[FUGSPBR] Roteador/Gateway(IPFW)

[Edson Brandi]

Rodrigo,

Fiz um script simples pra servir de exemplo, acho que ele atende o que
vc esta querendo, libera sua rede local para trafegar para fora
através da sua maquina com NAT, e o seu gateway não possui nenhuma
porta entrante aberta.

Faz seculos que não mexo com IPFW, mas acho que as regras estão
certas, só editar as variaveis do inicio e testar.

[]´s Edson

--------- 8< ----------------------------

#!/bin/sh

net="XXX.YYY.ZZZ.WWW"
mask="255.255.255.0"
natd_interface="xl0"

# Seta o comando do ipfw
fwcmd="/sbin/ipfw -q"

# Limpa as regras
${fwcmd} -f flush

${fwcmd} add 50 divert natd all from any to any via ${natd_interface}

# Seta regras para o loopback 
${fwcmd} add 100 pass all from any to any via lo0
${fwcmd} add 110 pass all from 127.0.0.1 to 127.0.0.1
${fwcmd} add 200 deny all from any to 127.0.0.0/8
${fwcmd} add 300 deny ip from 127.0.0.0/8 to any

# Libera trafego interno rede 10.10.10.0/24
${fwcmd} add pass all from  ${net}:${mask} to ${net}:${mask}

# Check-State
${fwcmd} add check-state

# Libera conexoes com setup ok
${fwcmd} add pass tcp from any to any established

# Libera pacotes fragmentados
#${fwcmd} add pass all from any to any frag

# Libera trafego TCP da rede interna pro mundo
${fwcmd} add pass tcp from  ${net}:${mask} to any setup
${fwcmd} add pass tcp from  me to any setup

# Nega restante das conexoes TCP
${fwcmd} add deny log tcp from any to any setup

# Libera consulta DNS
${fwcmd} add pass udp from ${net}:${mask} to any 53 keep-state
${fwcmd} add pass udp from any 53 to ${net}:${mask} keep-state
${fwcmd} add pass udp from me to any 53 keep-state
${fwcmd} add pass udp from any 53 to me keep-state

# Nega restante das conexoes UDP
${fwcmd} add deny log udp from any to any

# Libera ICMP
#${fwcmd} add pass icmp from ${net}:${mask} to any keep-state
#${fwcmd} add pass icmp from me to any keep-state

-- 
[ ]´s Edson
_______________________________________________________________
Para enviar um novo email para a lista: fugspbr em fugspbr.org
Sair da Lista: http://lists.fugspbr.org/listinfo.cgi
Historico: http://www4.fugspbr.org/lista/html/FUG-BR/