самый простой способ прописать на обоих рутерах
${fwcmd} add xxx pass tcp from any to any
но правило надо сужать до конкретных айпишников,
остается открытым вопрос кто должен инициализировать тисипи сессию, или нужно в обе стороны открывать.
я бы вместо 303 и 304 правил написал${fwcmd} add 303 allow tcp from $wan_ip to any $out_tcp
${fwcmd} add 303 allow tcp from any $out_tcp to $wan_ip
${fwcmd} add 304 allow tcp from any to ${wan_ip} ${ftp_p}
${fwcmd} add 304 allow tcp from ${wan_ip} ${ftp_p} to any
и в офисе соответственно также, а вообще имхо лучше определиться кто куда конкретно будет ходить и от этого плясать, и вместо всех anyпрописать конкретно сети/ip
можно продолжить эту тему :)
>офис
>fwcmd="/sbin/ipfw"
>${fwcmd} -f flush
>
>lan_if="rl1"
>lan_ip="192.168.30.13"
>lan_net="192.168.30.0/24"
>wan_if="vr0"
>wan_ip="10.151.194.14"
>
>od=10.151.194.14
>sd=10.148.111.12
>
>udp_ports="53, 123"
>out_tcp="20, 21, 22, 80, 443"
>ftp_p="49152-65535"
>
>
>${fwcmd} add 100 divert natd all from any to any via ${wan_ip}
>
>
>${fwcmd} add 1 allow ip from any to any via gif0
>${fwcmd} add 1 allow udp from ${od} to ${sd} isakmp
>${fwcmd} add 1 allow udp from ${sd} to ${od} isakmp
>${fwcmd} add 1 allow esp from ${od} to ${sd}
>${fwcmd} add 1 allow esp from ${sd} to ${od}
>${fwcmd} add 1 allow ipencap from ${od} to ${sd}
>${fwcmd} add 1 allow ipencap from ${sd} to ${od}
>
>${fwcmd} add 200 check-state
>
>${fwcmd} add 300 pass icmp from any to any icmptype 0, 3,
>8, 11
>${fwcmd} add 301 pass udp from ${wan_ip} to any 33434-33525 keep-state
>${fwcmd} add 302 pass udp from ${wan_ip} to any ${udp_port} keep-state
>${fwcmd} add 303 pass tcp from ${wan_ip} to any ${out_tcp} keep-state
>${fwcmd} add 304 pass tcp from ${wan_ip} ${ftp_p} to any setup keep-state
>
>
>
>склад
>fwcmd="/sbin/ipfw"
>${fwcmd} -f flush
>
>lan_if="rl0"
>lan_ip="192.168.33.3"
>lan_net="192.168.33.0/24"
>wan_if="rl1"
>wan_ip="10.148.111.12"
>
>od=10.151.194.14
>sd=10.148.111.12
>
>udp_ports="53, 123"
>in_tcp="22, 3389"
>out_tcp="20, 21, 22, 80, 443, 3389"
>ftp_p="49152-65535"
>
>${fwcmd} add 100 divert natd all from any to any via ${wan_ip}
>
>
>ipfw add 1 allow ip from any to any via gif0
>ipfw add 1 allow udp from ${sd} to ${od} isakmp
>ipfw add 1 allow udp from ${od} to ${sd} isakmp
>ipfw add 1 allow esp from ${sd} to ${od}
>ipfw add 1 allow esp from ${od} to ${sd}
>ipfw add 1 allow ipencap from ${sd} to ${od}
>ipfw add 1 allow ipencap from ${od} to ${sd}
>
>${fwcmd} add 200 check-state
>
>${fwcmd} add 300 pass icmp from any to any icmptype 0, 3,
>8, 11
>${fwcmd} add 301 pass udp from ${wan_ip} to any 33434-33525 keep-state
>${fwcmd} add 302 pass udp from ${wan_ip} to any ${udp_port} keep-state
>${fwcmd} add 303 pass tcp from ${wan_ip} to any ${out_tcp} keep-state
>${fwcmd} add 304 pass tcp from ${wan_ip} ${ftp_p} to any setup keep-state
>
