RFC 3330

Кстати, часто встречающийся вопрос пользователя, когда он прибегает с проблемами с сетью. Ну и плюс про эту сеть надо знать любому системному администратору:
#########################
## filter bogus ip ##
#########################

# Stop traffic TO RFC1918 nets (client_net only on the outside interface!)
$fwcmd add 030 deny log logamount 50 ip from any to 10.0.0.0/8, 172.16.0.0/12
$fwcmd add 032 deny log logamount 50 ip from any to 192.168.0.0/16 via ${out2_ip}

# "This" Network, RFC1700
${fwcmd} add 033 deny log logamount 50 ip from any to 0.0.0.0/8
# TO LINKLOCAL RFC 3330 (DHCP auto-configuration)
${fwcmd} add 034 deny log logamount 50 ip from any to 169.254.0.0/16
# TO TEST-NET RFC 3330
${fwcmd} add 035 deny log logamount 50 ip from any to 192.0.2.0/24
# TO Benchmark-NET RFC 2544
${fwcmd} add 036 deny log logamount 50 ip from any to 198.18.0.0/15
# allow ospf
${fwcmd} add 037 allow ip from any to 224.0.0.5
# sliently discard MULTICAST (class D) and class E, RFC 3330 including broadcasts
${fwcmd} add 038 deny ip from any to 224.0.0.0/4, 240.0.0.0/5

# Stop traffic FROM RFC1918 nets
# don't filter client_net, which will be translated latter
$fwcmd add 040 deny log logamount 50 ip from 10.0.0.0/8, 172.16.0.0/12 to any

# Stop "This" Network, RFC1700
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E),
# RFC 3330 nets on the outside interface
$fwcmd add 041 deny log logamount 50 ip from 0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 198.18.0.0/15 to any