Re: ipnat
- From
- Mikhail M Krivenkov (2:5020/400)
- To
- Andrey N. Oktyabrski
- Date
- 2009-03-01T00:24:12Z
- Area
- RU.UNIX.SOLARIS
From: "Mikhail M Krivenkov" <krivenkov@tagtech.ru>
> Странно. У меня аська работает через него. Правда, конфиг простейший:
> 17:33 ano@hog:~:$ cat /etc/ipf/ipnat.conf
> ### NAT for 192.168.1.0/24 ###
> map iprb0 192.168.1.0/24 -> x.x.x.x/32 portmap tcp/udp 10240:65000
> map iprb0 192.168.1.0/24 -> x.x.x.x/32
> map skge0 192.168.1.0/24 -> z.z.z.z/32 portmap tcp/udp 10240:65000
> map skge0 192.168.1.0/24 -> z.z.z.z/32
>
> ### Transparent proxy on 127.0.0.127 ###
> rdr e1000g0 0.0.0.0/0 port 80 -> 127.0.0.127 port 3128
>
> 17:33 ano@hog:~:$ cat /etc/ipf/ipf.conf
> pass in all
> pass out all
>
> ### FastRoute to non-default gateway ###
> pass out on skge0 to iprb0:x.x.x.y from x.x.x.0/29 to any keep state
> pass out on iprb0 to skge0:z.z.z.y from z.z.z.0/29 to any keep state
>
> 17:33 ano@hog:~:$ uname -a
> SunOS hog 5.11 snv_97 i86pc i386 i86pc Solaris
>
У вас как я понял OpenSolaris, в моем случае немного подругому:
uname -a:
SunOS xxxxx 5.10 Generic_120011-14 sun4u sparc SUNW,UltraSPARC-IIi-cEngine
SunOS xxxxx 5.10 Generic_127112-02 i86pc i386 i86pc
На обоих симптомы одинаковые.
(на старом, где работает SunOS xxxxx 5.8 Generic_117351-04 i86pc i386 i86pc)
ipf.conf:
pass in on hme0 from any to any
pass out on hme0 from any to any
pass in on hme1 from any to any
pass out on hme1 from any to any
ipnat.conf:
map hme0 10.0.0.0/24 -> x.x.x.x/32 portmap tcp/udp 50000:60000
map hme0 10.0.0.0/24 -> x.x.x.x/32
ipf -V:
ipf: IP Filter: v4.1.9 (592)
Kernel: IP Filter: v4.1.9
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 1
Feature mask: 0x107
ipf -T list:
fr_flags min 0 max 0xffffffff current 0
fr_active min 0 max 0 current 1
fr_control_forwarding min 0 max 0x1 current 0
fr_update_ipid min 0 max 0x1 current 0
fr_chksrc min 0 max 0x1 current 0
fr_minttl min 0 max 0x1 current 4
fr_icmpminfragmtu min 0 max 0x1 current 68
fr_pass min 0 max 0xffffffff current 134217730
ipf_loopback min 0 max 0x1 current sz = 0
fr_tcpidletimeout min 0x1 max 0x7fffffff current 864000
fr_tcpclosewait min 0x1 max 0x7fffffff current 240
fr_tcplastack min 0x1 max 0x7fffffff current 240
fr_tcptimeout min 0x1 max 0x7fffffff current 240
fr_tcpclosed min 0x1 max 0x7fffffff current 120
fr_tcphalfclosed min 0x1 max 0x7fffffff current 14400
fr_udptimeout min 0x1 max 0x7fffffff current 240
fr_udpacktimeout min 0x1 max 0x7fffffff current 24
fr_icmptimeout min 0x1 max 0x7fffffff current 120
fr_icmpacktimeout min 0x1 max 0x7fffffff current 12
fr_iptimeout min 0x1 max 0x7fffffff current 120
fr_statemax min 0x1 max 0x7fffffff current 4013
fr_statesize min 0x1 max 0x7fffffff current 5737
fr_state_lock min 0 max 0x1 current 0
fr_state_maxbucket min 0x1 max 0x7fffffff current 26
fr_state_maxbucket_reset min 0 max 0x1 current 1
ipstate_logging min 0 max 0x1 current 1
fr_nat_lock min 0 max 0x1 current 0
ipf_nattable_sz min 0x1 max 0x7fffffff current 2047
ipf_nattable_max min 0x1 max 0x7fffffff current 30000
ipf_natrules_sz min 0x1 max 0x7fffffff current 127
ipf_rdrrules_sz min 0x1 max 0x7fffffff current 127
ipf_hostmap_sz min 0x1 max 0x7fffffff current 2047
fr_nat_maxbucket min 0x1 max 0x7fffffff current 22
fr_nat_maxbucket_reset min 0 max 0x1 current 1
nat_logging min 0 max 0x1 current 1
fr_defnatage min 0x1 max 0x7fffffff current 1200
fr_defnatipage min 0x1 max 0x7fffffff current sz = 0
fr_defnaticmpage min 0x1 max 0x7fffffff current 6
ipfr_size min 0x1 max 0x7fffffff current 257
fr_ipfrttl min 0x1 max 0x7fffffff current 120
ipl_suppress min 0 max 0x1 current 1
ipl_buffer_sz min 0 max 0 current 0
ipl_logmax min 0 max 0x7fffffff current 7
ipl_logall min 0 max 0x1 current 0
ipl_logsize min 0 max 0x80000 current 8192
ippr_ftp_debug min 0 max 0xa current 0
--- ifmail v.2.15dev5.4
* Origin: MTU-Intel ISP (2:5020/400)
SEEN-BY: 236/100 450/1024 461/640 469/142 999 4625/8 5000/5000 5006/1 5007/1
SEEN-BY: 5010/70 5011/13 5012/46 5015/28 5019/40 5020/175 194 400 545 902 1922
SEEN-BY: 5020/2238 4441 5021/29 5025/3 5030/1080 1957 5035/38 5036/1 5045/7
SEEN-BY: 5051/15 5054/1 4 8 9 28 37 5060/88 5061/15 120 5062/10 5064/7 5066/18
SEEN-BY: 5075/5 35 5080/68 5085/13 5095/20 5096/18 6001/10 6009/1
PATH: 5020/400 545 5054/1 37