abills.net.ua

Код: Выделить всё

ipfw.rules:
${FW} add 39 fwd 10.0.0.1,80 tcp from "table(99)" to not 10.0.0.3  80,443

Код: Выделить всё

ppp.linkup
GUEST_MODE:
    # Start sript to fill table for forwarding
    !bg /usr/local/script/forwarder limited_up INTERFACE USER HISADDR
    # Allow http to  (required for forwarding)
    #set filter in 0 permit 0/0 10.0.0.0/29 tcp dst eq 80
    #set filter out 0 permit 10.0.0.0/29 0/0 tcp src eq 80
    # Allow tcp for http from any to any (required for forwarding)
    set filter in 2 permit 0/0 0 dst eq 80
    set filter out 2 permit 0 0/0 tcp src eq 80
    # Allow our DNS
    set filter in 4 permit 0/0 10.0.0.3 udp dst eq 53
    set filter out 4 permit 10.0.0.3 0/0 udp src eq 53
    # Allow https to billing/webmail host
    set filter in 7 permit 0/0 10.0.0.3 tcp dst eq 443
    set filter out 7 permit 10.0.0.3 0/0 tcp src eq 443

Код: Выделить всё

[14:36][berylhead][/home/mike]#confcat /usr/local/script/forwarder
my $debug=0;
$debug=1 if ($#ARGV > -1 && $ARGV[$#ARGV] eq 'debug');
if ( $#ARGV < 3 ) {
 print qq{Not anought argumets:
 Example:
----------------------------------------------------------------
 /etc/ppp/ppp.linkup
 DENY:
   !bg /usr/abills/libexec/linkupdown up INTERFACE USER HISADDR
 /etc/ppp/ppp.linkdown
 DENY:
   !bg /usr/abills/libexec/linkupdown down INTERFACE USER HISADDR
DEBUG: $debug
};
exit 0;
}
use strict;
my $exit_code = 0;
our $IPFW='/sbin/ipfw';
my $denied_table_num='99';
my ($ACTION, $INTERFACE, $USER, $HISADDR) = (shift,shift,shift,shift);
if ($ACTION eq 'limited_up') {
    my $command = "add";
    $exit_code = fw_work ($command, $INTERFACE, $USER, $HISADDR, $denied_table_num);
}
if ($ACTION eq 'limited_down') {
    my $command = "delete";
    $exit_code = fw_work ($command, $INTERFACE, $USER, $HISADDR, $denied_table_num);
}
}
}
}
}
exit $exit_code;
sub fw_work {
    my ($act, $iface, $user, $addr, $table_num) = (shift,shift,shift,shift,shift);
    my $command = "$IPFW table $table_num $act $addr\n";
    `$command`;
    return 1;
}
}

Код: Выделить всё

[14:37][berylhead][/home/mike]#pkg_info -Ix redir
redir-2.2.1_2       A tcp connection redirection utility

Код: Выделить всё

[14:39][berylhead][/home/mike]#cat /etc/rc.conf | grep redir
icmp_drop_redirect="YES"
redir_enable="YES"
redir_flags="--lport=80 --cport=80 --laddr=10.0.0.1 --caddr=denied.fqdn"