Fli4l und 3 interne Netze

erstens:
IP_NET_N='3' # number of IP ethernet networks, usually 1
IP_NET_1='192.168.100.1/24' # IP address of your n'th ethernet card and
IP_NET_2='192.168.99.1/24'
IP_NET_3='192.168.168.1/24' # netmask in CIDR (no. of set bits)
IP_NET_1_DEV='eth0' # required: device name like ethX
IP_NET_2_DEV='eth0'
IP_NET_3_DEV='eth0'

PF_NEW_CONFIG='yes' # new style packet filter config

PF_INPUT_POLICY='DROP' # be nice and use reject as policy
PF_INPUT_ACCEPT_DEF='yes' # use default rule set
PF_INPUT_LOG='no' # don't log anything
PF_INPUT_LOG_LIMIT='3/minute:5'
PF_INPUT_REJ_LIMIT='1/second:5'
PF_INPUT_UDP_REJ_LIMIT='1/second:5'
PF_INPUT_N='1'
PF_INPUT_1='IP_NET_1 ACCEPT'
PF_INPUT_2='IP_NET_2 reject'
PF_INPUT_3='IP_NET_3 reject'

PF_FORWARD_POLICY='DROP' # be nice and use reject as policy
PF_FORWARD_ACCEPT_DEF='yes' # use default rule set
PF_FORWARD_LOG='no' # don't log anything
PF_FORWARD_LOG_LIMIT='3/minute:5' # log 3 events per minute; allow a
PF_FORWARD_REJ_LIMIT='1/second:5' # reject 1 connection per second; allow
PF_FORWARD_UDP_REJ_LIMIT='1/second:5' # reject 1 udp packet per second;
PF_FORWARD_N='1'
#PF_FORWARD_1='tmpl:samba DROP' # drop samba traffic if it tries
PF_FORWARD_1='IP_NET_1 ACCEPT' # accept everything else
PF_FORWARD_2='IP_NET_2 ACCEPT' # accept everything else
PF_FORWARD_3='IP_NET_3 ACCEPT' # accept everything else


PF_POSTROUTING_N='3'
PF_POSTROUTING_1='IP_NET_1 MASQUERADE' # masquerade traffic leaving
PF_POSTROUTING_2='IP_NET_2 MASQUERADE' # masquerade traffic leaving
PF_POSTROUTING_3='IP_NET_3 MASQUERADE' # masquerade traffic leaving
PF_PREROUTING_N='0'
PF_PREROUTING_1='1.2.3.4 dynamic:22 DNAT:@client2'

PF_USR_CHAIN_N='0'

#------------------------------------------------------------------------------

1. Old style packet filter config - set PF_NEW_CONFIG='no' to use
2. this version

#------------------------------------------------------------------------------

1. PF_NEW_CONFIG='yes' # use old style packet filter config

#--------------------------------------------------------------------------

1. Known networks - Networks which are allowed to pass the packet
2. filter (additional restrictions may be applied via black/white
3. lists, port based filters, port forwarding opens additional holes, ...)

#--------------------------------------------------------------------------
MASQ_NETWORK='192.168.0.0./16' # networks to masquerade (e.g. our LAN)
ROUTE_NETWORK='' # same as masq_network, but packets
TRUSTED_NETS='' # allow free and unmasqueraded
#--------------------------------------------------------------------------

1. Host based restrictions: internal hosts to allow/deny forwarding


1. FORWARD_HOST_WHITE='no' describes a black list (forbidden)
2. FORWARD_HOST_WHITE='yes' describes a white list (allowed)


1. Example:
2. FORWARD_HOST_WHITE='no' and FORWARD_HOST_N='0':
3. -> forwarding of 0 hosts is denied
4. -> forwarding of all hosts is allowed
#--------------------------------------------------------------------------
FORWARD_HOST_WHITE='no' # 'no': black list, 'yes': white list
FORWARD_HOST_N='0' # number of allowed/denied hosts
FORWARD_HOST_1='192.168.6.5' # optional: 1st allowed/denied host
FORWARD_HOST_2='@client2' # optional: 2nd allowed/denied host

#--------------------------------------------------------------------------

1. Port based restrictions: ports to reject/deny forwarding
#--------------------------------------------------------------------------
FORWARD_DENY_PORT_N='3' # no. of ports to reject/deny
FORWARD_DENY_PORT_1='139 REJECT-TCP' # reject forwarding of netbios
FORWARD_DENY_PORT_2='445 REJECT-TCP'
FORWARD_DENY_PORT_3='137-138 REJECT-UDP'

#--------------------------------------------------------------------------

1. Accept connections from outside to several ports (served ports)
#--------------------------------------------------------------------------
INPUT_POLICY='REJECT' # be nice and use reject as policy
INPUT_ACCEPT_PORT_N='0' # no. of ports to accept from outside
INPUT_ACCEPT_PORT_1='22 TCP' # e.g. allow connection to ssh service

#--------------------------------------------------------------------------

1. Logging
#--------------------------------------------------------------------------
PACKETFILTER_LOG='no' # log access to rejected/denied ports

zweitens: Open VPN habe ich von extern schon am laufen. Aber intern möchte ich eigentlich das windows interne PPTP bzw. L2TP da mein hauptsächlich mein WLAN fähiges PAD auf das Firmennetz zugreifen sollte um mails abzugleichen.

Funktionieren tut folgendes:

OPEN VPN von aussen ins Büronetz
Internetzugang aus allen 3 Netzen
Zugriff der Netze untereinander ---->>>>>>> und das darf nicht !!!

gar nicht gehen tut das VPN aus dem privaten Netz ins Büronetz.