日本免费全黄少妇一区二区三区-高清无码一区二区三区四区-欧美中文字幕日韩在线观看-国产福利诱惑在线网站-国产中文字幕一区在线-亚洲欧美精品日韩一区-久久国产精品国产精品国产-国产精久久久久久一区二区三区-欧美亚洲国产精品久久久久

  1. 首頁(yè) > 云知道 > >

使用IPFILTER設(shè)置小型企業(yè)防火墻系統(tǒng)

云知道

使用IPFILTER設(shè)置小型企業(yè)防火墻系統(tǒng)
作者：peijun.jiang
一、 網(wǎng)絡(luò)環(huán)境
1、主機(jī)A：安裝FreeBSD4.7，安裝三塊網(wǎng)卡fxp0、xl0和xl1 。
fxp0為對(duì)外網(wǎng)卡，IP：x.x.x.x ISP為我提供的IP地址
xl0為對(duì)內(nèi)公共區(qū)域網(wǎng)卡，IP：192.168.0.1
xl1為對(duì)內(nèi)服務(wù)提供區(qū)域網(wǎng)卡，IP：192.168.80.1
2、主機(jī)B：對(duì)外提供www服務(wù)主機(jī)，ip地址為：192.168.80.80
3、主機(jī)C：對(duì)外提供ftp服務(wù)主機(jī)，ip：192.168.80.3 。
4、其他工作站N臺(tái) 。
二、編譯內(nèi)核

1、#cd /sys/i386/conf
#cp GENERIC kernel_IPF

2、編譯kernel_IPF,加入一下選項(xiàng)：
options IPFILTER
options IPFILTER_LOG
options IPFILTER_DEFAULT_BLOCK

3、#/usr/sbin/config kernel_IPF
#cd ../../compile/kernel_IPF
#make kepend
#make
#make install

4、編輯/etc/rc.rc.conf,打開(kāi)以下選項(xiàng)：
defaultrouter="x.x.x.1" x.x.x.1為ISP提供的網(wǎng)關(guān)
gateway_enable="YES"
ipfilter_enable＝"YES"
ipnat_enable="YES"
5、重新啟動(dòng)系統(tǒng)：reboot
三、配置防火墻

1、 設(shè)置地址轉(zhuǎn)換ipnat 。在/etc下新建文件ipnat.rules,內(nèi)容為：
map fxp0 192.168.0.0/16 -> 0/32 proxy port ftp ftp/tcp
map fxp0 192.168.0.0/24 -> 0/32 portmap tcp/udp 10000:30000
map fxp0 192.168.0.0/24 -> 0/32
map fxp0 192.168.80.0/24 -> 0/32 portmap tcp/udp 300001:60000
map fxp0 192.168.80.0/24 -> 0/32 portmap
rdr fxp0 x.x.x.x/32 port 80 -> 192.168.0.2 port 80
rdr fxp0 x.x.x.x/32 port ftp -> 192.168.0.3 port ftp
rdr fxp0 x.x.x.x/32 port 30001-50000 -> 192.168.80.3 port 30001 tcp

2、設(shè)置包過(guò)濾ipfilter 。在/etc下新建文件ipf.rules,內(nèi)容為：
block in log quick all with short
block in log quick all with ipopts
block in log quick all with frag
block in log quick all with opt lsrr
block in log quick all with opt ssrr

以上五句為過(guò)濾掉可能會(huì)帶來(lái)安全問(wèn)題的短數(shù)據(jù)包或具備路由信息的數(shù)據(jù)包以及防止非法掃描服務(wù)器

pass out on xl0 all
pass in on xlo all
pass out on xl1 all
pass in on xl1 all
pass out quick on lo0 all
pass in quick on lo0 all
以上為內(nèi)部網(wǎng)絡(luò)界面和loopback網(wǎng)絡(luò)界面可以自由發(fā)送和接受數(shù)據(jù)包

block out on fxp0 all
以上為屏蔽外部網(wǎng)絡(luò)界面向外發(fā)送數(shù)據(jù)包

block out log on fxp0 from any to 192.168.0.0/16
block out log quick on fxp0 from any to 0.0.0.0/8
block out log quick on fxp0 from any to 169.254.0.0/8
block out log quick on fxp0 from any to 10.0.0.0/8
block out log quick on fxp0 from any to 127.16.0.0/12
block out log quick on fxp0 from any to 127.0.0.0/8
block out log quick on fxp0 from any to 192.0.2.0/24
block out log quick on fxp0 from any to 204.152.64.0/23
block out log quick on fxp0 from any to 224.0.0.0/3
以上為屏蔽不合法地址的輸出數(shù)據(jù)

pass out log on fxp0 proto tcp/udp from any to any keep state
pass out log on fxp0 proto icmp all keep state
以上為允許TCP 、UDP、ICMP數(shù)據(jù)包向外發(fā)送出去，并且允許回應(yīng)數(shù)據(jù)包發(fā)送回到內(nèi)部網(wǎng)絡(luò)

block in log on fxp0 from 192.168.0.0/16 to any
block in log quick on fxp0 from 10.0.0.0/8 to any
block in log quick on fxp0 from 172.16.0.0/12 to any
block in log quick on fxp0 from 127.0.0.0/8 to any
block in log quick on fxp0 from 192.0.2.0/24 to any
block in log quick on fxp0 from 169.254.0.0/16 to any
block in log quick on fxp0 from 224.0.0.0/3 to any
block in log quick on fxp0 from 204.152.64.0/23 to any
block in log quick on fxp0 from x.x.x.x/32 to any
block in log quick on fxp0 from any to x.x.x.0/32
block in log quick on fxp0 from any to x.x.x.255/32
以上為屏蔽具備內(nèi)部網(wǎng)絡(luò)地址的數(shù)據(jù)包被轉(zhuǎn)發(fā)到外部網(wǎng)絡(luò)

pass in quick on fxp0 proto tcp from any to any port = 80 flags S/SA keep state
pass in quick on fxp0 proto tcp from any to any port = ftp flags S/SA keep state
pass in quick on fxp0 proto tcp from any to any port = ftp-data flags S/SA keep state

推薦閱讀