man ipfw
If you administer one or more subnets, you can take advantage of the
ipfw2 syntax to specify address sets and or-blocks and write
extremely
compact rulesets which selectively enable services to blocks of
clients,
as below:
goodguys="{ 10.1.2.0/24{20,35,66,18} or 10.2.3.0/28{6,3,11}
}"
badguys="10.1.2.0/24{8,38,60}"
ipfw add allow ip from ${goodguys} to any
ipfw add deny ip from ${badguys} to any
... normal policies ...
Marcelo
On Thu, 2005-03-10 at 10:46, Daniel Angelini Toledo wrote:
> Senhores,
>
> Esgotei meus neurônios tentando fazer isso, e estou recorrendo à vocês.
>
> Preciso liberar uma faixa de IP's para navegar sem proxy, ou seja, sair
> pela porta 80, e bloquear todo o resto.
>
> Liberar os IP's 192.168.26.1 até 192.168.26.6 e bloquear o resto.
>
> Aqui está meu script de firewall:
>
> sis0: interface externa
> rl0: interface externa
>
> #!/bin/sh
> ipfw -f flush
> ipfw add 01 divert 8668 ip from any to any via sis0
>
> ipfw add 101 allow tcp from 192.168.26.0/24 to 192.168.26.254 3128 via
> rl0
> ipfw add 102 allow tcp from 192.168.26.1/32 to any 80 via rl0 setup
> keep-state
> ipfw add 103 allow tcp from 192.168.26.2/32 to any 80 via rl0 setup
> keep-state
> ipfw add 104 allow tcp from 192.168.26.3/32 to any 80 via rl0 setup
> keep-state
> ipfw add 105 allow tcp from 192.168.26.4/32 to any 80 via rl0 setup
> keep-state
> ipfw add 106 allow tcp from 192.168.26.5/32 to any 80 via sis0 setup
> keep-state
> ipfw add 107 allow tcp from 192.168.26.6/32 to any 80 via rl0 setup
> keep-state
>
> ipfw add 108 deny tcp from any to any 3128 via sis0
>
> ipfw add 110 deny tcp from 192.168.26.0/24{7-254} to any 80 via rl0
>
> ipfw add 300 allow ip from any to any
>
>
> Grato
> Daniel
>
> _______________________________________________________________
> Para enviar um novo email para a lista: freebsd@fug.com.br
> Sair da Lista: http://mail.fug.com.br/mailman/listinfo/freebsd_fug.com.br
> Historico: http://www4.fugspbr.org/lista/html/FUG-BR/
>
_______________________________________________________________
Para enviar um novo email para a lista: freebsd@fug.com.br
Sair da Lista: http://mail.fug.com.br/mailman/listinfo/freebsd_fug.com.br
Historico: http://www4.fugspbr.org/lista/html/FUG-BR/
