Kiegészíteném a lentieket, hogy ezt sem hagytam ki:<br><br>/etc/rc.conf<br><br><div style="margin-left: 40px;">gateway_enable="YES"<br></div><br>/etc/sysctl.conf<br><br><div style="margin-left: 40px;">net.inet.ip.forwarding=1<br>
net.inet6.ip6.forwarding=1<br>security.jail.allow_raw_sockets=1<br></div><br><br><div class="gmail_quote">2010/6/4 Illó Gábor <span dir="ltr"><<a href="mailto:stageline@gmail.com">stageline@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Sziasztok<br><br>Van egy jail-em amely ezjail-el készült, ennek az ip címe 172.20.0.2<br><br>
A jaileket kiszolgáló rendszeren 1-től 5 ig lett beállítva alias a <font face="Courier New"><font face="Courier New">ifconfig em0 alias <font face="Courier New">172.20.0.2</font> netmask 255.255.255.0 paranccsal.</font></font><br>
<br>Jaileket futtató fő rendszer ifconfig kimenete:<br><br>em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500<br> options=219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC><br>
ether 00:19:db:62:62:6a<br> inet 195.228.156.104 netmask 0xffffff00 broadcast 195.228.156.255<br> inet6 fe80::219:dbff:fe62:626a%em0 prefixlen 64 scopeid 0x1<br> inet 172.20.0.1 netmask 0xffffff00 broadcast 172.20.0.255<br>
inet 172.20.0.2 netmask 0xffffff00 broadcast 172.20.0.255<br> inet 172.20.0.3 netmask 0xffffff00 broadcast 172.20.0.255<br> inet 172.20.0.4 netmask 0xffffff00 broadcast 172.20.0.255<br> inet 172.20.0.5 netmask 0xffffff00 broadcast 172.20.0.255<br>
nd6 options=3<PERFORMNUD,ACCEPT_RTADV><br> media: Ethernet autoselect (100baseTX <full-duplex>)<br> status: active<br>lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384<br>
options=3<RXCSUM,TXCSUM><br> inet 127.0.0.1 netmask 0xff000000<br> inet6 ::1 prefixlen 128<br> inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2<br> nd6 options=3<PERFORMNUD,ACCEPT_RTADV><br>
<br>A 172.20.0.2 ip című jail ifconfig kimenete:<br><br>em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500<br> options=219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC><br>
ether 00:19:db:62:62:6a<br> inet 172.20.0.2 netmask 0xffffff00 broadcast 172.20.0.255<br> media: Ethernet autoselect (100baseTX <full-duplex>)<br> status: active<br>lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384<br>
options=3<RXCSUM,TXCSUM><br><br>A gond, hogy nincs net a jail-en. Míg a jaileket futtató gépen megy a névfeloldás és a net, a jailben egyik sem. Tűzfalnak pf-et használok, ami így néz ki:<br><br>int_if="em0"<br>
icmp_types="echoreq"<br>public="195.228.156.104"<br><br>www="172.20.0.1"<br>mysql="172.20.0.2"<br>mail="172.20.0.3"<br>apache="172.20.0.4"<br><br># Tell if we return or drop blocked packets in general<br>
set block-policy return<br><br># don't filter on the loopback interface<br>set skip on lo0<br><br># Normalization: reassemble fragments and resolve or reduce traffic ambiguities.<br>scrub in all<br><br># NAT a helyi halora<br>
nat on $int_if from <a href="http://172.20.0.0/24" target="_blank">172.20.0.0/24</a> to any -> $public<br><br># <a href="http://www.stageline.hu" target="_blank">www.stageline.hu</a><br># FTP<br>rdr pass on $int_if proto tcp from any to any port 21 -> $www<br>
rdr pass on $int_if proto tcp from any to any port 30000:31000 -> $www<br><br># HTTP<br>rdr pass on $int_if proto tcp from any to any port 80 -> $www<br>rdr pass on $int_if proto tcp from any to any port 443 -> $www<br>
<br># <a href="http://mail.stageline.hu" target="_blank">mail.stageline.hu</a><br># SMTP Postfix<br>rdr pass on $int_if proto tcp from any to any port 995 -> $mail<br>rdr pass on $int_if proto tcp from any to any port 587 -> $mail<br>
rdr pass on $int_if proto tcp from any to any port 25 -> $mail<br>rdr pass on $int_if proto tcp from any to any port 465 -> $mail<br><br># Dovecot<br>rdr pass on $int_if proto tcp from any to any port 993 -> $mail<br>
rdr pass on $int_if proto tcp from any to any port 110 -> $mail<br><br># APACHE FTP<br>rdr pass on $int_if proto tcp from any to any port 28 -> $apache port 21<br>rdr pass on $int_if proto tcp from any to any port 33000:34000 -> $apache<br>
<br clear="all"># Set Antispoof rule<br>antispoof for $int_if<br><br># Block all incoming traffic<br>block in all<br><br># activate spoofing protection for all interfaces<br>block in quick from urpf-failed<br><br># Allow all outgoing traffic<br>
pass out all keep state<br><br># Allow ping<br>pass in inet proto icmp all icmp-type $icmp_types<br><br># Allow incoming<br>pass in proto tcp to $int_if port {1985}<br><br>#vpn<br>pass in quick proto esp from any to any<br>
pass in quick proto ah from any to any<br>pass in quick proto ipencap from any to any<br>pass in quick proto udp from any port = 500 to any port = 500<br>pass in quick on gif0 from any to any<br><br><br>Valami ötlet esetleg? Eddig működött így. Éjjel újraraktam a rendszert, most szeretném éleszteni de nem megy. Az ezjail az, ami új.<br>
<br>-- <br>Best Regards<br><font color="#888888">Gábor Illó<br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Best Regards<br>Gábor Illó<br>