[BSD] openbsd pf

[daemon at vipmail.hu]

            Sziasztok!
Egy leírás alapján beállítottam az OpenBSD-s pf-confot:


ext="tun0"

int="rl0"



loop="lo0"

intnet="192.168.0.0/24"

noroute="{127.0.0.1/8,192.168.0.0/16,10.0.0.0/8,255.255.255.255/32}"

inservicestcp="{ssh,smtp,auth,http,https,pop3}"

outservicestcp="{http,https,smtp,pop3,imap,whois,domain,ssh,telnet,ftp,ftp-data,nntp,auth,rsync,1863,5190,8880,3389}"

outservicesudp="{ntp,domain}"

ircports="{6667,6666,6668,6669}"

ircservers="195.70.37.253"

freedbhosts="{64.71.163.204,130.179.31.49,193.166.235.14,193.201.200.74,195.37.77.133,203.16.234.30}"

freedbports=888





nat on $ext from $int:network to any -> $ext

rdr on $int proto tcp from any to any port 21 -> 127.0.0.1 port 8081

scrub in on {$ext,$int} all




block out log on $ext all

block in log on $ext all

block return-rst out log on $ext proto tcp all

block return-rst in log on $ext proto tcp all

block return-icmp out log on $ext proto udp all

block return-icmp in log on $ext proto udp all

block in quick inet6 all

block out quick inet6 all



pass in quick on $loop all

pass out quick on $loop all



block in log quick on $ext inet proto tcp from any to any flags FUP/FUP

block in log quick on $ext inet proto tcp from any to any flags SF/SFRA

block in log quick on $ext inet proto tcp from any to any flags /SFRA



block in log quick on $ext from $noroute to any

block out log quick on $ext from any to $noroute

block in quick on $ext from any to 255.255.255.255



pass in quick on $ext inet proto tcp from any to any port > 49151 flags S/SA keep state

pass out quick on $ext inet proto icmp all icmp-type 8 code 0 keep state

pass in quick on $ext inet proto icmp all icmp-type 8 code 0 keep state



pass in quick on $ext inet proto tcp from any to any port $inservicestcp flags S/SA keep state

pass out quick on $ext inet proto udp from any to any port $outservicesudp keep state

pass out quick on $ext inet proto tcp from any to any port $outservicestcp flags S/SA modulate state



pass out quick on $ext inet proto tcp from any to $ircservers port $ircports flags S/SA modulate state

pass out quick on $ext inet proto tcp from any to $freedbhosts port $freedbports flags S/SA modulate state


Az inetd.conf  ftp része így néz ki:

127.0.0.1:8081 stream tcp	nowait	root	/usr/libexec/ftp-proxy  ftpproxy

A belső hálóról mégsem lehet ftp-zni, pedig a forgalom elvileg át van irányítva. Mi lehet a baj?
Az smtp protokoll sem működik, pedig az is át van engedve, és a sendmail access fájljában is benne van a belső hálózat.
Segítsetek, legyetek szívesek!
Üdv:
Bakos Gergő



____________________________________________________

Polifonikus csengőhangok, színes háttérképek minden témakörben >>>
http://www.telcsi.hu/index.php?prefix=JM
GSMaréna.hu - Részletes infók a mobiltelefonokról >>>
http://www.gsmarena.hu


--------- következő rész ---------
Egy csatolt HTML állomány át lett konvertálva...
URL: <http://datacast.hu/pipermail/bsd/attachments/20050118/c70a3ae4/attachment.html>