>>Еще раз благодарю за ответ. Если срастется - отпишу результат.
>А куда оно денется. Собственно я даже не знаю что сказать.
Результат-то я получил.... Короче.
==natd.conf
same_ports yes
use_sockets yes
unregistered_only yes
==rc.conf
#NAT
natd_enable="YES"
natd_program="/sbin/natd"
natd_interface="fxp0"
natd_flags="-f /etc/natd.conf"
#PPPoE
ppp_enable="YES"
ppp_mode="ddial"
ppp_nat="YES" # Вот тут я не уверен, надо-ли...
ppp_profile="adsl"
#VPN
mpd_enable="YES"
==ifconfig
fxp0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=8<VLAN_MTU>
inet 195.x.x.115 netmask 0xffffffff broadcast 195.x.x.115
ether 00:60:b0:1a:5e:8b
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=8<VLAN_MTU>
inet 192.168.77.254 netmask 0xffffff00 broadcast 192.168.77.255
ether 00:10:dc:08:fb:3e
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet 127.0.0.1 netmask 0xff000000
tun0: flags=8151<UP,POINTOPOINT,RUNNING,PROMISC,MULTICAST> mtu 1492
inet 195.x.x.115 --> 195.x.y.20 netmask 0xffffffff
Opened by PID 208
ng0: flags=8890<POINTOPOINT,NOARP,SIMPLEX,MULTICAST> mtu 1500
==netstat -rn
Destination Gateway Flags Refs Use Netif Expire
default 195.x.y.20 UGS 0 514557 tun0
127.0.0.1 127.0.0.1 UH 0 28 lo0
192.168.77 link#2 UC 0 0 rl0
192.168.77.50 00:10:dc:d9:ad:92 UHLW 0 3749 rl0 234
195.x.y.20 195.x.x.115 UH 1 2 tun0
195.x.x.115 00:60:b0:1a:5e:8b UHLW 0 35 lo0 =>
195.x.x.115/32 link#1 UC 0 0 fxp0
==rc.ipfw
#!/bin/sh -
fwcmd="/sbin/ipfw -q"
oif="tun0"
oip="195.x.x.115"
onet="195.x.x.115/32"
omask="255.255.255.255"
iif="rl0"
iip="192.168.77.254"
inet="192.168.77.0/24"
imask="255.255.255.0"
nat_1="tun0"
${fwcmd} -f flush
${fwcmd} zero
${fwcmd} add 100 pass all from any to any via lo0
${fwcmd} add 200 deny all from any to 127.0.0.0/8
${fwcmd} add 300 deny ip from 127.0.0.0/8 to any
${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}
${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
${fwcmd} add divert natd all from any to any via ${nat_1}
${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}
${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}
${fwcmd} add pass tcp from any to any established
${fwcmd} add pass all from any to any frag
${fwcmd} add pass tcp from any to ${oip} 25 setup
${fwcmd} add pass tcp from any to ${oip} 110 setup
$ipfw add pass all from any to any via ng0
${fwcmd} add deny log tcp from any to any in via ${oif} setup
${fwcmd} add pass tcp from any to any setup
${fwcmd} add pass udp from ${oip} to any 53 keep-state
${fwcmd} add pass udp from ${oip} to any 123 keep-state
rc.ipfw собран на базе Симпл по Вашему совету из Вашей ссылки =)
http://www.opennet.dev/openforum/vsluhforumID10/3273.html
"Все же почитайте man ipfw , посмотрите пример Simple в /etc/rc.firewall"
После ребута основные сервисы заработали 25, 53, 110. ВПН пока не работает, но я этим займусь.
До этого было все тоже за исключением ФВ, который достался в наследство.
Если интересно, могу показать обо что я голову ломал.
Вариант для распечатки
Информационная безопасность (Public)
(ok) on 15-Май-07, 13:38 
