[FUG-BR] IPFW - Liberar faixa de IP's

[Marcelo Costa]

man ipfw


 If you administer one or more subnets, you can take advantage of the
     ipfw2 syntax to specify address sets and or-blocks and write
extremely
     compact rulesets which selectively enable services to blocks of
clients,
     as below:

           goodguys="{ 10.1.2.0/24{20,35,66,18} or 10.2.3.0/28{6,3,11}
}"
           badguys="10.1.2.0/24{8,38,60}"

           ipfw add allow ip from ${goodguys} to any
           ipfw add deny ip from ${badguys} to any
           ... normal policies ...

Marcelo


On Thu, 2005-03-10 at 10:46, Daniel Angelini Toledo wrote:
> Senhores,
> 
> Esgotei meus neurônios tentando fazer isso, e estou recorrendo à vocês.
> 
> Preciso liberar uma faixa de IP's para navegar sem proxy, ou seja, sair
> pela porta 80, e bloquear todo o resto.
> 
> Liberar os IP's 192.168.26.1 até 192.168.26.6 e bloquear o resto.
> 
> Aqui está meu script de firewall:
> 
> sis0: interface externa
> rl0: interface externa
> 
> #!/bin/sh
> ipfw -f flush
> ipfw add 01 divert 8668 ip from any to any via sis0
> 
> ipfw add 101 allow tcp from 192.168.26.0/24 to 192.168.26.254 3128 via
> rl0
> ipfw add 102 allow tcp from 192.168.26.1/32 to any 80 via rl0 setup
> keep-state
> ipfw add 103 allow tcp from 192.168.26.2/32 to any 80 via rl0 setup
> keep-state
> ipfw add 104 allow tcp from 192.168.26.3/32 to any 80 via rl0 setup
> keep-state
> ipfw add 105 allow tcp from 192.168.26.4/32 to any 80 via rl0 setup
> keep-state
> ipfw add 106 allow tcp from 192.168.26.5/32 to any 80 via sis0 setup
> keep-state
> ipfw add 107 allow tcp from 192.168.26.6/32 to any 80 via rl0 setup
> keep-state
> 
> ipfw add 108 deny tcp from any to any 3128 via sis0
> 
> ipfw add 110 deny tcp from 192.168.26.0/24{7-254} to any 80 via rl0
> 
> ipfw add 300 allow ip from any to any
> 
> 
> Grato
> Daniel
> 
> _______________________________________________________________
> Para enviar um novo email para a lista: freebsd em fug.com.br
> Sair da Lista: http://mail.fug.com.br/mailman/listinfo/freebsd_fug.com.br
> Historico: http://www4.fugspbr.org/lista/html/FUG-BR/
> 


_______________________________________________________________
Para enviar um novo email para a lista: freebsd em fug.com.br
Sair da Lista: http://mail.fug.com.br/mailman/listinfo/freebsd_fug.com.br
Historico: http://www4.fugspbr.org/lista/html/FUG-BR/