>А как быть с ftp #!/bin/sh ournet="192.168.0.0/24" ourprefix="192.168.0" ipout="*.*.*.*" ipuser="192.168.0.*" ifout="xl0" ifuser="xl1" # CLEAR RULES ipfw -q flush ipfw -f pipe flush ipfw -f queue flush # BEGIN FIREWALLING ipfw add 10 check-state # DENY PART I ipfw add 11 deny icmp from any to any in icmptype 5,9,13,14,15,16,17 ipfw add 12 reject ip from ${ournet} to any in via ${ifout} ipfw add 14 deny all from any to 255.255.255.255 ipfw add 16 deny udp from any to any 137,138 # THIS MUST BE ipfw add 30 allow all from any to any via lo ipfw add 31 allow ip from me to any keep-state #----------------- FOREIGN IN -------------------------------- # OUTSIDE FTP, FTPDATA ipfw add 43 allow tcp from any to me 20,21,49153 in via ${ifout} #----------------- LOCAL SECTION ---------------------------- # LOCAL DNS, NTP ipfw add 50 allow udp from ${ournet} to me 53,123 in via ${ifuser} # LOCAL FTP, SSH, HTTP, FTPDATA ipfw add 55 allow tcp from ${ournet} to me 20,21,22,8000,49153 in via ${ifuser} #----------------- FORWARD SECTION ------------------------- # SQUID ipfw add 59 fwd 127.0.0.1,3129 tcp from ${ournet} to any 80 out via ${ifout} # NATD ipfw add 60 divert natd all from any to any via ${ifout} #------------------ USER SECTION ---------------------------- # LOCAL ICMP ipfw add 70 allow icmp from ${ournet} to any in via ${ifuser} ipfw add 71 allow icmp from any to ${ournet} # LOCAL ICQ ipfw add 80 allow tcp from ${ournet} to any 5190 in via ${ifuser} ipfw add 81 allow tcp from any 5190 to ${ournet} #-------------------------------------------------------------- # USER DUMMYNET OUT ipfw pipe 1 config bw 128Kbit/s ipfw queue 1 config pipe 1 weight 50 queue 20 mask src-ip 0xffffffff # USER DUMMYNET IN ipfw pipe 2 config bw 128Kbit/s ipfw queue 2 config pipe 2 weight 50 queue 40 mask dst-ip 0xffffffff # DUMMYNET USER ipfw add 59901 queue 1 ip from ${ournet} to any in via ${ifuser} ipfw add 59902 queue 2 ip from any to ${ournet} #-------------------------------------------------------------- # OUTSIDE ICMP ipfw add 59998 allow icmp from any to me in via ${ifout} # GLOBAL OUT ipfw add 59999 allow ip from ${ipout} to any out via ${ifout} # DENY ANYTHING ELSE WITH LOGGING ipfw add 60000 deny ip from any to anyправило за номером 43 и vsftpd. proftpd тоже сойдет: нужен ftp сервер с отстраиваемыми номерами портов.
|