...извините за наверное глупый вопрос, но все-же?
Стоит FreeBSD 4.8.
-------
options ICMP_BANDLIM
options TCP_DROP_SYNFIN
options IPDIVERT
options HZ=1300
options DUMMYNET
options IPFIREWALL
options IPFIREWALL_FORWARD
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=50
-------
net.inet.ip.fw.one_pass=0
-------
ournet='192.168.0.1/24'
uprefix='192.168.0'
iftun='tun*'
ifrl='rl0'
${ipfw} add allow ip from any to any via lo0
${ipfw} add allow ip from ${uprefix}.2 to any via ${ifrl}
${ipfw} add allow ip from any to ${uprefix}.2 via ${ifrl}
...
${ipfw} add allow ip from ${uprefix}.99 to any via ${ifrl}
${ipfw} add allow ip from any to ${uprefix}.99 via ${ifrl}
${ipfw} add allow tcp from ${ournet} to ${uprefix}.1 139 in via ${ifrl}
${ipfw} add allow tcp from ${uprefix}.1 139 to ${ournet} out via ${ifrl}
${ipfw} add allow udp from ${uprefix}.1 138 to ${ournet} 138 out via ${ifrl}
${ipfw} add allow udp from ${ournet} 138 to ${uprefix}.1 138 in via ${ifrl}
${ipfw} add allow udp from ${uprefix}.1 137 to ${ournet} 137 out via ${ifrl}
${ipfw} add allow udp from ${ournet} 137 to ${uprefix}.1 137 in via ${ifrl}
${ipfw} add allow udp from ${uprefix}.1 123 to ${ournet} 123 out via ${ifrl}
${ipfw} add allow udp from ${ournet} 123 to ${uprefix}.1 123 in via ${ifrl}
${ipfw} add pipe 1 ip from any to any out xmit ${iftun}
${ipfw} add pipe 2 ip from any to any in recv ${iftun}
${ipfw} pipe 1 config bw 115Kbit/s
${ipfw} pipe 2 config bw 115Kbit/s
${ipfw} queue 10 config pipe 1 weight 15 mask src-ip 0xFFFFFFFF
${ipfw} queue 11 config pipe 2 weight 15 mask dst-ip 0xFFFFFFFF
${ipfw} queue 20 config pipe 1 weight 35 mask src-ip 0xFFFFFFFF
${ipfw} queue 21 config pipe 2 weight 35 mask dst-ip 0xFFFFFFFF
${ipfw} queue 30 config pipe 1 weight 50 mask src-ip 0xFFFFFFFF
${ipfw} queue 31 config pipe 2 weight 50 mask dst-ip 0xFFFFFFFF
${ipfw} add queue 30 ip from ${uprefix}.2 to any out recv ${ifrl} xmit ${iftun}
...
${ipfw} add queue 30 ip from ${uprefix}.99 to any out recv ${ifrl} xmit ${iftun}
${ipfw} add divert 8668 ip from any to any via ${iftun}
${ipfw} add queue 31 ip from any to ${uprefix}.2 in recv ${iftun}
...
${ipfw} add queue 31 ip from any to ${uprefix}.99 in recv ${iftun}
${ipfw} add allow icmp from any to any in via ${iftun} icmptype 0,3,4,8,11,12,13,14
${ipfw} add allow udp from any to any 53,123,4672 out xmit ${iftun}
${ipfw} add allow udp from any 53,123,4672 to any in recv ${iftun}
${ipfw} add allow tcp from any to any out xmit ${iftun} setup
${ipfw} add allow tcp from any to any via ${iftun} established
${ipfw} add allow tcp from any to any 80 setup
${ipfw} add allow tcp from any to any 22 setup
${ipfw} add reset log tcp from any to any 113 in recv ${iftun}
-------
65535 deny ip from any to any
-------
Как перебросить tcp 4662 порт на другую машину за фиреволом?
Т.е. ктото должен приконектиться извне через ${iftun} (tun имеет реальный ip) к машине внутри локальной сети ${ifrl}.
>Как перебросить tcp 4662 порт на другую машину за фиреволом?
>Т.е. ктото должен приконектиться извне через ${iftun} (tun имеет реальный ip) к
>машине внутри локальной сети ${ifrl}.datapipe uplink_ip 4662 lan_ip 4662
datapipe в портах
Честно говоря лень вчитываться в твои правила. У меня во внутренней сетке стоит sendmail и apache, то есть надо редиректить на 25 и 80 порт. у меня так:
на файрволе/роутере:
/etc/rc.conf
....................
natd_flags="-redirect_port tcp 192.168.1.20:25 25 -redirect_port tcp 192.168.1.20:80 80"
..........................#ipfw show
..............
02500 138 7708 allow tcp from any to any 25 setup
02800 0 0 allow tcp from any to 192.168.1.20 80 setup
.......................ВОТ И ВСЁ!