Hugle

ostalnyje natiatsa na drugih interfaceh ja by mog koneshno vpisat' kazhdij port kotorij mne nuzhen na etot GW no eto zajmiiot okolo 65000 strok.. :)

vkliuchiaju NAT na opredelionnyje destination porty.

spasibo za sovet, razobralsia ;) eshio odin voprosik vozmozhno li shtoto vrode: map fxp3 from 192.168.0.0/16 ! to 192.168.0.0/16 ports = 445:1862 -> 212.59.9.59/32 portmap tcpudp auto t.e. shtoby nat vkliuchiat' na port-range ? takoje pravilo nerabotaet, no mozhet ktoto znaet vozmozhno li takoje voobshe? esli da, to kak spasibo :)

Privedstvuju vseh. uzhe ne v pervij ras vozvrashiajus k etomu voprossu :) delo takoje est' usera s ip 192.168.1.x i 192.168.2.x i est' 2 GW x.x.x.161 ( IP na mojom interface x.x.x.162) z.z.z.142 (tuta z.z.z.141) delo takoje... nado eti 2 raznije subneta psutit' cherez raznije gateways. ipnat pravila takovy: map fxp1 from 192.168.1.0/24 ! to 192.168.0.0/16 -> x.x.x.162/32 proxy port ftp ftp/tcp map fxp1 from 192.168.1.0/24 ! to 192.168.0.0/16 -> x.x.x.162/32 portmap tcp/udp 30000:60000 map fxp1 from 192.168.1.0/24 ! to 192.168.0.0/16 -> x.x.x.162/32 map vlan0 from 192.168.2.0/24 ! to 192.168.0.0/16 -> z.z.z.142/32 proxy port ftp ftp/tcp map vlan0 from 192.168.2.0/24 ! to 192.168.0.0/16 -> z.z.z.142/32 portmap tcp/udp 30000:60000 map vlan0 from 192.168.2.0/24 ! to 192.168.0.0/16 -> z.z.z.142/32 route add default x.x.x.161 tak, vsio rabotaet tolko subneta 192.168.1.0/24 no ne rabotaet dla 192.168.2.0/24, nado kakto igratsa so vtorim gateway. progoval dobavit' pravelo po tipu: ipfw add 1 fwd z.z.z.141 all from any to not z.z.z.142 no ne pomogaet. pomojemu ipfw fwd, rabotaet pered IPNAT'om, poetomu pakety neperehodiat na gateway2. Mozhet ktonibud' mozhet pomoch? spasibo.

esli v pasivnom rezhime scanirovat' to budet viden (iz redka) ip dazhe te, kotorije ne v tvojom segmente.

arping MAC (da eto unixovxkih tool) no i to windowskije mashyny ne otvechiajut... tolko unixovskije (hotia na nih tozhe mozhno zdelat' shto neuznaesh:) ) prostejshij sposob, esli on v tvojom subnete (IP) to pod freebsd: arp -na | grep "ma:cc:aa:dd:rr:es" eshio s pomoshiu tcpdump'a mozhno probovat' lovit'.

na skolko ja ponial.. to togda nado zakinut' usera www (pod etim userom vrode apache krutitsa) v sudo, shtoby on pod polzovatsa komandoj ipfw... adalshe na cgi scripte opisyvaesh... if user = kakojtotam user and pass = tvoj_pass then blabla.. na PHP eto vygliadeloby primerno tak: system("/sbin/ipfw add 100 allow shtototam");

squid mozhet shape'it tolko traffic kotorij idiot cherez nego.. ja nedumaju shto ty smozhesh shape'it ftp traffic.. t.e. zdelat' transparent proxy dla ftp pomojemu nikak nepoluchitsa.. on budet shapeit' tolko 80yj port...

esli user imeet pravo na super-usera to zechem dopolnitelnaja zashita pered ipfw?

esli situacija slishkom beznadioshnaja, mozhet sledujet postavit' bridge s freebsd i shape'it na niom?:)

a mozhet u tebia virus v seti? w32/Nachi.Worm propatch windows (xp ili 2000)

poj server krutilsia po winxp do togo, kak v seti bylo 50 userov.. ptom ershil shto nado shtoto delat'.. zaisntalil Linux (debian) i muchial ego 10 chiasov, NAT nachial rabotat'.. ;] potom eshio potratil 4 chiasa na to, shtob zastavit' rabotat' 2 kanala (u menai 2 dsl'a bylo) Teper pereshol na FreeBSD, i radujus' ;] traffic shaping udoben.. podshiot traffica tozhe mozhno vesti, hotia ja nevedu. Tolko MRTG traffiki risuet.. BIND irc server squid-cache (klassanja shtuka kogda > 100 userov v seti) i FTP eshio hacknut' neuspeli :)) pravda FTP krutitsa na drugom servere, shtoby engruzit' lishnimi 60GB traffika v den'

cat /var/log/messages | grep named shtonit' pokazyvaet ?

lutshe ispolzuj: mask dst-ip 0xffffffff mask src-ip 0xffffffff potom w `ipfw pipe show` budet jasnee ;))) ja duamju odinakovyje nomera pravil tozhe ne sovetujetsa polzovat' i esli delaesh ogranichenije v inet (ne do routera samogo) to delaja from not me to $lan out via $lanif #download from $lan to not me in via $lanif #upload

chiutok smenil ipant.rules map 213.252.162.162 from 192.168.0.0/16 ! to 192.168.0.0/16 -> 213.252.192.162/32 portmap tcp/udp 10000:60000 map 213.252.162.162 from 192.168.0.0/16 ! to 192.168.0.0/16 -> 213.252.192.162/32 map rl1 from 192.168.0.0/16 ! to 192.168.0.0/16 -> 212.59.9.59/32 portmap tcp/udp 10000:60000 map rl1 from 192.168.0.0/16 ! to 192.168.0.0/16 -> 212.59.9.59/32 map vlan0 from 192.168.0.0/16 ! to 192.168.0.0/16 -> 213.252.192.142/32 portmap tcp/udp 10000:60000 map vlan0 from 192.168.0.0/16 ! to 192.168.0.0/16 -> 213.252.192.142/32 [code] poskolku fxp0 eto setevoj interface + alias no kogda ja dobavliaju pravila ipf.rules ping do servera voobshe propadaet hotia is SSH nevykidyvaet, i loginitsa normalno na ftp tozhe zahodit... pomogite dobrije liudi ;) Spasibo bolshoe