FreeBsd5.4+pf+squid反向代理实战笔记

cd /usr/src/sys/i386/conf
cp GENERIC cache

device pf
device pflog
device pfsync
options ALTQ
options ALTQ_CBQ

/usr/sbin/config cache
cd ../config/cache
make depend
make
make install

reboot

usbd_enable="NO"
defaultrouter="218.4.xxx.xxx"
hostname="cache.aaa.com"
ifconfig_fxp0="inet 218.4.xxx.xxx netmask 255.255.255.248"
ifconfig_fxp1="inet 192.168.2.10 netmask 255.255.255.0"
gateway_enable="YES"
inetd_enable="YES"
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
sshd_enable="YES"

net.inet.ip.forwarding=1

wan_if="fxp0"
lan_if="fxp1"
inter_net="192.168.2.0/24"
web_server="192.168.2.3"
ftp_server="192.168.2.3"
scrub in all
nat on $wan_if from $inter_net to any -> fxp0

rdr on fxp1 proto tcp from $lan_if to any port 80 -> $lan_if port 80

rdr on fxp1 proto tcp from any to any port 21 -> 127.0.0.1 port 8021
#rdr on fxp0 proto tcp from any to $wan_if port 80 ->$web_server port 8080
#rdr on fxp1 proto tcp from $lan_if to $wan_if port 80 ->$web_server port 8080

rdr on $wan_if proto tcp from any to any port 21 -> $ftp_server port 21
rdr on $wan_if proto tcp from any to any port 49152:65535 -> $ftp_server port 49152:65535

# in on $wan_if
pass in quick on $wan_if proto tcp from any to $ftp_server port 21 keep state
pass in quick on $wan_if proto tcp from any to $ftp_server port > 49151 keep state

# out on $lan_if
pass out quick on $lan_if proto tcp from any to $ftp_server port 21 keep state
pass out quick on $lan_if proto tcp from any to $ftp_server port > 49151 keep state

#Disable danger port
#Danger_Port="{445 135 139 593 5554 9995 9996}"
#block quick on $wan_if inet proto tcp from any to any port $Danger_Port
#block quick on $wan_if inet proto tcp from any to any port $Danger_Port
pass in all
pass out all