Различия

Показаны различия между двумя версиями страницы.

--- wiki:freebsd:ipfw [2024/01/07 11:55] – Diman
+++ wiki:freebsd:ipfw [2026/03/25 12:26] (текущий) – [Работающий в первый же запуск скрипт ipfw] Diman
@@ Строка 6: / Строка 6: @@
 <code bash>
+#
+# Установим кое-какие пакеты
+#
+pkg update && pkg upgrade
+pkg install -y mc nano rsync  tmux bash htop bind-tools
+# replace bash for root
+chsh -s /usr/local/bin/bash root
 # russian lang for root
@@ Строка 24: / Строка 33: @@
-pkg update && pkg upgrade
-pkg install -y mc nano rsync screen tmux bash htop
-# replace bash for root
-chsh -s /usr/local/bin/bash root
@@ Строка 40: / Строка 43: @@
 <code bash>
-echo '# IPFW
+#
+# Перейти в BASH
+#
+bash
+cat <<EOF >> /boot/loader.conf
+# IPFW
 ipfw_load="YES"
 ipfw_nat_load="YES"
 firewall_logif="YES"
+# PIPE + dummynet
 ipdivert_load="YES"
 dummynet_load="YES"
 ng_pipe_load="YES"
 # SETFIB
-net.fibs="4"' >> /boot/loader.conf
+net.fibs="4"
+EOF
-echo '#!/usr/local/bin/bash
+</code>
+==== Работающий в первый же запуск скрипт ipfw ====
+<code bash>
+echo '#!/usr/local/bin/bash
 cmd="/sbin/ipfw -q"
 $cmd -f flush
-$cmd enable one_pass
+$cmd disable one_pass
 $cmd add allow all from any to any via lo0
 $cmd add deny all from any to 127.0.0.0/8
@@ Строка 62: / Строка 80: @@
 $cmd add deny all from any to any frag
+# ssh
+$cmd table admin create missing
+$cmd table admin add 10.1.1.0/24
+$cmd table admin add 192.168.10.0/24
 $cmd add check-state
-$cmd add allow tcp from any to any established
+#$cmd add allow tcp from any to any established
 $cmd add allow all from any to any out keep-state
-# ssh
-$cmd table admin create missing
-$cmd table admin add 46.160.11.108
-$cmd table admin add 5.135.191.116
-$cmd table admin add 188.138.9.117
-$cmd table admin add 195.154.236.137
 $cmd add allow ip from "table(admin)" to me 22
-# HTTP && HTTPS
-$cmd add allow tcp from any to me 443 in limit src-addr 50
-$cmd add allow tcp from any to me 80 in limit src-addr 20
-# Mail
-$cmd add allow tcp from me to any 25 out
-$cmd add allow tcp from any 25 to me in
 # Ping
 $cmd add allow icmp from "table(admin)" to me in icmptype 8
 $cmd add allow icmp from me to "table(admin)" out icmptype 0,8
-$cmd add deny log all from any to any' > /etc/ipfw.script
+$cmd add allow all from any to any
+$cmd add deny log all from any to any' > /etc/fw-script.sh
 sysrc firewall_enable="YES"
-sysrc firewall_script="/etc/ipfw.script"
+sysrc firewall_script="/etc/fw-script.sh"
 sysrc firewall_logging="YES"
+</code>
+==== NTPd ====
+<code bash>
+# ntpd
+echo '# NTP
+server ntp.ix.ru iburst maxpoll 9 prefer
+server ntp2.aas.ru iburst maxpoll 9
+server 0.freebsd.pool.ntp.org iburst maxpoll 9
+server 1.freebsd.pool.ntp.org iburst maxpoll 9
+restrict default ignore
+restrict 127.0.0.1
+restrict ntp.ix.ru
+restrict ntp2.aas.ru
+restrict 0.freebsd.pool.ntp.org
+interface ignore wildcard
+interface listen igb0
+logfile /var/log/ntp.log
+driftfile /var/db/ntp.drift
+' > /etc/ntp.conf
+touch /var/db/ntp.drift
+touch /var/log/ntp.log
+sysrc ntpd_enable="YES"
+sysrc ntpdate_enable="YES"
+sysrc ntpdate_hosts="127.0.0.1"
+sysrc ntpd_sync_on_start="NO"
+service ntpd start
 </code>
+==== Включение NAT ====
+<code bash>
+sysrc gateway_enable="YES"
+</code>