Исходное сообщение
"pf, не получается настроить port-forwarding в pf" Отправлено vitus, 03-Мрт-12 01:11
Добрый вечер. Есть проблемы с настройкой pf и порт-форвардингом Есть набор правил: ##Definition Section         int_if="em0"         ext_if="em1"         ext_addr="xx.xx.xx.xx"         int_network="192.168.1.0/24"         icmp_types="echoreq" ##Internal Network Hosts         locman="192.168.1.4" ##Common Block Policy         scrub out all         scrub in all         set skip on lo0 ##NAT Policy         nat on $ext_if from $int_network to any -> ($ext_if) ##NAT Policy, locman-server publication         rdr on $ext_if proto tcp from any to $ext_addr port rdp ->$locman port rdp ##Filtering Policy #       block in all #       block out all ##Internal Network         #allow ftp,telnet,ssh,pop3         #disallow www, smtp         pass in on $int_if proto tcp from $int_if:network to any port {21,22,23,110} keep state         pass in on $int_if proto icmp from $int_if:network keep state ##External Network         pass in on $ext_if proto tcp from any to any port 22         pass out on $ext_if proto tcp all modulate state flags S/SA         pass out on $ext_if proto {udp, icmp} all keep state         pass in on $ext_if proto tcp from any to any port rdp результаты тестов: gateway3# pfctl -sn nat on em1 inet from 192.168.1.0/24 to any -> (em1) round-robin rdr on em1 inet proto tcp from any to xx.xx.xx.xx port = rdp -> 192.168.1.4 port 3389 gateway3# pfctl -sr scrub out all fragment reassemble scrub in all fragment reassemble pass in on em0 inet proto tcp from 192.168.1.0/24 to any port = ftp flags S/SA keep state pass in on em0 inet proto tcp from 192.168.1.0/24 to any port = ssh flags S/SA keep state pass in on em0 inet proto tcp from 192.168.1.0/24 to any port = telnet flags S/SA keep state pass in on em0 inet proto tcp from 192.168.1.0/24 to any port = pop3 flags S/SA keep state pass in on em0 inet proto icmp from 192.168.1.0/24 to any keep state pass in on em1 proto tcp from any to any port = ssh flags S/SA keep state pass out on em1 proto tcp all flags S/SA modulate state pass out on em1 proto udp all keep state pass out on em1 proto icmp all keep state pass in on em1 proto tcp from any to any port = rdp flags S/SA keep state Однако телнет на внешний интерфейс не проходит. Есть какие-либо идеи. Порт 22 снаружи доступен, т.е фильтрация работает.