freebsd ipf+ipnat+ipfw建立带流量控制的透明网关(5) then echo 'pass in quick on '$ADSLDEV' proto tcp from any to any port = 554 keep state' >> /etc/ipf.rules echo 'pass in quick on '$ADSLDEV' proto udp from any to any port = 554 keep state' >> /etc/ipf.rules fi if [ $INTARNMYSQL != "0.0.0.0" ] then echo 'pass in quick on '$ADSLDEV' proto tcp from any to any port = 3306 keep state' >> /etc/ipf.rules fi if [ $INTARNJABBER != "0.0.0.0" ] then echo 'pass in quick on '$ADSLDEV' proto tcp from any to any port = 5222 keep state' >> /etc/ipf.rules echo 'pass in quick on '$ADSLDEV' proto tcp from any to any port = 5269 keep state' >> /etc/ipf.rules fi echo '' >> /etc/ipf.rules echo '#阻塞内部网络访问以下指定IP地址' >> /etc/ipf.rules echo 'block out quick proto tcp/udp from any to any port = 6995 #不能连接BT ' >> /etc/ipf.rules echo '' >> /etc/ipf.rules echo '#内部网络可以访问外部网络' >> /etc/ipf.rules echo 'pass out log on '$ADSLDEV' proto icmp all keep state' >> /etc/ipf.rules echo 'pass out log on '$ADSLDEV' proto tcp/udp from any to any keep state' >> /etc/ipf.rules echo '' >> /etc/ipf.rules echo '#阻塞外部网络的其它请求' >> /etc/ipf.rules echo 'block return-rst in log on '$ADSLDEV' proto tcp from any to '$ADSLIP' flags S/SA' >> /etc/ipf.rules echo 'block return-icmp(net-unr) in log on '$ADSLDEV' proto udp from any to '$ADSLIP'' >> /etc/ipf.rules echo 'block in log on '$ADSLDEV' all' >> /etc/ipf.rules echo '' >> /etc/ipf.rules echo '#阻塞内部网络访问以下指定IP地址' >> /etc/ipf.rules echo '#block in log quick on '$ADSLDEV' proto tcp from any to 202.106.185.77 flags S/SA #不能连接163.com' >> /etc/ipf.rules echo '' >> /etc/ipf.rules echo '#内部网络的数据全部可以通过防火墙' >> /etc/ipf.rules echo 'pass in on '$INTARNDEV' all' >> /etc/ipf.rules echo 'pass out on '$INTARNDEV' all' >> /etc/ipf.rules echo 'pass in on lo0 all' >> /etc/ipf.rules
