Jump to content

pf к ipfw перевод

Привет BSD гуру Кто-нибудь есть идеи, как мы можем перевести эти правила packet filter к IPFW nat и setfib.


lan_net = ""

int_if = "dc0"

ext_if1 = "fxp0"

ext_if2 = "fxp1"

ext_gw1 = ""

ext_gw2 = ""


# nat outgoing connections on each internet interface

match out on $ext_if1 from $lan_net nat-to ($ext_if1)

match out on $ext_if2 from $lan_net nat-to ($ext_if2)


# default deny

block in

block out


# pass all outgoing packets on internal interface

pass out on $int_if to $lan_net

# pass in quick any packets destined for the gateway itself

pass in quick on $int_if from $lan_net to $int_if

# load balance outgoing traffic from internal network.

pass in on $int_if from $lan_net \

route-to { ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } \


# keep https traffic on a single connection; some web applications,

# especially "secure" ones, don't allow it to change mid-session

pass in on $int_if proto tcp from $lan_net to port https \

route-to ($ext_if1 $ext_gw1)


# general "pass out" rules for external interfaces

pass out on $ext_if1

pass out on $ext_if2


# route packets from any IPs on $ext_if1 to $ext_gw1 and the same for

# $ext_if2 and $ext_gw2

pass out on $ext_if1 from $ext_if2 route-to ($ext_if2 $ext_gw2)

pass out on $ext_if2 from $ext_if1 route-to ($ext_if1 $ext_gw1)

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this