Запрет доступа к определённому сайту

add [номер, правило должно располагаться выше divert'a] fwd 127.0.0.1,8000 tcp from any to 217.21.42.220 8000 out via [внешний интерфейс]

> ipfw show
04080     629222     26940594 allow ip from 192.168.132.0/23 to 192.168.130.1
04090    1281595   1696854726 allow ip from 192.168.130.1 to 192.168.132.0/23
04100   15022651    974582066 allow udp from any to any dst-port 27015-27025 in
04200   15012228    974009415 allow udp from any to any dst-port 27015-27025 out
04300   14808936   2017041738 allow udp from any 27015-27025 to any in
04400   14807222   2016990883 allow udp from any 27015-27025 to any out
05000       8620      1097512 allow ip from any to any via lo0
05001          0            0 deny ip from any to 127.0.0.0/8
05002          0            0 deny ip from 127.0.0.0/8 to any
05010          0            0 allow udp from any 67 to 192.168.130.1 in via em1
05011          0            0 allow udp from 192.168.130.1 68 to any out via em1
05012          0            0 allow udp from any 67 to 192.168.132.1 in via em0
05013          0            0 allow udp from 192.168.132.1 68 to any out via em0
05020     570146     61265689 deny ip from 192.168.132.0/23 to 192.168.130.0/23
05021     686333     80098889 deny ip from 192.168.130.0/23 to 192.168.132.0/23
05030  721353744 247578917976 allow ip from 192.168.130.0/23 to any
05031  554422397 148530458588 allow ip from 192.168.132.0/23 to any
05032 1233914981 874321759083 allow ip from 217.21.42.0/24 to any
05033  175359760 203167458754 allow ip from 172.31.1.0/24 to any
05034    4898646    264544338 allow ip from 192.168.129.0/30 to any
05035        154        22842 allow ip from 172.16.0.0/16 to any
05036          0            0 allow ip from 192.168.168.0/21 to any
05037          0            0 allow ip from 192.168.176.0/21 to any
05038          0            0 allow ip from 192.168.184.0/21 to any
65535     399442     27128776 deny ip from any to any

ipfw add fwd 05040 127.0.0.1:8000 tcp from any to 217.21.42.220:8000 out via em2

natd_flags="-dynamic -f /etc/natd.conf"

redirect_port tcp 127.0.0.1:8000 8000

> ipfw add fwd 127.0.0.1,8000 tcp from any to 217.21.42.220 8000 out via em1
05138 fwd 127.0.0.1,8000 tcp from any to 217.21.42.220 dst-port 8000 out via em1
> ipfw add fwd 127.0.0.1,8000 tcp from any to 217.21.42.220 8000 out via em0
05238 fwd 127.0.0.1,8000 tcp from any to 217.21.42.220 dst-port 8000 out via em0
> ipfw add fwd 127.0.0.1,8000 tcp from any to 217.21.42.220 8000 out via em2
05338 fwd 127.0.0.1,8000 tcp from any to 217.21.42.220 dst-port 8000 out via em2

ipfw add deny log all from any to 217.21.42.220 8000 out

05138 deny log logamount 5 ip from any to 217.21.42.220 dst-port 8000 out

# -- sysinstall generated deltas -- # Mon Jan 25 19:52:24 2010
# Created: Mon Jan 25 19:52:24 2010
# Enable network daemons for user convenience.
# Please make all changes to this file, not to /etc/defaults/rc.conf.
# This file now contains just the overrides from /etc/defaults/rc.conf.
gateway_enable="YES"
hostname="192.168.132.1"
ifconfig_em2="inet 192.168.129.2 netmask 255.255.255.252 broadcast 192.168.129.3"
ifconfig_em0="inet 192.168.132.1 netmask 255.255.254.0"
ifconfig_em1="inet 192.168.130.1 netmask 255.255.254.0 broadcast 192.168.131.255"
static_routes="bn niks"          #h17 h16 h15 bntu h6"
route_bn="-net 172.31.1.0/24 192.168.129.1"
route_niks="-net 217.21.42.0/24 192.168.129.1"
#route_h17="-net 192.168.184.0/21 192.168.129.1"
#route_h16="-net 192.168.176.0/21 192.168.129.1"
#route_h15="-net 192.168.168.0/21 192.168.129.1"
#route_bntu="-net 172.16.0.0/16 192.168.129.1"
#route_h6="-net 192.168.136.0/21 192.168.129.1"
keymap="us.iso"
snmpd_enable="YES"
sendmail_none="YES"
ftpd_enable="YES"
mysql_enable="YES"
sshd_enable="YES"
dhcpd_enable="YES"
dhcpd_iface="em0 em1"
firewall_enable="YES"
firewall_script="/etc/rc.firewall"
apache22_enable="YES"
verlihub_enable="YES"
icecast_enable="YES"
linux_enable="YES"
named_enable="YES"
named_program="/usr/sbin/named"
named_flags="-u bind -c /etc/namedb/named.conf"
webmin_enable="YES"
openfire_enable="YES"
squid_enable="YES"
icecast2_enable="YES"
statd_enable="YES"
ventrilo_server_enable="YES"
mysql_server_enable="YES"
inetd_enable="YES"
natd_enable="YES"
natd_flags="-dynamic -f /etc/natd.conf"
firewall_quiet="YES"
tcp_extensions="NO"
tcp_drop_synfin="YES"
icmp_drop_redirect="YES"

ipfw="/sbin/ipfw"
if4="em1"
if3="em0"
ifi="em2"
host4="192.168.130.1"
host3="192.168.132.1"
net4="192.168.130.0/23"
net3="192.168.132.0/23"
netNiks="217.21.42.0/24"
netBn="172.31.1.0/24"
netRouter="192.168.129.0/30"
#netBNTU="172.16.0.0/16"
#net15="192.168.168.0/21"
#net16="192.168.176.0/21"
#net17="192.168.184.0/21"
setup_loopback () {
        ${ipfw} add 5000 pass all from any to any via lo0
        ${ipfw} add 5001 deny all from any to 127.0.0.0/8
        ${ipfw} add 5002 deny ip from 127.0.0.0/8 to any
}
setup_default() {
        ${ipfw} add 65535 deny ip from any to any
}
enable_our_network() {
        ${ipfw} add 5030 allow ip from ${net4} to any
        ${ipfw} add 5031 allow ip from ${net3} to any
        ${ipfw} add 5032 allow ip from ${netNiks} to any
        ${ipfw} add 5033 allow ip from ${netBn} to any
        ${ipfw} add 5034 allow ip from ${netRouter} to any
        #${ipfw} add 5035 allow ip from ${netBNTU} to any
        #${ipfw} add 5036 allow ip from ${net15} to any
        #${ipfw} add 5037 allow ip from ${net16} to any
        #${ipfw} add 5038 allow ip from ${net17} to any
}
setup_no_hostel3_to_hostel4() {
    ${ipfw} add 5020 deny ip from ${net4} to ${net3}
    ${ipfw} add 5021 deny ip from ${net3} to ${net4}
}
enable_host4_for_net3() {
        ${ipfw} add 4080 allow ip from ${net3} to ${host4}
          ${ipfw} add 4090 allow ip from ${host4} to ${net3}
}
dhcp_enable() {
        ${ipfw} add 5010 allow udp from any 67 to ${host4} in via ${if4}
        ${ipfw} add 5011 allow udp from ${host4} 68 to any out via ${if4}
        ${ipfw} add 5012 allow udp from any 67 to ${host3} in via ${if3}
        ${ipfw} add 5013 allow udp from ${host3} 68 to any out via ${if3}
}
counter_strike() {
    ${ipfw} add 4100 allow udp from any to any 27015-27025 in
    ${ipfw} add 4200 allow udp from any to any 27015-27025 out
    ${ipfw} add 4300 allow udp from any 27015-27025 to any in
    ${ipfw} add 4400 allow udp from any 27015-27025 to any out
}
start_firewall() {
        ${ipfw} -f flush
        setup_loopback
        setup_default
        dhcp_enable
        enable_our_network
        setup_no_hostel3_to_hostel4
          enable_host4_for_net3
    counter_strike
}
start_firewall

<icecast>
    <limits>
        <clients>100</clients>
        <sources>8</sources>
        <threadpool>5</threadpool>
        <queue-size>524288</queue-size>
        <client-timeout>30</client-timeout>
        <header-timeout>20</header-timeout>
        <source-timeout>15</source-timeout>
        <!-- If enabled, this will provide a burst of data when a client
             first connects, thereby significantly reducing the startup
             time for listeners that do substantial buffering. However,
             it also significantly increases latency between the source
             client and listening client.  For low-latency setups, you
             might want to disable this. -->
        <burst-on-connect>1</burst-on-connect>
        <!-- same as burst-on-connect, but this allows for being more
             specific on how much to burst. Most people won't need to
             change from the default 64k. Applies to all mountpoints  -->
        <burst-size>65535</burst-size>
    </limits>
    <authentication>
        <!-- Sources log in with username 'source' -->
        <source-password>hackme</source-password>
        <!-- Relays log in username 'relay' -->
        <relay-password>hackme</relay-password>
        <!-- Admin logs in with the username given below -->
        <admin-user>admin</admin-user>
        <admin-password>104124</admin-password>
    </authentication>
    <!-- set the mountpoint for a shoutcast source to use, the default if not
         specified is /stream but you can change it here if an alternative is
         wanted or an extension is required
    <shoutcast-mount>/live.nsv</shoutcast-mount>
    -->
    <!-- Uncomment this if you want directory listings -->
    <!--
    <directory>
        <yp-url-timeout>15</yp-url-timeout>
        <yp-url>http://dir.xiph.org/cgi-bin/yp-cgi</yp-url>
    </directory>
     -->
    <!-- This is the hostname other people will use to connect to your server.
    It affects mainly the urls generated by Icecast for playlists and yp
    listings. -->
    <hostname>localhost</hostname>
    <!-- You may have multiple <listener> elements -->
    <listen-socket>
        <port>8000</port>
        <!--<bind-address>192.168.130.1</bind-address> -->
        <!-- <shoutcast-mount>/stream</shoutcast-mount> -->
    </listen-socket>
    <!--<master-server>127.0.0.1</master-server>-->
    <!--<master-server-port>8001</master-server-port>-->
    <!--<master-update-interval>120</master-update-interval>-->
    <!--<master-password>hackme</master-password>-->
    <!-- setting this makes all relays on-demand unless overridden, this is
         useful for master relays which do not have <relay> definitions here.
         The default is 0 -->    <!--<relays-on-demand>1</relays-on-demand>-->
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/alpha</mount>
        <local-mount>/alpha</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    
    <relay>
    <server>radio.niks.by</server>
    <port>8000</port>
    <mount>/aplus</mount>
    <local-mount>/aplus</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/love-dance</mount>
    <on-demand>1</on-demand>
        <local-mount>/love-dance</local-mount>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/unistar</mount>
        <local-mount>/unistar</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/europa+</mount>
        <local-mount>/europa+</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/radio-record</mount>
        <local-mount>/radio-record</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/love-radio</mount>
        <local-mount>/love-radio</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/novoeradio</mount>
    <on-demand>1</on-demand>
        <local-mount>/novoeradio</local-mount>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/retro-fm</mount>
        <local-mount>/retro-fm</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/nashe</mount>
        <local-mount>/nashe</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
  
     <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/aplus-hiphop</mount>
        <local-mount>/aplus-hiphop</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/aplus-russian</mount>
        <local-mount>/aplus-russian</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/aplus-relax</mount>
        <local-mount>/aplus-relax</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    <relay>
        <server>radio.niks.by</server>
        <port>8000</port>
        <mount>/aplus-rock</mount>
        <local-mount>/aplus-rock</local-mount>
    <on-demand>1</on-demand>
        <relay-shoutcast-metadata>1</relay-shoutcast-metadata>
    </relay>
    <!-- Only define a <mount> section if you want to use advanced options,
         like alternative usernames or passwords
    <mount>
        <mount-name>/example-complex.ogg</mount-name>
        <username>othersource</username>
        <password>hackmemore</password>
        <max-listeners>1</max-listeners>
        <dump-file>/tmp/dump-example1.ogg</dump-file>
        <burst-size>65536</burst-size>
        <fallback-mount>/example2.ogg</fallback-mount>
        <fallback-override>1</fallback-override>
        <fallback-when-full>1</fallback-when-full>
        <intro>/example_intro.ogg</intro>
        <hidden>1</hidden>
        <no-yp>1</no-yp>
        <authentication type="htpasswd">
                <option name="filename" value="myauth"/>
                <option name="allow_duplicate_users" value="0"/>
        </authentication>
        <on-connect>/home/icecast/bin/stream-start</on-connect>
        <on-disconnect>/home/icecast/bin/stream-stop</on-disconnect>
    </mount>
    <mount>
        <mount-name>/auth_example.ogg</mount-name>
        <authentication type="url">
            <option name="mount_add"       value="http://myauthserver.net/notify_mount.php"/>
            <option name="mount_remove"    value="http://myauthserver.net/notify_mount.php"/
            <option name="listener_add"    value="http://myauthserver.net/notify_listener.php"/>
            <option name="listener_remove" value="http://myauthserver.net/notify_listener.php"/>
        </authentication>
    </mount>
    -->
    <fileserve>1</fileserve>
    <paths>
        <!-- basedir is only used if chroot is enabled -->
        <basedir>/usr/local/share/icecast</basedir>
        <!-- Note that if <chroot> is turned on below, these paths must both
             be relative to the new root, not the original root -->
        <logdir>/var/log/icecast</logdir>
        <webroot>/usr/local/share/icecast/web</webroot>
        <adminroot>/usr/local/share/icecast/admin</adminroot>
        <!-- <pidfile>/usr/local/share/icecast/icecast.pid</pidfile> -->
        <!-- Aliases: treat requests for 'source' path as being for 'dest' path
             May be made specific to a port or bound address using the "port"
             and "bind-address" attributes.
          -->
        <!--
        <alias source="/foo" dest="/bar"/>
          -->
        <!-- Aliases: can also be used for simple redirections as well,
             this example will redirect all requests for http://server:port/ to
             the status page
          -->
        <alias source="/" dest="/status.xsl"/>
    </paths>
    <logging>
        <accesslog>access.log</accesslog>
        <errorlog>error.log</errorlog>
        <!-- <playlistlog>playlist.log</playlistlog> -->
          <loglevel>3</loglevel> <!-- 4 Debug, 3 Info, 2 Warn, 1 Error -->
          <logsize>10000</logsize> <!-- Max size of a logfile -->
        <!-- If logarchive is enabled (1), then when logsize is reached
             the logfile will be moved to [error|access|playlist].log.DATESTAMP,
             otherwise it will be moved to [error|access|playlist].log.old.
             Default is non-archive mode (i.e. overwrite)
        -->
        <!-- <logarchive>1</logarchive> -->
    </logging>
    <security>
        <chroot>0</chroot>
        <changeowner>
            <user>icecast</user>
            <group>icecast</group>
        </changeowner>
    </security>
</icecast>

<relay>
        <server>radio.niks.by</server>
        <port>8000</port>

05024   25176    1322353 allow ip from any to 217.21.42.220 via em2
05025       0          0 deny ip from any to 217.21.42.220 dst-port 8000 out
05026     535      25444 deny ip from any to 217.21.42.220 dst-port 8000 in
05027   47223   59650066 allow ip from 217.21.42.220 to any via em2
05028       0          0 deny ip from 217.21.42.220 to any dst-port 8000 out
05029       0          0 deny ip from 217.21.42.220 to any dst-port 8000 in