FreeBSDと私のWeb / FTPサーバー上のNATを実行している。
ルールには、常にからIPを許可する必要がありますか？またはどうやって？ ep0場合には、私は私の助けdoesn'tイントラネット、ルールからの任意のIPを許可する必要がありますが、常にすべてのdivertsするすべてのパケットを受け入れるか？
間の場合でも、多くの規則は規則を流用し、許可するルールから、システムができるように簡単にハッキング： ）
psの私のラングに申し訳ない。 ： ）

は、 "どのから任意の"または"すべてからの"カーネルのオプションに応じて[ IPFIREWALL_DEFAULT_TO_ACCEPT ] 、このオプションを使用するときは、オープンシステムが設定されているのすべてを否定するすべてのことです65535番号FreeBSDのファイアウォールのデフォルトの規則がある。 NATとファイアウォールの場合も、有効にすると、各インターフェイスの異なるルールを定義すると、ウェブサーバーに影響はありません。お客様のサーバーの次の行をしてみてください：

ipfw add pass tcp from any to any established
ipfw add pass tcp from any to me 80 via {$ext_if} keep-state

私は適切に必要なものはない残念そうなんです。今はしてみます。
私はルールが設定されている：

00050は8668から任意にed0経由でのIPをそらす
00200からIPを否定するには127.0.0.0 / 8
00300 127.0.0.0からのIPを拒否/ 8にする
00350 192.168.0.0/24から任意のIPを許可
00400からは192.168.0.0/24のIPを許可
00900までの任意のIPを許可
65535までの任意のIPを拒否

たとえこれらのものを追加
00500許可xxxx 192.168.0.0/24からのIP
00550 ep0に対して、 xxxxからIP経由で可能に
00600経由xxxxに任意のep0からIPを許可
00800からxxxxに任意のIPを許可
NATを適切に動作するようにして900のルールは、 ipfw doesn't削除してください。
xxxx -インターネットアドレス

ep0 -内部アダプタ
ed0 -外部

この例を見て、私は、あなたはそれを修正することができますasure働くのは、デフォルトを/ etc / rc.firewall ：作ら

[Ss][Ii][Mm][Pp][Ll][Ee])
        ############
        # This is a prototype setup for a simple firewall.  Configure this
        # machine as a named server and ntp server, and point all the machines
        # on the inside at this machine for those services.
        ############

        dont_deny="my_very_best_friend"

        # set these to your outside interface network and netmask and ip
        oif="rl1"
        onet="outside_net_address"
        omask="255.255.255.240"
        oip="outside_ip_addr"

        # set these to your inside interface network and netmask and ip
        iif="rl0"
        inet="internal_net_address"
        imask="255.255.255.0"
        iip="internal_ip"

        # Stop spoofing
        ${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
        ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}

        # Stop RFC1918 nets on the outside interface
        ${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
        ${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
        ${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}

        # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
        # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
        # on the outside interface
        ${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
        ${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
        ${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
        ${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
        ${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}


        #########       RULES BEFORE NAT      ######################

        # Allow access for iserver
        #${fwcmd} add pass tcp from 192.168.10.10 to any out setup
        # Allow access for SIMM-3
        #${fwcmd} add pass tcp from 192.168.10.20 to any out setup
        # Deny everything else
        #${fwcmd} add deny all from 192.168.0.0/24 to any setup
        #

        #######################################################################

        # Network Address Translation.  This rule is placed here deliberately
        # so that it does not interfere with the surrounding address-checking
        # rules.  If for example one of your internal LAN machines had its IP
        # address set to 192.0.2.1 then an incoming packet for it after being
        # translated by natd(8) would match the `deny' rule above.  Similarly
        # an outgoing packet originated from it before being translated would
        # match the `deny' rule below.
        case ${natd_enable} in
        [Yy][Ee][Ss])
                if [ -n "${natd_interface}" ]; then
                        ${fwcmd} add divert natd all from any to any via ${natd_interface}
                fi
                ;;
        esac

        # Stop RFC1918 nets on the outside interface
        ${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
        ${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
        ${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}

        # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
        # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
        # on the outside interface
        ${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
        ${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
        ${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
        ${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
        ${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}

        ####    RULES AFTER NAT       ##########################

        ${fwcmd} add pass tcp from any to me 113
        ${fwcmd} add pass tcp from me 113 to any

        # ${fwcmd} add pass tcp from me to any via ${iif} keep-state

        ##################################################################

        # Don't deny address[es]
        ${fwcmd} add pass all from ${dont_deny} to any
        ${fwcmd} add pass all from any to ${dont_deny}

        # Allow TCP through if setup succeeded
        ${fwcmd} add pass tcp from any to any established

        # Allow IP fragments to pass through
        ${fwcmd} add pass all from any to any frag

        # Allow setup of incoming email
        ${fwcmd} add pass tcp from any to ${oip} 25 setup

        # Allow access to our DNS
        ${fwcmd} add pass tcp from any to ${oip} 53 setup
        ${fwcmd} add pass udp from any to ${oip} 53
        ${fwcmd} add pass udp from ${oip} 53 to any

        # Allow access to our WWW
        ${fwcmd} add pass tcp from any to ${oip} 80 setup

        # Allow access to Webmin
        ${fwcmd} add pass tcp from any to ${oip} 3129 setup

        # SSH
        ${fwcmd} add pass tcp from any to ${oip} 22 setup

        # FTP
        ${fwcmd} add pass tcp from any to ${oip} 21 setup

        # FTP-data
        ${fwcmd} add pass tcp from any to ${oip} 20 setup

        # SMTP
        ${fwcmd} add pass tcp from any to ${oip} 25 setup

        # POP3
        ${fwcmd} add pass tcp from any to ${oip} 110 setup

        # Reject&Log all setup of incoming connections from the outside
        ${fwcmd} add deny log tcp from any to any in via ${oif} setup

        # Allow setup of any other TCP connection
        ${fwcmd} add pass tcp from any to any setup

        # Allow DNS queries out in the world
        ${fwcmd} add pass udp from ${oip} to any 53 keep-state

        # Allow NTP queries out in the world
        ${fwcmd} add pass udp from ${oip} to any 123 keep-state

        # Everything else is denied by default, unless the
        # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
        # config file.
        ;;