ICMP Destination Unreachable 的问题,紧急求助

weixin_38073293 2006-08-22 11:36:56

OPBENBSD+PF做NAT
PF.CONF
:
ext_if="em1"
int_if="em0"
table <spamd> persist
table <spamd-white> persist
set skip on lo
scrub in
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
nat on em1 from any to any -> (em1)
#rdr on em0 inet proto tcp from 61.234.228.139 to any port 80 -> 127.0.0.1 port 3128
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
rdr pass on $ext_if proto tcp from <spamd> to port smtp \
      -> 127.0.0.1 port spamd
rdr pass on $ext_if proto tcp from !<spamd-white> to port smtp \
      -> 127.0.0.1 port spamd
rdr pass on $ext_if proto tcp from any to port 21 \
      -> 127.0.0.1 port 8021
anchor "ftp-proxy/*"
#block in
pass out keep state
pass quick on $int_if
antispoof quick for { lo $int_if }
pass in on $ext_if proto tcp to ($ext_if) port ssh keep state
pass in log on $ext_if proto tcp to ($ext_if) port smtp keep state
pass out log on $ext_if proto tcp from ($ext_if) to port smtp keep state

IFCONFIG
:
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33224
      groups: lo
      inet 127.0.0.1 netmask 0xff000000
      inet6 ::1 prefixlen 128
      inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
      lladdr 00:04:23:b4:42:16
      media: Ethernet autoselect (100baseTX full-duplex)
      status: active
      inet 192.168.88.2 netmask 0xffffff00 broadcast 192.168.88.255
      inet6 fe80::204:23ff:feb4:4216%em0 prefixlen 64 scopeid 0x1
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
      lladdr 00:0e:0c:a1:bd:7a
      groups: egress
      media: Ethernet autoselect (100baseTX full-duplex)
      status: active
      inet 222.240.132.149 netmask 0xffffff00 broadcast 222.240.132.255
      inet6 fe80::20e:cff:fea1:bd7a%em1 prefixlen 64 scopeid 0x2
      inet 222.240.132.150 netmask 0xffffff00 broadcast 222.240.132.255
      inet 222.240.132.151 netmask 0xffffff00 broadcast 222.240.132.255
      inet 222.240.132.152 netmask 0xffffff00 broadcast 222.240.132.255
      inet 222.240.132.153 netmask 0xffffff00 broadcast 222.240.132.255
      inet 222.240.132.154 netmask 0xffffff00 broadcast 222.240.132.255
      inet 222.240.132.155 netmask 0xffffff00 broadcast 222.240.132.255
      inet 222.240.132.156 netmask 0xffffff00 broadcast 222.240.132.255
      inet 222.240.132.157 netmask 0xffffff00 broadcast 222.240.132.255
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33224
pfsync0: flags=0<> mtu 1460
      groups: carp
enc0: flags=0<> mtu 1536

ROUTE
:
Destination       Gateway          Flags Refs    Use Mtu  Interface
default          222.240.132.145 UGS       1 36462524    - em1
61.234/15       192.168.88.1    UGS       0  1456600    - em0
loopback          localhost       UGRS       0       0  33224 lo0
localhost       localhost       UH       9    72  33224 lo0
192.168.88/24    link#1          UC       3       0    - em0
192.168.88.1    00:09:11:da:08:ab  UHLc       2       0    - em0
192.168.88.2    00:04:23:b4:42:16  UHLc       0    1570    - lo0
192.168.88.6    00:09:11:da:08:ab  UHLc       0 12669    - em0
222.51/16       192.168.88.1    UGS       1 47460853    - em0
222.240.132/24    link#2          UC       2       0    - em1
222.240.132.145 00:12:80:b7:b6:00  UHLc       1    30    - em1
nat             00:0e:0c:a1:bd:7a  UHLc       0    38    - lo0
222.240.132.150 localhost       UGHS       0    92  33224 lo0
222.240.132.151 localhost       UGHS       0    24  33224 lo0
222.240.132.152 localhost       UGHS       0       6  33224 lo0
222.240.132.153 localhost       UGHS       0    30  33224 lo0
222.240.132.154 localhost       UGHS       0    32  33224 lo0
222.240.132.155 localhost       UGHS       0    104  33224 lo0
222.240.132.156 localhost       UGHS       0    32  33224 lo0
222.240.132.157 localhost       UGHS       0    25  33224 lo0
BASE-ADDRESS.MCAST localhost       URS       0       0  33224 lo0

但是我在客户端下的PING DNS出现下面情况

>> Main# ping 202.103.96.112 32
[host 202.103.96.112, max tries 32, delay 1000 msec]
#0 got ICMP Destination Unreachable from 192.168.88.2.
202.103.96.112: #1 timed out.
#0 got ICMP Destination Unreachable from 192.168.88.2.
202.103.96.112: #2 timed out.
#0 got ICMP Destination Unreachable from 192.168.88.2.
202.103.96.112: #3 timed out.
202.103.96.112: #4 timed out.
202.103.96.112: #5 timed out.
#0 got ICMP Destination Unreachable from 192.168.88.2.
202.103.96.112: #6 timed out.
#0 got ICMP Destination Unreachable from 192.168.88.2.
202.103.96.112: #7 timed out.
202.103.96.112: #8 ok, RTT 4 msec.
202.103.96.112: #9 ok, RTT 5 msec.
202.103.96.112: #10 ok, RTT 3 msec.
202.103.96.112: #11 ok, RTT 4 msec.
202.103.96.112: #12 ok, RTT 4 msec.
202.103.96.112: #13 ok, RTT 3 msec.
202.103.96.112: #14 ok, RTT 4 msec.

请求各位大大紧急帮助

...全文