Архив форумов ЦИТФорума

[Константин С. Глебов]

доброго времени суток.
настраиваю нат, сделал все как сказано в хендбуке,
а именно: в файрволе поместил правило для ната:
divert 8668 ip from any to any via tun0
Пробую с машины с адресом 192.168.0.200 приготовить плов, не работает.
Пробовал также убрать все правила оставив только пропуск всех и нат,тоже не работает.

в /etc/rc.conf:
natd_enable="YES"
natd_interface="tun0"

ipfw:
divert 8668 ip from any to any via tun0
allow ip from any to any

подскажите плз где нетак...

[VeL]

А ipfw в /etc/rc.conf прописал?
Проверь запущен ли у тебя ipfw который и должен заварачивать трафик в нат.

В тот момент времени когда ты предполагаешь что все настроенно правильно и по твоему мнению должно работать
покажи вывод команды:

[Константин С. Глебов]

вот вывод файрвола, вроде он запускается:

> sudo ipfw list
00100 check-state
00200 allow ip from any to any via lo0
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to 127.0.0.0/8
00500 divert 8668 ip from ${lan1} to any via tun0
00600 allow ip from me to ${lan1} via em0
00700 allow ip from ${lan1} to me via em0
00800 allow udp from me to ${isp_dns1} dst-port 53 out via rl0 keep-state
00900 allow udp from me to ${isp_dns2} dst-port 53 out via tun0 keep-state
01000 allow icmp from any to any via em0
01100 allow icmp from any to any via rl0
01200 allow icmp from any to any via tun0
01300 allow icmp from any to any via gif0
01400 allow ip from me to ${isp_pppoe} via rl0
01500 allow ip from ${isp_pppoe} to me via rl0
01600 allow ip from ${friendly_server} to me dst-port 22 in
01700 allow ip from me to ${friendly_server} dst-port 22 out
01800 allow ip from ${friendly_server} to me dst-port 3389 in
01900 allow ip from me to ${friendly_server} dst-port 3389 out
02000 allow ip from ${filial} to me dst-port 22 in
02100 allow ip from me to ${filial} dst-port 22 out
02200 allow tcp from ${lan1} to ${lan2} out via gif0
02300 allow tcp from ${lan2} to ${lan1} in via gif0
02400 allow tcp from ${lan1} to ${lan2} via em0
02500 allow tcp from ${lan2} to ${lan1} via em0
02600 allow udp from ${filial} to me dst-port 500
02700 allow udp from me to ${filial} dst-port 500
02800 allow esp from me to ${filial} out
02900 allow esp from ${filial} to me in
03000 allow tcp from me to any out via tun0 setup
03100 allow tcp from any to any via tun0 established
03200 allow ip from any to any via tun0 frag
03300 deny log ip from any to any
65535 allow ip from any to any

а вот /etc/rc.conf

# -- sysinstall generated deltas -- # Fri Jun 6 22:02:25 2008
# Created: Fri Jun 6 22:02:25 2008
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
font8x14="cp866-8x14"
font8x16="cp866b-8x16"
font8x8="cp866-8x8"
keymap="ru.koi8-r"
keyrate="fast"
mousechar_start="3"
moused_enable="YES"
saver="logo"
scrnmap="koi8-r2cp866"

hostname="gate0.loc"
ifconfig_em0="inet 192.168.0.1 netmask 255.255.255.0"
ifconfig_rl0="DHCP"
cloned_interfaces="gif0"
gif_interfaces="gif0"
gifconfig_gif0="centr_ip filial_ip"
ifconfig_gif0="inet 192.168.0.1 192.168.1.1 netmask 255.255.255.0"

#run sshd
sshd_enable="YES"

#run pppd
ppp_enable="YES"
ppp_mode="ddial"
ppp_profile="orionnet"

#enable squid
squid_enable="YES"

#enable apache22
apache22_enable="YES"

#enable firewall
firewall_enable="YES"
firewall_script="/etc/myrc.firewall"
firewall_logging="YES"

#static routes
static_routes="isppppoe filisp int"
route_isppppoe="-host isp_pppoe centr_ip"
route_filisp="-net isp_int_net isp_int_router -netmask 255.255.248.0"
route_int="-net 192.168.1.0 192.168.1.1 -netmask 255.255.255.0"

gateway_enable="YES"
natd_enable="YES"
natd_interface="tun0"
natd_flags="-u -redirect_port tcp 192.168.0.15:3389 3389"

ipsec_enable="YES"
ipsec_file="/etc/ipsec.conf"
racoon_enable="YES"
racoon_flags="-f /usr/local/etc/racoon/racoon.conf"


> ls -l /etc/myrc.firewall
-rw-r--r-- 1 root wheel 2230 1 окт 21:15 /etc/myrc.firewall

[crash]

в ядре включили?

[Константин С. Глебов]

да,вот чо в настроечном файле ядра
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=0
options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPDIVERT