用freebsd的ipfilter做防火墻的問題？

yyweng

freebsd下的ipfilter只要沒有一個網段長時間沒有流量。當再次上外網時，就不能.上網，只要同一個網段內的一臺計算機ping一下電信的網關，就可以上網了。我是用固定IP上網。下面是ipf.rules的配置：
pass in all
pass out all
block in quick from 10.43.168.215/32 to any keep state
block in quick from 10.43.168.137/32 to any keep state
block in quick from 10.43.168.136/32 to any keep state
block in quick from 10.43.168.232/32 to any keep state
block in quick from 10.43.168.236/32 to any keep state
block in quick from 10.43.168.243/32 to any keep state
block in quick from 10.43.168.225/32 to any keep state
block in quick from 10.43.168.235/32 to any keep state
block in quick from 10.43.168.223/32 to any keep state
block in quick from 10.43.168.139/32 to any keep state
block in quick from 10.43.168.110/32 to any keep state
block in log quick all with short
block in log quick all with ipopts
block in log quick all with frag
block in log quick all with opt lsrr
pass out on vr0 all
pass in on vr0 all
pass out on rl0 all
pass in on rl0 all
block out on bfe0 all
pass out log on bfe0 proto tcp/udp all keep state
pass out log on bfe0 proto icmp all keep state
pass in quick on bfe0 proto tcp from any to any port=53 keep state
pass in quick on bfe0 proto tcp from any to any port=ftp flags S/SA keep state
pass in quick on bfe0 proto tcp from any to any port=ftp-data flags S/SA keep state
pass in quick on bfe0 proto tcp from any to any port 30000 >< 50001 flags S/SA keep state

[ 本帖最后由 yyweng 于 2008-5-8 15:12 編輯 ]

yyweng

當發(fā)生這個問題時，我可以ping通本網段的網關，和其他網段。用putty可以登陸到防火墻上，并且防火墻可以訪問外網。但客戶端必須ping電信的網關地地址，感覺想是要激活連接本網段網關的網卡似的。

feillex

網絡結構是怎樣的？

yyweng

網絡結構，此防火墻有3塊網卡(bfe0,vr0,rl0),bfe0連接到公網，vr0連接10.43.168.0/24網段，rl0下面連接10.143.162.0/24的網段。

yyweng

誰來幫我解決一下這個問題啊。求你們了。。。。。

yyweng

求求你們了

feillex

1. 
   
2. block out on bfe0 all
   
3. pass out log on bfe0 proto tcp/udp all keep state
   
4. pass out log on bfe0 proto icmp all keep state
   

復制代碼

有了第一條，后邊兩條沒用啊。
去掉第一條試試

yyweng

我去掉了block out on bfe0 all還是不行，但我發(fā)現一個問題，我們客戶端上不了后，我到防火墻上去后ping域名時，也不行，只有ping下電信的網關就可以了。就是感覺沒有流量出去后，就感覺出去的端口變?yōu)榇龣C狀態(tài)，要PING一下電信的網關才能將它激活。請高手指點一下。謝謝。求你們了。。。。。。

yyweng

有人嗎，幫個忙吧。求你們了。。。。。。。。

feillex

監(jiān)控防火墻日志�？纯纯蛻舳藷o法上網時，是那條規(guī)則起作用。