[Mm][Yy]
# variable
fwcmd="/sbin/ipfw -q"# internet interface
oif="rl1"
onet="192.168.1.0/30"
oip="192.168.1.2"
# localnet interface
iif="rl0"
inet="192.168.2.0/24"
iip="192.168.2.99"
# drop old rules
${fwcmd} -f flush
# local trafic
${fwcmd} add 50 divert natd ip from any to any via ${oif}
${fwcmd} add 100 pass all from any to any via lo0
${fwcmd} add 200 deny all from any to 127.0.0.0/8
${fwcmd} add 300 deny ip from 127.0.0.0/8 to any
# RDP
${fwcmd} add 500 allow tcp from any to any 3389
${fwcmd} add 600 allow tcp from any 3389 to any
# ICMP
${fwcmd} add 1100 deny icmp from any to any in icmptype 5,9,13,14,15,16,17
${fwcmd} add 1200 allow icmp from any to any
# SSH
${fwcmd} add 2100 allow tcp from ${inet} to me 22
${fwcmd} add 2200 allow tcp from me 22 to ${inet}
# DNS
${fwcmd} add 3100 allow udp from any to any 53
${fwcmd} add 3200 allow udp from any 53 to any
${fwcmd} add 3300 allow tcp from any to any 53
${fwcmd} add 3400 allow tcp from any 53 to any
# Web
${fwcmd} add 4100 allow tcp from any to any 80,443
${fwcmd} add 4200 allow tcp from any 80,443 to any
# Mail
${fwcmd} add 5100 allow tcp from any to any 25,110
${fwcmd} add 5200 allow tcp from any 25,110 to any
# ICQ
${fwcmd} add 6100 allow tcp from any to any 5190
${fwcmd} add 6200 allow tcp from any 5190 to any
# pptp
${fwcmd} add 7100 allow tcp from any to me 1723
${fwcmd} add 7200 allow tcp from me 1723 to any
${fwcmd} add 65000 allow ip from any to any
Вариант для распечатки
Информационная безопасность (Public)
(ok) on 10-Ноя-07, 11:13 
