#!/bin/sh

extip="83.xxx.xxx.xxx"

intip="192.168.9.2"

intnet="192.168.9.0/24"

mailserver="83.xxx.xxx.2"

intgateway="83.xxx.xxx.1"

#

/sbin/ipfw -f flush &

#

/sbin/ipfw add 180 divert natd ip from ${intnet} to any out xmit fxp0

/sbin/ipfw add 190 divert natd ip from any to ${extip}

# ICMP

/sbin/ipfw add 500 allow icmp from any to any

# SSH

/sbin/ipfw add 10000 allow tcp from any to any 22

/sbin/ipfw add 10010 allow tcp from any 22 to any

# DNS

/sbin/ipfw add 11000 allow tcp from any to any 53

/sbin/ipfw add 11010 allow tcp from any 53 to any

/sbin/ipfw add 11020 allow udp from any to any 53

/sbin/ipfw add 11030 allow udp from any 53 to any

# Web FTP

/sbin/ipfw add 12000 allow tcp from me to any 20,21,80,443

/sbin/ipfw add 12010 allow tcp from any 20,21,80,443 to me

/sbin/ipfw add 12020 allow udp from me to any 20,21

/sbin/ipfw add 12030 allow udp from any 20,21 to me

#

# Script for the privilege group

/bin/sh /etc/rc.firewall.local.inet

# Deny other computer of LAN

/sbin/ipfw add 12960 deny tcp from ${intnet} to any 20,21,80,443

/sbin/ipfw add 12970 deny tcp from any 20,21,80,443 to ${intnet}

/sbin/ipfw add 12980 deny udp from ${intnet} to any 20,21

/sbin/ipfw add 12990 deny udp from any 20,21 to ${intnet}

#