allow ip from 10.44.0.5 to 10.0.0.0/8
02020 allow ip from any to 10.44.0.5 in recv cx0
02030 allow ip from not 10.0.0.0/8 to 10.44.0.5
02040 allow ip from 10.0.0.0/8 to 10.44.0.5
02050 allow ip from any to 10.44.0.5
02060 count ip from 10.33.0.22 to any out xmit cx0
02070 count ip from not 10.0.0.0/8 to 10.33.0.22 via rl0
02080 allow ip from 10.33.0.22 to not 10.0.0.0/8
02090 allow ip from 10.33.0.22 to 10.0.0.0/8
02100 allow ip from any to 10.33.0.22 in recv cx0
02110 allow ip from not 10.0.0.0/8 to 10.33.0.22
02120 allow ip from 10.0.0.0/8 to 10.33.0.22
02130 allow ip from any to 10.33.0.22
02140 count ip from 10.33.0.40 to any out xmit cx0
02150 count ip from not 10.0.0.0/8 to 10.33.0.40 via rl0
02160 allow ip from 10.33.0.40 to not 10.0.0.0/8
02170 allow ip from 10.33.0.40 to 10.0.0.0/8
02180 allow ip from any to 10.33.0.40 in recv cx0
02190 allow ip from not 10.0.0.0/8 to 10.33.0.40
02200 allow ip from 10.0.0.0/8 to 10.33.0.40
02210 allow ip from any to 10.33.0.40
02220 count ip from any to 212.109.53.32 in recv cx0
02230 count ip from 212.109.53.33 to any out xmit cx0
02240 count ip from any to 212.109.53.33 in recv cx0
02250 count ip from any to 212.109.53.34 in recv cx0
02260 count ip from 212.109.53.34 to any out xmit cx0
02270 count ip from any to 212.109.53.35 in recv cx0
02280 count ip from any to 212.109.53.36 in recv cx0
02290 count ip from 212.109.53.37 to any out xmit cx0
02300 count ip from any to 212.109.53.37 in recv cx0
02310 count ip from any to 212.109.53.38 in recv cx0
02320 count ip from 212.109.53.38 to any out xmit cx0
02330 count ip from any to 212.109.53.39 in recv cx0
02340 count tcp from any to 212.109.43.162 25 in recv cx0
02350 count tcp from 212.109.43.162 to any 25 out xmit cx0
02360 count ip from any to 212.109.43.162 in recv cx0
02370 count ip from 212.109.43.162 to any out xmit cx0
65535 allow ip from any to any
Так работает, но если добавить предпоследним запрещаюе правило "все отовсюду" - перестает.

• Закрытый firewall, Nikolaev D., 19:18 , 25-Мрт-03, (1)
  • Закрытый firewall, Алексей, 11:26 , 26-Мрт-03, (2)
    • Закрытый firewall, PavelShavrin, 11:39 , 26-Мрт-03, (3)