30.5 IPFILTER (IPF) ·À»ðǽ

¡¡¡¡IPFILTER µÄ×÷ÕßÊÇ Darren Reed¡£ IPFILTER ÊǶÀÁ¢ÓÚ²Ù×÷ϵͳµÄ£º ËüÊÇÒ»¸ö¿ª·ÅÔ´´úÂëµÄÓ¦Ó㬠²¢ÇÒÒѾ­±»ÒÆÖ²µ½ÁË FreeBSD¡¢ NetBSD¡¢ OpenBSD¡¢ SunOS¡¢ HP/UX£¬ ÒÔ¼° Solaris ²Ù×÷ϵͳÉÏ¡£ IPFILTER µÄÖ§³ÖºÍά»¤¶¼Ï൱»îÔ¾£¬ ²¢ÇÒÓйæÂɵط¢²¼¸üа汾¡£

¡¡¡¡IPFILTER ÌṩÁËÄÚºËģʽµÄ·À»ðǽºÍ NAT »úÖÆ£¬ ÕâЩ»úÖÆ¿ÉÒÔͨ¹ýÓû§Ä£Ê½ÔËÐеĽӿڳÌÐò½øÐмàÊӺͿØÖÆ¡£ ·À»ðǽ¹æÔò¿ÉÒÔʹÓà ipf(8) ¹¤¾ßÀ´¶¯Ì¬µØÉèÖúÍɾ³ý¡£ NAT ¹æÔò¿ÉÒÔͨ¹ý ipnat(1) ¹¤¾ßÀ´Î¬»¤¡£ ipfstat(8) ¹¤¾ßÔò¿ÉÒÔÓÃÀ´ÏÔʾ IPFILTER Äں˲¿·ÖµÄͳ¼ÆÊý¾Ý¡£ ×îºó£¬ ʹÓà ipmon(8) ³ÌÐò¿ÉÒÔ°Ñ IPFILTER µÄ¶¯×÷¼Ç¼µ½ÏµÍ³ÈÕÖ¾ÎļþÖС£

¡¡¡¡IPF ×î³õÊÇʹÓÃÒ»×é ¡°ÒÔ×îºóÆ¥ÅäµÄ¹æÔòΪ׼¡± µÄ²ßÂÔÀ´ÊµÏֵģ¬ ÕâÖÖ·½Ê½Ö»ÄÜÖ§³ÖÎÞ״̬µÄ¹æÔò¡£ Ëæ×Åʱ´úµÄ½ø²½£¬ IPF ±»Öð½¥ÔöÇ¿£¬ ²¢¼ÓÈëÁË ¡°quick¡± Ñ¡Ï ÒÔ¼°Ö§³Ö״̬µÄ ¡°keep state¡± Ñ¡Ï ÕâʹµÃ¹æÔò´¦ÀíÂß¼­±äµÃ¸ü¸»ÓÐÏÖ´úÆøÏ¢¡£ IPF µÄ¹Ù·½ÎĵµÖ»½éÉÜÁË´«Í³µÄ¹æÔò±àд·½·¨ºÍÎļþ´¦ÀíÂß¼­¡£ ÐÂÔöµÄ¹¦ÄÜÖ»ÊÇ×÷ΪһЩ¸½¼ÓµÄÑ¡Ïî³öÏÖ£¬ Èç¹ûÄÜÍêÈ«Àí½âÕâЩ¹¦ÄÜ£¬ Ôò¶ÔÓÚ½¨Á¢¸ü°²È«µÄ·À»ðǽ¾ÍºÜÓкô¦¡£

¡¡¡¡ÕâÒ»½ÚÖÐÖ÷ÒªÊÇÕë¶Ô ¡°quick¡± Ñ¡Ï ÒÔ¼°Ö§³Ö״̬µÄ ¡°keep state¡± Ñ¡ÏîµÄ½éÉÜ¡£ ÕâÊÇÃ÷ʾÔÊÐí·À»ðǽ¹æÔò¼¯×î»ù±¾µÄ±àÐ´ÒªËØ¡£

¡¡¡¡Òª»ñµÃ¹ØÓÚ´«Í³¹æÔò´¦Àí·½Ê½µÄÏêϸÐÅÏ¢£¬ Çë²Î¿¼£º http://www.obfuscation.org/ipf/ipf-howto.html#TOC_1 ÒÔ¼° http://coombs.anu.edu.au/~avalon/ip-filter.html¡£

¡¡¡¡IPF FAQ ¿ÉÒÔÔÚ http://www.phildev.net/ipf/index.html ÕÒµ½¡£

¡¡¡¡³ý´ËÖ®Í⣬ Äú»¹¿ÉÒÔÔÚ http://marc.theaimsgroup.com/?l=ipfilter ÕÒµ½¿ª·ÅÔ´´úÂëµÄ IPFilter µÄÓʼþÁÐ±í´æµµ£¬ ²¢½øÐÐËÑË÷¡£

30.5.1 ÆôÓÃ IPF

¡¡¡¡IPF ×÷Ϊ FreeBSD »ù±¾°²×°µÄÒ»²¿·Ö£¬ ÒÔÒ»¸ö¶ÀÁ¢µÄÄÚºËÄ£¿éµÄÐÎʽÌṩ¡£ Èç¹ûÔÚ rc.conf ÖÐÅäÖÃÁË ipfilter_enable="YES"£¬ ϵͳ¾Í»á×Ô¶¯µØ¶¯Ì¬¼ÓÔØ IPF ÄÚºËÄ£¿é¡£ Õâ¸öÄÚºËÄ£¿éÔÚ´´½¨Ê±ÆôÓÃÁËÈÕÖ¾Ö§³Ö£¬ ²¢¼ÓÈëÁË default pass all Ñ¡Ïî¡£ Èç¹ûÖ»ÊÇÐèÒª°ÑĬÈϵĹæÔòÉèÖÃΪ block all µÄ»°£¬ ¾Í²»ÐèÒª°Ñ IPF ±àÒëµ½ÄÚºËÖС£ ¼òµ¥µØÍ¨¹ý°Ñ block all ÕâÌõ¹æÔò¼ÓÈë×Ô¼ºµÄ¹æÔò¼¯À´´ïµ½Í¬ÑùµÄÄ¿µÄ¡£

30.5.2 ÄÚºËÑ¡Ïî

¡¡¡¡ÏÂÃæÕâЩ FreeBSD Äں˱àÒëÑ¡Ïî²¢²»ÊÇÆôÓà IPF Ëù±ØÐèµÄ¡£ ÕâÀïÖ»ÊÇ×÷Ϊ±³¾°ÖªÊ¶À´¼ÓÒÔ²ûÊö¡£ Èç¹û½« IPF ±àÈëÁËÄںˣ¬ Ôò¶ÔÓ¦µÄÄÚºËÄ£¿é½«²»±»Ê¹Óá£

¡¡¡¡¹ØÓÚ IPF Ñ¡ÏîÓï¾äµÄÄں˱àÒëÅäÖõÄÀý×Ó£¬ ¿ÉÒÔÔÚÄÚºËÔ´´úÂëÖÐµÄ /usr/src/sys/conf/NOTES ÕÒµ½¡£ ´Ë´¦ÁоÙÈçÏ£º

options IPFILTER
options IPFILTER_LOG
options IPFILTER_DEFAULT_BLOCK

¡¡¡¡options IPFILTER ÓÃÓÚÆôÓà ¡°IPFILTER¡± ·À»ðǽµÄÖ§³Ö¡£

¡¡¡¡options IPFILTER_LOG ÓÃÓÚÆôÓà IPF µÄÈÕÖ¾Ö§³Ö£¬ ËùÓÐÆ¥ÅäÁ˰üº¬ log µÄ¹æÔòµÄ°ü£¬ ¶¼»á±»¼Ç¼µ½ ipl Õâ¸ö°ü¼Ç¼α©¤©¤É豸ÖС£

¡¡¡¡options IPFILTER_DEFAULT_BLOCK ½«¸Ä±ä·À»ðǽµÄĬÈ϶¯×÷£¬ ½ø¶ø£¬ ËùÓв»Æ¥Åä·À»ðǽµÄ pass ¹æÔòµÄ°ü¶¼»á±»×èÖ¹¡£

¡¡¡¡ÕâЩѡÏîÖ»ÓÐÔÚÄúÖØÐ±àÒë²¢°²×°ÁËÉÏÊöÅäÖõÄÄÚºËÖ®ºó²Å»áÉúЧ¡£

30.5.3 ¿ÉÓÃµÄ rc.conf Ñ¡Ïî

¡¡¡¡ÒªÔÚÆô¶¯Ê±¼¤»î IPF£¬ ÐèÒªÔÚ /etc/rc.conf ÖÐÔö¼ÓÏÂÃæµÄÉèÖãº

ipfilter_enable="YES"             # Æô¶¯ ipf ·À»ðǽ
ipfilter_rules="/etc/ipf.rules"   # ½«±»¼ÓÔØµÄ¹æÔò¶¨Ò壬 ÕâÊÇÒ»¸öÎı¾Îļþ
ipmon_enable="YES"                # Æô¶¯ IP ¼àÊÓÈÕÖ¾
ipmon_flags="-Ds"                 # D = ×÷Ϊ·þÎñ³ÌÐòÆô¶¯
                                  # s = ʹÓà syslog ¼Ç¼
                                  # v = ¼Ç¼ tcp ´°¿Ú´óС¡¢ ack ºÍ˳ÐòºÅ(seq)
                                  # n = ½« IP ºÍ¶Ë¿ÚÓ³ÉäΪÃû×Ö

¡¡¡¡Èç¹ûÔÚ·À»ðǽºóÃæÓÐʹÓÃÁ˱£ÁôµÄ˽ÓÐ IP µØÖ··¶Î§µÄ LAN£¬ »¹ÐèÒªÔö¼ÓÏÂÃæµÄһЩѡÏîÀ´ÆôÓà NAT ¹¦ÄÜ£º

gateway_enable="YES"              # ÆôÓÃ×÷Ϊ LAN Íø¹ØµÄ¹¦ÄÜ
ipnat_enable="YES"                # Æô¶¯ ipnat ¹¦ÄÜ
ipnat_rules="/etc/ipnat.rules"    # ÓÃÓÚ ipnat µÄ¹æÔò¶¨ÒåÎļþ

30.5.4 IPF

¡¡¡¡ipf(8) ÃüÁî¿ÉÒÔÓÃÀ´¼ÓÔØÄú×Ô¼ºµÄ¹æÔòÎļþ¡£ Ò»°ãÇé¿öÏ£¬ Äú¿ÉÒÔ½¨Á¢Ò»¸ö°üÀ¨Äú×Ô¶¨ÒåµÄ¹æÔòµÄÎļþ£¬ ²¢Ê¹ÓÃÕâ¸öÃüÁîÀ´Ìæ»»µôÕýÔÚÔËÐеķÀ»ðǽÖеÄÄÚ²¿¹æÔò£º

# ipf -Fa -f /etc/ipf.rules

¡¡¡¡-Fa ±íʾÇå³ýËùÓеÄÄÚ²¿¹æÔò±í¡£

¡¡¡¡-f ÓÃÓÚÖ¸¶¨½«Òª±»¶ÁÈ¡µÄ¹æÔò¶¨ÒåÎļþ¡£

¡¡¡¡Õâ¸ö¹¦ÄÜʹµÃÄúÄܹ»ÐÞ¸Ä×Ô¶¨ÒåµÄ¹æÔòÎļþ£¬ ͨ¹ýÔËÐÐÉÏÃæµÄ IPF ÃüÁ ¿ÉÒÔ½«ÕýÔÚÔËÐеķÀ»ðǽˢÐÂΪʹÓÃÈ«ÐµĹæÔò¼¯£¬ ¶ø²»ÐèÒªÖØÐÂÆô¶¯ÏµÍ³¡£ Õâ¶ÔÓÚ²âÊÔÐµĹæÔòÀ´Ëµ¾ÍºÜ·½±ã£¬ ÒòΪÄú¿ÉÒÔÈÎÒâÖ´ÐÐÉÏÃæµÄÃüÁî¡£

¡¡¡¡Çë²Î¿¼ ipf(8) Áª»úÊÖ²áÒÔÁ˽âÕâ¸öÃüÁîÌṩµÄÆäËüÑ¡Ïî¡£

¡¡¡¡ipf(8) ÃüÁî¼Ù¶¨¹æÔòÎļþÊÇÒ»¸ö±ê×¼µÄÎı¾Îļþ¡£ Ëü²»ÄÜ´¦ÀíʹÓ÷ûºÅ´ú»»µÄ½Å±¾¡£

¡¡¡¡Ò²È·ÊµÓа취ÀûÓýű¾µÄ·Ç³£Ç¿´óµÄ·ûºÅÌæ»»ÄÜÁ¦À´¹¹½¨ IPF ¹æÔò¡£ ÒªÁË½â½øÒ»²½µÄϸ½Ú£¬ Çë²Î¿¼ µÚ 30.5.9 ½Ú¡£

30.5.5 IPFSTAT

¡¡¡¡Ä¬ÈÏÇé¿öÏ£¬ ipfstat(8) »á»ñÈ¡²¢ÏÔʾËùÓеÄÀÛ»ýͳ¼Æ£¬ ÕâЩͳ¼ÆÊÇ·À»ðǽÆô¶¯ÒÔÀ´Óû§¶¨ÒåµÄ¹æÔòÆ¥ÅäµÄ³öÈëÁ÷Á¿£¬ Äú¿ÉÒÔͨ¹ýʹÓà ipf -Z ÃüÁîÀ´½«ÕâЩ¼ÆÊýÆ÷ÇåÁã¡£

¡¡¡¡Çë²Î¼û ipfstat(8) Áª»úÊÖ²áÒÔÁË½â½øÒ»²½µÄϸ½Ú¡£

¡¡¡¡Ä¬È쵀 ipfstat(8) ÃüÁîÊä³öÀàËÆÓÚÏÂÃæµÄÑù×Ó£º

input packets: blocked 99286 passed 1255609 nomatch 14686 counted 0
 output packets: blocked 4200 passed 1284345 nomatch 14687 counted 0
 input packets logged: blocked 99286 passed 0
 output packets logged: blocked 0 passed 0
 packets logged: input 0 output 0
 log failures: input 3898 output 0
 fragment state(in): kept 0 lost 0
 fragment state(out): kept 0 lost 0
 packet state(in): kept 169364 lost 0
 packet state(out): kept 431395 lost 0
 ICMP replies: 0 TCP RSTs sent: 0
 Result cache hits(in): 1215208 (out): 1098963
 IN Pullups succeeded: 2 failed: 0
 OUT Pullups succeeded: 0 failed: 0
 Fastroute successes: 0 failures: 0
 TCP cksum fails(in): 0 (out): 0
 Packet log flags set: (0)

¡¡¡¡Èç¹ûʹÓÃÁË -i (½øÈëÁ÷Á¿) »òÕß -o (Êä³öÁ÷Á¿)£¬ Õâ¸öÃüÁî¾ÍÖ»»ñÈ¡²¢ÏÔʾÄÚºËÖÐËù°²×°µÄ¶ÔÓ¦¹ýÂËÆ÷¹æÔòµÄͳ¼ÆÊý¾Ý¡£

¡¡¡¡ipfstat -in ÒÔ¹æÔòºÅµÄÐÎʽÏÔʾ½øÈëµÄÄÚ²¿¹æÔò±í¡£

¡¡¡¡ipfstat -on ÒÔ¹æÔòºÅµÄÐÎʽÏÔʾÁ÷³öµÄÄÚ²¿¹æÔò±í¡£

¡¡¡¡Êä³öºÍÏÂÃæµÄÀàËÆ£º

@1 pass out on xl0 from any to any
@2 block out on dc0 from any to any
@3 pass out quick on dc0 proto tcp/udp from any to any keep state

¡¡¡¡ipfstat -ih ÏÔʾÄÚ²¿¹æÔò±íÖеĽøÈëÁ÷Á¿£¬ ÿһ¸öÆ¥Å乿ÔòÇ°Ãæ»áͬʱÏÔʾƥÅäµÄ´ÎÊý¡£

¡¡¡¡ipfstat -oh ÏÔʾÄÚ²¿¹æÔò±íÖеÄÁ÷³öÁ÷Á¿£¬ ÿһ¸öÆ¥Å乿ÔòÇ°Ãæ»áͬʱÏÔʾƥÅäµÄ´ÎÊý¡£

¡¡¡¡Êä³öºÍÏÂÃæµÄÀàËÆ£º

2451423 pass out on xl0 from any to any
354727 block out on dc0 from any to any
430918 pass out quick on dc0 proto tcp/udp from any to any keep state

¡¡¡¡ipfstat ÃüÁîµÄÒ»¸öÖØÒªµÄ¹¦ÄÜ¿ÉÒÔͨ¹ýÖ¸¶¨ -t ²ÎÊýÀ´Ê¹Ó㬠Ëü»áÒÔÀàËÆ top(1) µÄÏÔʾ FreeBSD ÕýÔËÐеĽø³Ì±íµÄ·½Ê½À´ÏÔʾͳ¼ÆÊý¾Ý¡£ µ±ÄúµÄ·À»ðǽÕýÔÚÊܵ½¹¥»÷µÄʱºò£¬ Õâ¸ö¹¦ÄÜÈÃÄúµÃÒÔʶ±ð¡¢ ÊÔÑ飬 ²¢²é¿´¹¥»÷µÄÊý¾Ý°ü¡£ Õâ¸öÑ¡ÏîÌỹÌṩÁËʵʱѡÔñÏ£Íû¼àÊÓµÄÄ¿µÄ»òÔ´ IP¡¢ ¶Ë¿Ú»òЭÒéµÄÄÜÁ¦¡£ Çë²Î¼û ipfstat(8) Áª»úÊÖ²áÒÔÁ˽âÏêϸÐÅÏ¢¡£

30.5.6 IPMON

¡¡¡¡ÎªÁËʹ ipmon Äܹ»ÕýÈ·¹¤×÷£¬ ±ØÐë´ò¿ª IPFILTER_LOG Õâ¸öÄÚºËÑ¡Ïî¡£ Õâ¸öÃüÁîÌṩÁËÁ½ÖÖ²»Í¬µÄʹÓÃģʽ¡£ ÄÚ½¨Ä£Ê½ÊÇĬÈϵÄģʽ£¬ Èç¹ûÄú²»Ö¸¶¨ -D ²ÎÊý£¬ ¾Í»á²ÉÓÃÕâÖÖģʽ¡£

¡¡¡¡·þÎñģʽÊdzÖÐøµØÍ¨¹ýϵͳÈÕÖ¾À´¼Ç¼µÄ¹¤×÷ģʽ£¬ ÕâÑù£¬ Äú¾Í¿ÉÒÔͨ¹ý²é¿´ÈÕÖ¾À´Á˽â¹ýÈ¥Ôø¾­·¢Éú¹ýµÄÊÂÇé¡£ ÕâÖÖģʽÊÇ FreeBSD ºÍ IPFILTER ÅäºÏ¹¤×÷µÄģʽ¡£ ÓÉÓÚÔÚ FreeBSD ÖÐÌṩÁËÒ»¸öÄÚ½¨µÄϵͳÈÕÖ¾×Ô¶¯ÂÖת¹¦ÄÜ£¬ Òò´Ë£¬ ʹÓà syslogd(8) ±ÈĬÈϵĽ«ÈÕÖ¾ÐÅÏ¢¼Ç¼µ½Ò»¸öÆÕͨÎļþÒªºÃ¡£ ÔÚĬÈ쵀 rc.conf ÎļþÖУ¬ ipmon_flags Óï¾ä»áÖ¸¶¨ -Ds ±êÖ¾£º

ipmon_flags="-Ds"                 # D = ×÷Ϊ·þÎñ³ÌÐòÆô¶¯
                  # s = ʹÓà syslog ¼Ç¼
                  # v = ¼Ç¼ tcp ´°¿Ú´óС¡¢ ack ºÍ˳ÐòºÅ(seq)
                  # n = ½« IP ºÍ¶Ë¿ÚÓ³ÉäΪÃû×Ö

¡¡¡¡¼Ç¼ÈÕÖ¾µÄºÃ´¦ÊǺÜÃ÷ÏԵġ£ ËüÌṩÁËÔÚʺóÖØÐÂÉó²éÏà¹ØÐÅÏ¢£¬ ÀýÈçÄÄЩ°ü±»¶ªÆú£¬ ÒÔ¼°ÕâЩ°üµÄÀ´Ô´µØÖ·µÈµÈ¡£ Õ⽫Ϊ²éÕÒ¹¥»÷ÕßÌṩ·Ç³£ÓÐÓõĵÚÒ»ÊÖ×ÊÁÏ¡£

¡¡¡¡¼´Ê¹ÆôÓÃÁËÈÕÖ¾»úÖÆ£¬ IPF ÈÔÈ»²»»á¶ÔÆä¹æÔò½øÐÐÈκÎÈÕÖ¾¼Ç¼¹¤×÷¡£ ·À»ðǽ¹ÜÀíÔ±¿ÉÒÔ¾ö¶¨¹æÔò¼¯ÖеÄÄÄЩӦ¼Ç¼ÈÕÖ¾£¬ ²¢ÔÚÕâЩ¹æÔòÉϼÓÈë log ¹Ø¼ü×Ö¡£ Ò»°ãÀ´Ëµ£¬ Ö»Ó¦¼Ç¼¾Ü¾øÐԵĹæÔò¡£

¡¡¡¡×÷Ϊ¹ßÀý£¬ ͨ³£»áÓÐÒ»ÌõĬÈϵġ¢¾Ü¾øËùÓÐÍøÂçÁ÷Á¿µÄ¹æÔò£¬ ²¢Ö¸¶¨ log ¹Ø¼ü×Ö£¬ ×÷ΪÄúµÄ¹æÔò¼¯µÄ×îºóÒ»Ìõ¡£ ÕâÑù¾ÍÄܹ»¿´µ½ËùÓÐûÓÐÆ¥ÅäÈκιæÔòµÄÊý¾Ý°üÁË¡£

30.5.7 IPMON µÄÈÕÖ¾

¡¡¡¡Syslogd ʹÓÃÌØÊâµÄ·½·¨¶ÔÈÕÖ¾Êý¾Ý½øÐзÖÀà¡£ ËüʹÓóÆÎª ¡°facility¡± ºÍ ¡°level¡± µÄ×é¡£ ÒÔ -Ds ģʽÔËÐÐµÄ IPMON ²ÉÓà local0 ×÷ΪĬÈ쵀 ¡°facility¡± Ãû¡£ Èç¹ûÐèÒª£¬ ¿ÉÒÔÓÃÏÂÁÐ levels À´½øÒ»²½Çø·ÖÊý¾Ý£º

LOG_INFO - ʹÓà "log" ¹Ø¼ü×ÖÖ¸¶¨µÄͨ¹ý»ò×èÖ¹¶¯×÷
LOG_NOTICE - ͬʱ¼Ç¼ͨ¹ýµÄÄÇЩÊý¾Ý°ü
LOG_WARNING - ͬʱ¼Ç¼×èÖ¹µÄÊý¾Ý°ü
LOG_ERR - ½øÒ»²½¼Ç¼º¬²»ÍêÕûµÄ°üÍ·µÄÊý¾Ý°ü

¡¡¡¡ÒªÉèÖà IPFILTER À´½«ËùÓеÄÊý¾Ý¼Ç¼µ½ /var/log/ipfilter.log£¬ ÐèÒªÊ×ÏȽ¨Á¢Õâ¸öÎļþ¡£ ÏÂÃæµÄÃüÁî¿ÉÒÔÍê³ÉÕâ¸ö¹¤×÷£º

# touch /var/log/ipfilter.log

¡¡¡¡syslogd(8) ¹¦ÄÜ¿ÉÒÔͨ¹ýÔÚ /etc/syslog.conf ÎļþÖеÄÓï¾äÀ´¶¨Òå¡£ syslog.conf ÌṩÁËÏ൱¶àµÄÓÃÒÔ¿ØÖÆ syslog ÈçºÎ´¦ÀíÀàËÆ IPF ÕâÑùµÄÓÃÓóÌÐòËù²úÉúµÄϵͳÏûÏ¢µÄ·½·¨¡£

¡¡¡¡ÄúÐèÒª½«ÏÂÁÐÓï¾ä¼Óµ½ /etc/syslog.conf£º

local0.* /var/log/ipfilter.log

¡¡¡¡ÕâÀïµÄ local0.* ±íʾ°ÑËùÓеÄÏà¹ØÈÕÖ¾ÐÅϢдµ½Ö¸¶¨µÄÎļþÖС£

¡¡¡¡ÒªÈà /etc/syslog.conf ÖеÄÐÞ¸ÄÁ¢¼´ÉúЧ£¬ ¿ÉÒÔÖØÐÂÆô¶¯¼ÆËã»ú£¬ »òÕßͨ¹ýÖ´ÐÐ /etc/rc.d/syslogd reload À´ÈÃËüÖØÐ¶ÁÈ¡ /etc/syslog.conf¡£

¡¡¡¡²»ÒªÍüÁËÐÞ¸Ä /etc/newsyslog.conf À´Èøմ´½¨µÄÈÕÖ¾½øÐÐÂÖת¡£

30.5.8 ¼Ç¼ÏûÏ¢µÄ¸ñʽ

¡¡¡¡ÓÉ ipmon Éú³ÉµÄÏûÏ¢Óɿոñ·Ö¸ôµÄÊý¾Ý×Ö¶Î×é³É¡£ ËùÓеÄÏûÏ¢¶¼°üº¬µÄ×Ö¶ÎÊÇ£º

  1. ½Óµ½Êý¾Ý°üµÄÈÕÆÚ¡£

  2. ½Óµ½Êý¾Ý°üµÄʱ¼ä¡£ Æä¸ñʽΪ HH:MM:SS.F£¬ ·Ö±ðÊÇСʱ¡¢ ·ÖÖÓ¡¢ Ã룬 ÒÔ¼°·ÖÃë (Õâ¸öÊý×Ö¿ÉÄÜÓÐÐí¶àλ)¡£

  3. ´¦ÀíÊý¾Ý°üµÄÍøÂç½Ó¿ÚÃû×Ö£¬ ÀýÈç dc0¡£

  4. ×éºÍ¹æÔòµÄ±àºÅ£¬ ÀýÈç @0:17¡£

¡¡¡¡¿ÉÒÔͨ¹ý ipfstat -in À´²é¿´ÕâЩÐÅÏ¢¡£

  1. ¶¯×÷£º p ±íʾͨ¹ý£¬ b ±íʾ×èÖ¹£¬ S ±íʾ°üÍ·²»È«£¬ n ±íʾûÓÐÆ¥ÅäÈκιæÔò£¬ L ±íʾ log ¹æÔò¡£ ÏÔʾÕâЩ±êÖ¾µÄ˳ÐòÊÇ£º S, p, b, n, L¡£ ´óдµÄ P »ò B ±íʾ¼Ç¼°üµÄÔ­ÒòÊÇij¸öÈ«¾ÖµÄÈÕÖ¾ÅäÖ㬠¶ø²»ÊÇij¸öÌØ¶¨µÄ¹æÔò¡£

  2. µØÖ·¡£ Õâʵ¼ÊÉϰüÀ¨Èý²¿·Ö£º Ô´µØÖ·ºÍ¶Ë¿Ú (ÒÔ¶ººÅ·Ö¿ª)£¬ Ò»¸ö -> ·ûºÅ£¬ ÒÔ¼°Ä¿µÄµØÖ·ºÍ¶Ë¿Ú£¬ ÀýÈ磺 209.53.17.22,80 -> 198.73.220.17,1722¡£

  3. PR£¬ ºó¸úЭÒéÃû³Æ»ò±àºÅ£¬ ÀýÈ磺 PR tcp¡£

  4. len£¬ ºó¸ú°üÍ·µÄ³¤¶È£¬ ÒÔ¼°°üµÄ×ܳ¤¶È£¬ ÀýÈ磺 len 20 40¡£

¡¡¡¡¶ÔÓÚ TCP °ü£¬ Ôò»¹»á°üÀ¨Ò»¸ö¸½¼ÓµÄ×ֶΣ¬ ÓÉÒ»¸öÁ¬×ֺſªÊ¼£¬ Ö®ºóÊDZíʾËùÉèÖõıêÖ¾µÄÒ»¸ö×Öĸ¡£ Çë²Î¼û ipf(5) Áª»úÊֲᣬ ÒÔÁ˽âÕâЩ×ÖĸËù¶ÔÓ¦µÄ±êÖ¾¡£

¡¡¡¡¶ÔÓÚ ICMP °ü£¬ ÔòÔÚ×îºó»áÓÐÁ½¸ö×ֶΡ£ ǰһ¸ö×ÜÊÇ ¡°ICMP¡±£¬ ¶øºóÒ»¸öÔòÊÇ ICMP ÏûÏ¢ºÍ×ÓÏûÏ¢µÄÀàÐÍ£¬ ÖмäÒÔбÏß·Ö¿¿£¬ ÀýÈç ICMP 3/3 ±íʾ¶Ë¿Ú²»¿É´ïÏûÏ¢¡£

30.5.9 ¹¹½¨²ÉÓ÷ûºÅÌæ»»µÄ¹æÔò½Å±¾

¡¡¡¡Ò»Ð©Óо­ÑéµÄ IPF »á´´½¨°üº¬¹æÔòµÄÎļþ£¬ ²¢°ÑËü±àд³ÉÄܹ»Óë·ûºÅÌæ»»½Å±¾¼æÈݵķ½Ê½¡£ ÕâÑù×ö×î´óµÄºÃ´¦ÊÇÄܹ»ÔÚÐÞ¸ÄʱֻÐ޸ķûºÅÃû×ÖËù´ú±íµÄÖµ£¬ ¶øÔڽű¾Ö´ÐÐʱֱ½ÓÌæ»»µôËùÓеÄÃû·û¡£ ×÷Ϊ½Å±¾£¬ ¿ÉÒÔʹÓ÷ûºÅÌæ»»À´°ÑÄÇЩ¾­³£Ê¹ÓõÄÖµÖ±½ÓÓÃÓÚ¶à¸ö¹æÔò¡£ ÏÂÃæ½«¸ø³öÒ»¸öÀý×Ó¡£

¡¡¡¡Õâ¸ö½Å±¾ËùʹÓõÄÓï·¨Óë sh(1)¡¢ csh(1)£¬ ÒÔ¼° tcsh(1) ½Å±¾¡£

¡¡¡¡·ûºÅÌæ»»µÄǰ׺×Ö¶ÎÊÇÃÀÔª·ûºÅ£º $¡£

¡¡¡¡·ûºÅ×ֶβ»Ê¹Óà $ ǰ׺¡£

¡¡¡¡Ï£ÍûÌæ»»·ûºÅ×ֶεÄÖµ£¬ ±ØÐëʹÓÃË«ÒýºÅ (") À¨ÆðÀ´¡£

¡¡¡¡ÄúµÄ¹æÔòÎļþµÄ¿ªÍ·ÀàËÆÕâÑù£º

############# IPF ¹æÔò½Å±¾µÄ¿ªÍ· ########################
oif="dc0"            # ÍâÍø½Ó¿ÚµÄÃû×Ö
odns="192.0.2.11"    # ISP µÄ DNS ·þÎñÆ÷ IP µØÖ·
myip="192.0.2.7"     # À´×Ô ISP µÄ¾²Ì¬ IP µØÖ·
ks="keep state"
fks="flags S keep state"

# ¿ÉÒÔʹÓÃÕâ¸ö½Å±¾À´½¨Á¢ /etc/ipf.rules Îļþ£¬
# Ò²¿ÉÒÔ "Ö±½ÓµØ" ÔËÐÐËü¡£
#
# Çëɾ³ýÁ½¸ö×¢ÊͺÅÖ®Ò»¡£
#
# 1) ±£ÁôÏÂÃæÒ»ÐУ¬ Ôò´´½¨ /etc/ipf.rules£º
#cat > /etc/ipf.rules << EOF
#
# 2) ±£ÁôÏÂÃæÒ»ÐУ¬ Ôò "Ö±½ÓµØ" ÔËÐнű¾£º
/sbin/ipf -Fa -f - << EOF

# ÔÊÐí·¢³öµ½ÎÒµÄ ISP µÄÓòÃû·þÎñÆ÷µÄ·ÃÎÊ
pass out quick on $oif proto tcp from any to $odns port = 53 $fks
pass out quick on $oif proto udp from any to $odns port = 53 $ks

# ÔÊÐí·¢³öδ¼ÓÃÜµÄ www ·ÃÎÊÇëÇó
pass out quick on $oif proto tcp from $myip to any port = 80 $fks

# ÔÊÐí·¢³öʹÓà TLS SSL ¼ÓÃÜµÄ https www ·ÃÎÊÇëÇó
pass out quick on $oif proto tcp from $myip to any port = 443 $fks
EOF
################## IPF ¹æÔò½Å±¾µÄ½áÊø ########################

¡¡¡¡Õâ¾ÍÊÇËùÐèµÄÈ«²¿ÄÚÈÝ¡£ Õâ¸ö¹æÔò±¾Éí²¢²»ÖØÒª£¬ ËüÃÇÖ÷ÒªÊÇÓÃÓÚÌåÏÖÈçºÎʹÓ÷ûºÅ´ú»»×ֶΣ¬ ÒÔ¼°ÈçºÎÍê³ÉÖµµÄÌæ»»¡£ Èç¹ûÉÏÃæµÄÀý×ÓµÄÃû×ÖÊÇ /etc/ipf.rules.script£¬ ¾Í¿ÉÒÔͨ¹ýÊäÈëÏÂÃæµÄÃüÁîÀ´ÖØÐ¼ÓÔØ¹æÔò£º

# sh /etc/ipf.rules.script

¡¡¡¡ÔÚ¹æÔòÎļþÖÐǶÈë·ûºÅÓÐÒ»¸öÎÊÌ⣺ IPF ÎÞ·¨Ê¶±ð·ûºÅÌæ»»£¬ Òò´ËËü²»ÄÜÖ±½ÓµØ¶ÁÈ¡ÕâÑùµÄ½Å±¾¡£

¡¡¡¡Õâ¸ö½Å±¾¿ÉÒÔʹÓÃÏÂÃæÁ½ÖÖ·½·¨Ö®Ò»À´Ê¹Óãº

¡¡¡¡ÕâÑù£¬ ÔÚϵͳÆô¶¯Ê±£¬ ¾Í»á×Ô¶¯¼ÓÔØÄúµÄ IPF ¹æÔòÁË¡£

30.5.10 IPF ¹æÔò¼¯

¡¡¡¡¹æÔò¼¯ÊÇÖ¸Ò»×é±àдºÃµÄÒÀ¾Ý°üµÄÖµ¾ö²ßÔÊÐíͨ¹ý»ò×èÖ¹ IPF ¹æÔò¡£ °üµÄË«Ïò½»»»×é³ÉÁËÒ»¸ö»á»°½»»¥¡£ ·À»ðǽ¹æÔò¼¯»á×÷ÓÃÓÚÀ´×ÔÓÚ Internet ¹«ÍøµÄ°üÒÔ¼°ÓÉϵͳ·¢³öÀ´»ØÓ¦ÕâЩ°üµÄÊý¾Ý°ü¡£ ÿһ¸ö TCP/IP ·þÎñ (ÀýÈç telnet, www, ÓʼþµÈµÈ) ¶¼ÓÉЭÒéÔ¤Ïȶ¨ÒåÁËÆäÌØÈ¨ (¼àÌý) ¶Ë¿Ú¡£ ·¢µ½Ìض¨·þÎñµÄ°ü»á´ÓÔ´µØÖ·Ê¹Ó÷ÇÌØÈ¨ (¸ß±àºÅ) ¶Ë¿Ú·¢³ö£¬ ²¢·¢µ½Ìض¨·þÎñÔÚÄ¿µÄµØÖ·µÄ¶ÔÓ¦¶Ë¿Ú¡£ ËùÓÐÕâЩ²ÎÊý (ÀýÈ磺 ¶Ë¿ÚºÍµØÖ·£© ¶¼ÊÇ¿ÉÒÔΪ·À»ðǽ¹æÔòËùÀûÓõģ¬ ÅбðÊÇ·ñÔÊÐí·þÎñͨ¹ýµÄ±ê×¼¡£

¡¡¡¡IPF ×î³õ±»Ð´³ÉʹÓÃÒ»×鳯×÷ ¡°ÒÔ×îºóÆ¥ÅäµÄ¹æÔòΪ׼¡± µÄ´¦ÀíÂß¼­£¬ ÇÒÖ»ÄÜ´¦ÀíÎÞ״̬µÄ¹æÔò¡£ Ëæ×Åʱ´úµÄ·¢Õ¹£¬ IPF ½øÐÐÁ˸Ľø£¬ ²¢ÌṩÁË ¡°quick¡± Ñ¡Ï ÒÔ¼°Ò»¸öÓÐ״̬µÄ ¡°keep state¡± Ñ¡Ïî¡£ ºóÕßʹ´¦ÀíÂß¼­Ñ¸ËٵظúÉÏÁËʱ´úµÄ²½·¥¡£

¡¡¡¡ÕâÒ»½ÚÖÐÌṩµÄһЩָµ¼£¬ ÊÇ»ùÓÚʹÓðüº¬ ¡°quick¡± Ñ¡ÏîºÍÓÐ״̬µÄ ¡°keep state¡± Ñ¡ÏîÀ´½øÐвûÊöµÄ¡£ ÕâЩÊDZàдÃ÷ʾÔÊÐí·À»ðǽ¹æÔò¼¯µÄ»ù±¾ÒªËØ¡£

¾¯¸æ: µ±¶Ô·À»ðǽ¹æÔò½øÐвÙ×÷ʱ£¬ Ó¦ ½÷É÷ÐÐÊ¡£ ijЩÅäÖÿÉÄÜ»á ½«Äú·´ËøÔÚ ·þÎñÆ÷ÍâÃæ¡£ ±£ÏÕÆð¼û£¬ Äú¿ÉÒÔ¿¼ÂÇÔÚµÚÒ»´Î½øÐзÀ»ðǽÅäÖÃʱÔÚ±¾µØ¿ØÖÆÌ¨ÉÏ£¬ ¶ø²»ÊÇÔ¶³Ì£¬ Èçͨ¹ý ssh À´½øÐС£

30.5.11 ¹æÔòÓï·¨

¡¡¡¡ÕâÀï¸ø³öµÄ¹æÔòÓï·¨ÒѾ­¼ò»¯µ½Ö»´¦ÀíÄÇЩÐÂʽµÄ´ø×´Ì¬¹æÔò£¬ ²¢ÇÒ¶¼ÊÇ ¡°µÚÒ»¸öÆ¥ÅäµÄ¹æÔò»ñʤ¡± Âß¼­µÄ¡£ ÒªÁ˽âÍêÕûµÄ´«Í³¹æÔòÓï·¨ÃèÊö£¬ Çë²Î¼û ipf(8) Áª»úÊֲᡣ

¡¡¡¡ÒÔ # ×Ö·û¿ªÍ·µÄÄÚÈݻᱻÈÏΪÊÇ×¢ÊÍ¡£ ÕâЩעÊÍ¿ÉÒÔ³öÏÖÔÚÒ»ÐйæÔòµÄĩ⣬ »òÕß¶ÀÕ¼Ò»ÐС£ ¿ÕÐлᱻºöÂÔ¡£

¡¡¡¡¹æÔòÓɹؼü×Ö×é³É¡£ ÕâЩ¹Ø¼ü×Ö±ØÐëÒÔÒ»¶¨µÄ˳Ðò£¬ ´Ó×óµ½ÓÒ³öÏÖÔÚÒ»ÐÐÉÏ¡£ ½ÓÏÂÀ´µÄÎÄ×ÖÖйؼü×Ö½«Ê¹ÓôÖÌå±íʾ¡£ ijЩ¹Ø¼ü×Ö¿ÉÄÜÌṩÁË×ÓÑ¡Ï ÕâЩ×ÓÑ¡Ïî±¾Éí¿ÉÄÜÒ²Êǹؼü×Ö£¬ ¶øÇÒ¿ÉÄÜ»áÌṩ¸ü¶àµÄ×ÓÑ¡Ïî¡£ ÏÂÃæµÄÎÄ×ÖÖУ¬ ÿÖÖÓï·¨¶¼Ê¹ÓôÖÌåµÄС½Ú±êÌâ³ÊÏÖ£¬ ²¢½éÉÜÁËÆäÉÏÏÂÎÄ¡£

¡¡¡¡ACTION IN-OUT OPTIONS SELECTION STATEFUL PROTO SRC_ADDR,DST_ADDR OBJECT PORT_NUM TCP_FLAG STATEFUL

¡¡¡¡ACTION = block | pass

¡¡¡¡IN-OUT = in | out

¡¡¡¡OPTIONS = log | quick | on ÍøÂç½Ó¿ÚµÄÃû×Ö

¡¡¡¡SELECTION = proto ЭÒéÃû³Æ | Ô´/Ä¿µÄ IP | port = ¶Ë¿ÚºÅ | flags ±êÖ¾Öµ

¡¡¡¡PROTO = tcp/udp | udp | tcp | icmp

¡¡¡¡SRC_ADD,DST_ADDR = all | from ¶ÔÏó to ¶ÔÏó

¡¡¡¡OBJECT = IPµØÖ· | any

¡¡¡¡PORT_NUM = port ¶Ë¿ÚºÅ

¡¡¡¡TCP_FLAG = S

¡¡¡¡STATEFUL = keep state

30.5.11.1 ACTION (¶¯×÷)

¡¡¡¡¶¯×÷¶Ô±íʾƥÅ乿ÔòµÄ°üÓ¦²Éȡʲô¶¯×÷¡£ ÿһ¸ö¹æÔò ±ØÐë °üº¬Ò»¸ö¶¯×÷¡£ ¿ÉÒÔʹÓÃÏÂÃæÁ½ÖÖ¶¯×÷Ö®Ò»£º

¡¡¡¡block ±íʾÈç¹û¹æÔòÓë°üÆ¥Å䣬 Ôò¶ªÆú°ü¡£

¡¡¡¡pass ±íʾÈç¹û¹æÔòÓë°üÆ¥Å䣬 ÔòÔÊÐí°üͨ¹ý·À»ðǽ¡£

30.5.11.2 IN-OUT

¡¡¡¡Ã¿¸ö¹ýÂËÆ÷¹æÔò¶¼±ØÐëÃ÷È·µØÖ¸¶¨ÊÇÁ÷È뻹ÊÇÁ÷³öµÄ¹æÔò¡£ ÏÂÒ»¸ö¹Ø¼ü×Ö±ØÐëҪôÊÇ in£¬ ҪôÊÇ out£¬ ·ñÔò½«ÎÞ·¨Í¨¹ýÓï·¨¼ì²é¡£

¡¡¡¡in ±íʾ¹æÔòÓ¦±»Ó¦ÓÃÓÚ¸Õ¸Õ´Ó Internet ¹«ÍøÉÏÊÕµ½µÄÊý¾Ý°ü¡£

¡¡¡¡out ±íʾ¹æÔòÓ¦±»Ó¦ÓÃÓÚ¼´½«·¢³öµ½ Internet µÄÊý¾Ý°ü¡£

30.5.11.3 OPTIONS

×¢Òâ: ÕâЩѡÏî±ØÐë°´ÏÂÃæÖ¸¶¨µÄ˳Ðò³öÏÖ¡£

¡¡¡¡log ±íʾ°üÍ·Ó¦±»Ð´Èëµ½ ipl ÈÕÖ¾ (ÈçÇ°Ãæ LOGGING С½ÚËù½éÉܵÄÄÇÑù)£¬ Èç¹ûËüÓë¹æÔòÆ¥ÅäµÄ»°¡£

¡¡¡¡quick ±íʾÈç¹û¸ø³öµÄ²ÎÊýÓë°üÆ¥Å䣬 ÔòÒÔÕâ¸ö¹æÔòΪ׼£¬ ÕâʹµÃÄܹ» "¶Ì·" µôºóÃæµÄ¹æÔò¡£ Õâ¸öÑ¡Ïî¶ÔÓÚʹÓÃÐÂʽµÄ´¦ÀíÂß¼­ÊDZØÐèµÄ¡£

¡¡¡¡on ±íʾ½«ÍøÂç½Ó¿ÚµÄÃû³Æ×÷Ϊɸѡ²ÎÊýµÄÒ»²¿·Ö¡£ ½Ó¿ÚµÄÃû×Ö»áÔÚ ifconfig(8) µÄÊä³öÖÐÏÔʾ¡£ ʹÓÃÕâ¸öÑ¡Ï Ôò¹æÔòÖ»»áÓ¦Óõ½Ä³Ò»¸öÍøÂç½Ó¿ÚÉϵijöÈëÊý¾Ý°üÉÏ¡£ ÒªÅäÖÃÐÂʽµÄ´¦ÀíÂß¼­£¬ ±ØÐëʹÓÃÕâ¸öÑ¡Ïî¡£

¡¡¡¡µ±¼Ç¼°üʱ£¬ °üµÄÍ·»á±»Ð´Èëµ½ IPL °üÈÕ־αÉ豸ÖС£ ½ô¸ú log ¹Ø¼ü×Ö£¬ ¿ÉÒÔʹÓÃÏÂÃæ¼¸¸öÐÞÊηû (°´ÕÕÏÂÁÐ˳Ðò)£º

¡¡¡¡body ±íʾӦͬʱ¼Ç¼°üµÄǰ 128 ×Ö½ÚµÄÄÚÈÝ¡£

¡¡¡¡first Èç¹û log ¹Ø¼ü×ÖºÍ keep state Ñ¡ÏîͬʱʹÓ㬠ÔòÕâ¸öÑ¡ÏîÖ»ÔÚµÚÒ»¸ö°üÉÏ´¥·¢£¬ ÕâÑù¾Í²»ÓüǼÿһ¸ö ¡°keep state¡± °üÐÅÏ¢ÁË¡£

30.5.11.4 SELECTION

¡¡¡¡ÕâÒ»½ÚËù½éÉܵĹؼü×Ö¿ÉÒÔÓÃÓÚËù¼ì²ìµÄ°üµÄÊôÐÔ¡£ ÓÐÒ»¸ö¹Ø¼ü×ÖÖ÷Ì⣬ ÒÔ¼°Ò»×é×ÓÑ¡Ïî¹Ø¼ü×Ö£¬ Äú±ØÐë´ÓËûÃÇÖÐÑ¡ÔñÒ»¸ö¡£ ÒÔÏÂÊÇһЩͨÓõÄÊôÐÔ£¬ ËüÃDZØÐë°´ÏÂÃæµÄ˳ÐòʹÓãº

30.5.11.5 PROTO

¡¡¡¡proto ÊÇÒ»¸öÖ÷Ìâ¹Ø¼ü×Ö£¬ Ëü±ØÐëÓëij¸öÏà¹ØµÄ×ÓÑ¡Ïî¹Ø¼ü×ÖÅäºÏʹÓᣠÕâ¸öÖµµÄ×÷ÓÃÊÇÆ¥Åäij¸öÌØ¶¨µÄЭÒé¡£ ҪʹÓÃÐÂʽµÄ¹æÔò´¦ÀíÂß¼­£¬ ¾Í±ØÐëʹÓÃÕâ¸öÑ¡Ïî¡£

¡¡¡¡tcp/udp | udp | tcp | icmp »òÆäËûÔÚ /etc/protocols Öж¨ÒåµÄЭÒé¡£ ÌØÊâµÄЭÒ鹨¼ü×Ö tcp/udp ¿ÉÒÔÓÃÓÚÆ¥Åä TCP »ò UDP °ü£¬ ÒýÈëÕâ¸ö¹Ø¼ü×ÖµÄ×÷ÓÃÊÇÊDZÜÃâ´óÁ¿µÄÖØ¸´¹æÔòµÄÂé·³¡£

30.5.11.6 SRC_ADDR/DST_ADDR

¡¡¡¡Ê¹Óà all ¹Ø¼ü´Ê£¬ »ù±¾ÉÏÏ൱ÓÚ ¡°from any to any¡± ÔÚûÓÐÅäºÏÆäËû¹Ø¼ü×ÖµÄÇéÐΡ£

¡¡¡¡from src to dst£º from ºÍ to ¹Ø¼ü×ÖÖ÷ÒªÊÇÓÃÀ´Æ¥Åä IP µØÖ·¡£ ËùÓеĹæÔò¶¼±ØÐë ͬʱ ¸ø³öÔ´ºÍÄ¿µÄÁ½¸ö²ÎÊý¡£ any ÊÇÒ»¸ö¿ÉÒÔÓÃÓÚÆ¥ÅäÈÎÒâ IP µØÖ·µÄÌØÊâ¹Ø¼ü×Ö¡£ ÀýÈ磬 Äú¿ÉÒÔʹÓà from any to any »ò from 0.0.0.0/0 to any »ò from any to 0.0.0.0/0 »ò from 0.0.0.0 to any ÒÔ¼° from any to 0.0.0.0¡£

¡¡¡¡Èç¹ûÎÞ·¨Ê¹ÓÃ×ÓÍøÑÚÂëÀ´±íʾ IP µÄ»°£¬ ±í´ïµØÖ·¾Í»áºÜÂé·³¡£ ʹÓà net-mgmt/ipcalc port ¿ÉÒÔ°ïÖú½øÐмÆËã¡£ Çë²Î¼ûÏÂÃæµÄÍøÒ³Á˽âÈçºÎ׫д³¤¶ÈÑÚÂ룺 http://jodies.de/ipcalc¡£

30.5.11.7 PORT

¡¡¡¡Èç¹ûΪԴ»òÄ¿µÄÖ¸¶¨ÁËÆ¥Åä¶Ë¿Ú£¬ ¹æÔò¾ÍÖ»ÄÜÓ¦ÓÃÓÚ TCP ºÍ UDP °üÁË¡£ µ±±àд¶Ë¿Ú±È½Ï¹æÔòʱ£¬ ¿ÉÒÔÖ¸¶¨ /etc/services ÖÐËù¶¨ÒåµÄÃû×Ö£¬ Ò²¿ÉÒÔÖ±½ÓÓö˿ںÅÀ´Ö¸¶¨¡£ Èç¹û¶Ë¿ÚºÅ³öÏÖÔÚÔ´¶ÔÏóÒ»²à£¬ Ôò±»ÈÏΪÊÇÔ´¶Ë¿ÚºÅ£» ·´Ö®£¬ Ôò±»ÈÏΪÊÇÄ¿µÄ¶Ë¿ÚºÅ¡£ ҪʹÓÃÐÂʽµÄ¹æÔò´¦ÀíÂß¼­£¬ ¾Í±ØÐëÓë to ¶ÔÏóÅäºÏʹÓÃÕâ¸öÑ¡Ïî¡£ ʹÓõÄÀý×Ó£º from any to any port = 80

¡¡¡¡¶Ôµ¥¸ö¶Ë¿ÚµÄ±È½Ï¿ÉÒÔ¶àÖÖ·½Ê½½øÐУ¬ ²¢¿ÉʹÓò»Í¬µÄ±È½ÏËã·û¡£ ´ËÍ⣬ »¹¿ÉÒÔÖ¸¶¨¶Ë¿ÚµÄ·¶Î§¡£

¡¡¡¡port "=" | "!=" | "<" | ">" | "<=" | ">=" | "eq" | "ne" | "lt" | "gt" | "le" | "ge".

¡¡¡¡ÒªÖ¸¶¨¶Ë¿Ú·¶Î§£¬ ¿ÉÒÔʹÓà "<>" | "><"¡£

¾¯¸æ: ÔÚÔ´ºÍÄ¿µÄÆ¥Åä²ÎÊýÖ®ºó£¬ ÐèҪʹÓÃÏÂÃæÁ½¸ö²ÎÊý£¬ ²ÅÄܹ»Ê¹ÓÃÐÂʽµÄ¹æÔò´¦ÀíÂß¼­¡£

30.5.11.8 TCP_FLAG

¡¡¡¡±êÖ¾Ö»¶Ô TCP ¹ýÂËÓÐÓᣠÕâЩ×ÖĸÓÃÀ´±í´ï TCP °üÍ·µÄ±êÖ¾¡£

¡¡¡¡ÐÂʽµÄ¹æÔò´¦ÀíÂß¼­Ê¹Óà flags S ²ÎÊýÀ´Ê¶±ð tcp »á»°¿ªÊ¼µÄÇëÇó¡£

30.5.11.9 STATEFUL

¡¡¡¡keep state ±íʾÈç¹ûÓÐÒ»¸ö°üÓë¹æÔòÆ¥Å䣬 ÔòÆäɸѡ²ÎÊýÓ¦¼¤»îÓÐ״̬µÄ¹ýÂË»úÖÆ¡£

×¢Òâ: Èç¹ûʹÓÃÐÂʽµÄ´¦ÀíÂß¼­£¬ ÔòÕâ¸öÑ¡ÏîÊDZØÐèµÄ¡£

30.5.12 ÓÐ״̬¹ýÂË

¡¡¡¡ÓÐ״̬¹ýÂ˽«ÍøÂçÁ÷Á¿µ±×÷Ò»ÖÖË«ÏòµÄ°ü½»»»À´´¦Àí¡£ Èç¹û¼¤»îËü£¬ keep-state »á¶¯Ì¬µØÎªÃ¿Ò»¸öÏà¹ØµÄ°üÔÚË«Ïò»á»°½»»¥¹ý³ÌÖвúÉúÄÚ²¿¹æÔò¡£ ËüÄܹ»È·ÈÏ·¢ÆðÕߺͰüµÄÄ¿µÄµØÖ®¼äµÄ»á»°ÊÇÓÐЧµÄË«Ïò°ü½»»»¹ý³ÌµÄÒ»²¿·Ö¡£ Èç¹û°üÓëÕâЩ¹æÔò²»·û£¬ Ôò½«×Ô¶¯µØ¾Ü¾ø¡£

¡¡¡¡×´Ì¬±£³ÖҲʹµÃ ICMP °üÄܹ»Óë TCP »ò UDP »á»°Ïà¹Ø¡£ Òò´Ë£¬ Èç¹ûÄúÔÚä¯ÀÀÍøÕ¾Ê±ÊÕµ½ÔÊÐíµÄ״̬±£³Ö¹æÔòÆ¥ÅäµÄ ICMP ÀàÐÍ 3 ´úÂë 4 ÏìÓ¦£¬ ÔòÕâЩÏìÓ¦»á±»×Ô¶¯µØÔÊÐí½øÈë¡£ ËùÓÐ IPF Äܹ»´¦ÀíµÄ°ü£¬ ¶¼¿ÉÒÔ×÷ΪijÖÖ»îÔ¾»á»°µÄÒ»²¿·Ö£¬ ¼´Ê¹ËüÊÇÁíÒ»ÖÖЭÒéµÄ£¬ Ò²»á±»ÔÊÐí½øÈë¡£

¡¡¡¡Ëù·¢ÉúµÄÊÂÇéÊÇ£º

¡¡¡¡½«ÒªÍ¨¹ýÁ¬Èë Internet ¹«ÍøµÄÍøÂç½Ó¿Ú·¢³öµÄ°ü£¬ Ê×ÏȻᾭ¹ý¶¯Ì¬×´Ì¬±íµÄ¼ì²é¡£ Èç¹û°üÓë»á»°ÖÐÔ¤ÆÚµÄÏÂÒ»¸ö°üÆ¥Å䣬 ·À»ðǽ¾Í»áÔÊÐí°üͨ¹ý£¬ ²¢¸üÐÂ״̬±íÖеĻỰµÄ½»»¥Á÷ÐÅÏ¢¡£ ²»ÊôÓÚ»îÔ¾»á»°µÄ°ü£¬ Ôò¼òµ¥µØ½»¸øÊä³ö¹æÔò¼¯È¥¼ì²é¡£

¡¡¡¡·¢µ½Á¬Èë Internet ¹«Íø½Ó¿ÚµÄ°ü£¬ Ò²»áÏȾ­¹ý¶¯Ì¬×´Ì¬±íµÄ¼ì²é¡£ Èç¹û°üÓë»á»°ÖÐÔ¤ÆÚµÄÏÂÒ»¸ö°üÆ¥Å䣬 ·À»ðǽ¾Í»áÔÊÐí°üͨ¹ý£¬ ²¢¸üÐÂ״̬±íÖеĻỰµÄ½»»¥Á÷ÐÅÏ¢¡£ ²»ÊôÓÚ»îÔ¾»á»°µÄ°ü£¬ Ôò¼òµ¥µØ½»¸øÊäÈë¹æÔò¼¯È¥¼ì²é¡£

¡¡¡¡µ±»á»°½áÊøÊ±£¬ ¶ÔÓ¦µÄÏî»áÔÚ¶¯Ì¬×´Ì¬±íÖÐɾ³ý¡£

¡¡¡¡ÓÐ״̬¹ýÂËʹµÃÄúÄܹ»¼¯ÖÐÓÚ×èÖ¹/ÔÊÐíеĻỰ¡£ Ò»µ©Ð»Ự±»ÔÊÐíͨ¹ý£¬ ÔòËùÓкóÐøµÄ°ü¾Í¶¼±»×Ô¶¯µØÔÊÐíͨ¹ý£¬ ¶øÎ±ÔìµÄ°üÔò±»×Ô¶¯µØ¾Ü¾ø¡£ Èç¹ûеĻỰ±»×èÖ¹£¬ ÔòºóÐøµÄ°üÒ²¶¼²»»á±»ÔÊÐíͨ¹ý¡£ ÓÐ״̬¹ýÂË´Ó¼¼Êõ½Ç¶È¶øÑÔ£¬ ÔÚ×èֹĿǰ¹¥»÷Õß³£Óõĺéˮʽ¹¥»÷À´Ëµ£¬ ¾ßÓиüºÃµÄ¿¹ÓùÄÜÁ¦¡£

30.5.13 Ã÷ʾÔÊÐí¹æÔò¼¯µÄÀý×Ó

¡¡¡¡ÏÂÃæµÄ¹æÔò¼¯ÊÇÈçºÎ±àд·Ç³£°²È«µÄÃ÷ʾÔÊÐí·À»ðǽ¹æÔò¼¯µÄÒ»¸ö·¶Àý¡£ Ã÷ʾÔÊÐí·À»ðǽֻÈÃÔÊÐíµÄ·þÎñ pass (ͨ¹ý)£¬ ¶øËùÓÐÆäËûµÄ·ÃÎʶ¼»á±»Ä¬Èϵؾܾø¡£ ÆÚÍûÓÃÀ´±£»¤ÆäËû»úÆ÷µÄ·À»ðǽ£¬ ͨ³£Ò²½Ð×ö ¡°ÍøÂç·À»ðǽ¡±£¬ ӦʹÓÃÖÁÉÙÁ½¸öÍøÂç½Ó¿Ú£¬ ²¢ÇÒͨ³£Ö»ÓÐÒ»¸ö½ÓÈëµ½ÊÜÐŵÄÒ»¶Ë (LAN)£¬ ¶øÁíÒ»¿éÔò½ÓÈë²»ÊÜÐŵÄÒ»¶Ë (Internet ¹«Íø)¡£ ÁíÍ⣬ ·À»ðǽҲ¿ÉÒÔÅäÖÃΪֻ±£»¤ËüËùÔËÐеÄÄǸöϵͳ ©¤©¤ ÕâÖÖÀàÐͳÆ×÷ ¡°Ö÷»ú·À»ðǽ¡±£¬ ͨ³£ÔÚ½ÓÈë²»ÊÜÐÅÍøÂçµÄ·þÎñÆ÷ÉÏʹÓá£

¡¡¡¡°üÀ¨ FreeBSD ÔÚÄÚµÄËùÓÐÀà UNIX® ϵͳͨ³£¶¼»áʹÓà lo0 ºÍ IP µØÖ· 127.0.0.1 ÓÃÓÚ²Ù×÷ϵͳÖÐÄÚ²¿µÄͨѶ¡£ ·À»ðǽ¹æÔò±ØÐëÔÊÐíÕâЩ°üÎÞ×è°­µØÍ¨¹ý¡£

¡¡¡¡½ÓÈë Internet ¹«ÍøµÄÍøÂç½Ó¿Ú£¬ ÊÇ·ÅÖùæÔò²¢ÔÊÐí½«·ÃÎÊÇëÇó·¢µ½ Internet ÒÔ¼°½ÓÊÕÏìÓ¦µÄµØ·½¡£ ÕâÓпÉÄÜÊÇÓû§Ä£Ê½µÄ PPP tun0 ½Ó¿Ú£¬ Èç¹ûÄúµÄÍø¿¨Í¬ DSL »òµçÀµ÷ÖÆ½âµ÷Æ÷ÏàÁªµÄ»°¡£

¡¡¡¡Èç¹ûÓÐÍø¿¨ÊÇÖ±½Ó½ÓÈë˽ÓÐÍø¶ÎµÄ£¬ ÕâÐ©ÍøÂç½Ó¿Ú¾Í¿ÉÄÜÐèÒªÅäÖÃÔÊÐíÀ´×ÔÕâЩ LAN µÄ°üÔڱ˴ËÖ®¼ä£¬ ÒÔ¼°µ½Íâ½ç (Internet) ÉϵĶÔÓ¦µÄͨ¹ý¹æÔò¡£

¡¡¡¡Ò»°ã˵À´£¬ ¹æÔòÓ¦±»×é֯ΪÈý¸öÖ÷ÒªµÄС½Ú£º ËùÓÐÔÊÐí×ÔÓÉͨ¹ýµÄ½Ó¿Ú¹æÔò£¬ ·¢µ½¹«Íø½Ó¿ÚµÄ¹æÔò£¬ ÒÔ¼°½øÈë¹«Íø½Ó¿ÚµÄ¹æÔò¡£

¡¡¡¡Ã¿Ò»¸ö¹«Íø½Ó¿Ú¹æÔòÖУ¬ ¾­³£»áÆ¥Åäµ½µÄ¹æÔòÓ¦¸Ã·ÅÖÃÔÚ¾¡¿ÉÄÜ¿¿Ç°µÄλÖᣠ¶ø×îºóÒ»¸ö¹æÔòÓ¦¸ÃÊÇ×èÖ¹°üͨ¹ý£¬ ²¢¼Ç¼ËüÃÇ¡£

¡¡¡¡ÏÂÃæ·À»ðǽ¹æÔò¼¯ÖУ¬ Outbound ²¿·ÖÊÇһЩʹÓà pass µÄ¹æÔò£¬ ÕâЩ¹æÔòÖ¸¶¨ÁËÔÊÐí·ÃÎʵĹ«Íø Internet ·þÎñ£¬ ²¢ÇÒÖ¸¶¨ÁË quick¡¢ on¡¢ proto¡¢ port£¬ ÒÔ¼° keep state ÕâЩѡÏî¡£ proto tcp ¹æÔò»¹Ö¸¶¨ÁË flag Õâ¸öÑ¡Ï ÕâÑù»á»°µÄµÚÒ»¸ö°ü½«³ö·¢×´Ì¬»úÖÆ¡£

¡¡¡¡½ÓÊÕ²¿·ÖÔòÊ×ÏÈ×èÖ¹ËùÓв»Ï£ÍûµÄ°ü£¬ ÕâÑù×öÓÐÁ½¸ö²»Í¬µÄÔ­Òò¡£ ÆäÒ»ÊǶñÒâµÄ°ü¿ÉÄܺÍijЩÔÊÐíµÄÁ÷Á¿¹æÔò´æÔÚ²¿·ÖÆ¥Å䣬 ¶øÎÒÃÇÏ£Íû×èÖ¹£¬ ¶ø²»ÊÇÈÃÕâЩ°ü½ö½öÓë allow ¹æÔò²¿·ÖÆ¥Åä¾ÍÔÊÐíËüÃǽøÈë¡£ Æä¶þÊÇ£¬ ÒѾ­È·ÐÅÒª×èÖ¹µÄ°ü±»¾Ü¾øÕâ¼þÊ£¬ ÍùÍù²¢²»ÊÇÎÒÃÇÐèÒª¹Ø×¢µÄ£¬ Òò´ËÖ»Òª¼òµ¥µØÓèÒÔ×èÖ¹¼´¿É¡£ ·À»ðǽ¹æÔò¼¯ÖеÄÿ¸ö²¿·ÖµÄ×îºóÒ»Ìõ¹æÔò¶¼ÊÇ×èÖ¹²¢¼Ç¼°ü£¬ ÕâÓÐÖúÓÚΪ´þ²¶¹¥»÷ÕßÁôÏ·¨ÂÉËùÒªÇóµÄÖ¤¾Ý¡£

¡¡¡¡ÁíÍâÒ»¸öÐèҪעÒâµÄÊÂÇéÊÇÈ·±£ÏµÍ³¶Ô²»Ï£ÍûµÄÊý¾Ý°ü²»×ö»ØÓ¦¡£ ÎÞЧµÄ°üÓ¦±»¶ªÆúºÍÏûʧ¡£ ÕâÑù£¬ ¹¥»÷Õß±ãÎÞ·¨ÖªµÀ°üÊÇ·ñµ½´ïÁËÄúµÄϵͳ¡£ ¹¥»÷Õß¶ÔϵͳÁ˽âµÄÔ½ÉÙ£¬ ¹¥ÏÝϵͳËùÐèµÄʱ¼äÒ²¾ÍÔ½¶à¡£ °üº¬ log first Ñ¡ÏîµÄ¹æÔòÖ»»á¼Ç¼ËüÃǵÚÒ»´Î±»´¥·¢Ê±µÄ°ü£¬ ÔÚÀý×ÓÖÐÕâ¸öÑ¡Ïî±»ÓÃÓڼǼ nmap OS Ö¸ÎÆÌ½²â ¹æÔò¡£ security/nmap Êǹ¥»÷Õß³£ÓõÄÒ»ÖÖÓÃÓÚ̽²âÄ¿±êϵͳËùÓòÙ×÷ϵͳµÄ¹¤¾ß¡£

¡¡¡¡Èç¹ûÄú¿´µ½ÁË log first ¹æÔòµÄÈÕÖ¾£¬ ¾ÍÓ¦¸ÃÓà ipfstat -hio ÃüÁîÀ´¿´¿´ÄǸö¹æÔò±»Æ¥ÅäµÄ´ÎÊý¡£ Èç¹ûÊýÄ¿½Ï´ó£¬ Ôò±íʾϵͳÕýÔÚÊܵ½ºéˮʽ¹¥»÷¡£

¡¡¡¡Èç¹û¼Ç¼µÄ°üµÄ¶Ë¿ÚºÅ²¢²»ÊÇÄúËùÖªµÀµÄ£¬ ¿ÉÒÔÔÚ /etc/services »ò http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers Á˽â¶Ë¿ÚºÅͨ³£µÄÓÃ;¡£

¡¡¡¡²Î¿¼ÏÂÃæµÄÍøÒ³£¬ Á˽âľÂíʹÓõĶ˿ڣº http://www.sans.org/security-resources/idfaq/oddports.php¡£

¡¡¡¡ÏÂÃæÊÇÎÒÔÚ×Ô¼ºµÄϵͳÖÐʹÓõÄÍêÕûµÄ£¬ ·Ç³£°²È«µÄ Ã÷ʾÔÊÐí ·À»ðǽ¹æÔò¼¯¡£ Ö±½ÓʹÓÃÕâ¸ö¹æÔò¼¯²»»á¸øÄúÔì³ÉÎÊÌ⣬ ÄúËùÒª×öµÄÖ»ÊÇ×¢Ê͵ôÄÇЩÄú²»ÐèÒª pass(ÔÊÐíͨ¹ý) µÄ·þÎñ¡£

¡¡¡¡Èç¹ûÔÚÈÕÖ¾Öз¢ÏÖÁËÏ£Íû ×èÖ¹ µÄ¼Ç¼£¬ Ö»ÐèÔÚ inbound С½ÚÖÐÔö¼ÓÒ»Ìõ×èÖ¹¹æÔò¼¯¿É¡£

¡¡¡¡Äú±ØÐ뽫ÿһ¸ö¹æÔòÖÐµÄ dc0 Ìæ»»ÎªÄúϵͳÉϽÓÈë Internet µÄÍøÂç½Ó¿ÚÃû³Æ£¬ ÀýÈ磬 Óû§»·¾³Ï嵀 PPP Ó¦¸ÃÊÇ tun0¡£

¡¡¡¡ÔÚ /etc/ipf.rules ÖмÓÈëÏÂÃæµÄÄÚÈÝ£º

#################################################################
# No restrictions on Inside LAN Interface for private network
# Not needed unless you have LAN
#################################################################

#pass out quick on xl0 all
#pass in quick on xl0 all

#################################################################
# No restrictions on Loopback Interface
#################################################################
pass in quick on lo0 all
pass out quick on lo0 all

#################################################################
# Interface facing Public Internet (Outbound Section)
# Match session start requests originating from behind the
# firewall on the private network
# or from this gateway server destined for the public Internet.
#################################################################

# Allow out access to my ISP's Domain name server.
# xxx must be the IP address of your ISP's DNS.
# Dup these lines if your ISP has more than one DNS server
# Get the IP addresses from /etc/resolv.conf file
pass out quick on dc0 proto tcp from any to xxx port = 53 flags S keep state
pass out quick on dc0 proto udp from any to xxx port = 53 keep state

# Allow out access to my ISP's DHCP server for cable or DSL networks.
# This rule is not needed for 'user ppp' type connection to the
# public Internet, so you can delete this whole group.
# Use the following rule and check log for IP address.
# Then put IP address in commented out rule & delete first rule
pass out log quick on dc0 proto udp from any to any port = 67 keep state
#pass out quick on dc0 proto udp from any to z.z.z.z port = 67 keep state


# Allow out non-secure standard www function
pass out quick on dc0 proto tcp from any to any port = 80 flags S keep state

# Allow out secure www function https over TLS SSL
pass out quick on dc0 proto tcp from any to any port = 443 flags S keep state

# Allow out send & get email function
pass out quick on dc0 proto tcp from any to any port = 110 flags S keep state
pass out quick on dc0 proto tcp from any to any port = 25 flags S keep state

# Allow out Time
pass out quick on dc0 proto tcp from any to any port = 37 flags S keep state

# Allow out nntp news
pass out quick on dc0 proto tcp from any to any port = 119 flags S keep state

# Allow out gateway & LAN users' non-secure FTP ( both passive & active modes)
# This function uses the IPNAT built in FTP proxy function coded in
# the nat rules file to make this single rule function correctly.
# If you want to use the pkg_add command to install application packages
# on your gateway system you need this rule.
pass out quick on dc0 proto tcp from any to any port = 21 flags S keep state

# Allow out ssh/sftp/scp (telnet/rlogin/FTP replacements)
# This function is using SSH (secure shell)
pass out quick on dc0 proto tcp from any to any port = 22 flags S keep state

# Allow out insecure Telnet
pass out quick on dc0 proto tcp from any to any port = 23 flags S keep state

# Allow out FreeBSD CVSup
pass out quick on dc0 proto tcp from any to any port = 5999 flags S keep state

# Allow out ping to public Internet
pass out quick on dc0 proto icmp from any to any icmp-type 8 keep state

# Allow out whois from LAN to public Internet
pass out quick on dc0 proto tcp from any to any port = 43 flags S keep state

# Block and log only the first occurrence of everything
# else that's trying to get out.
# This rule implements the default block
block out log first quick on dc0 all

#################################################################
# Interface facing Public Internet (Inbound Section)
# Match packets originating from the public Internet
# destined for this gateway server or the private network.
#################################################################

# Block all inbound traffic from non-routable or reserved address spaces
block in quick on dc0 from 192.168.0.0/16 to any    #RFC 1918 private IP
block in quick on dc0 from 172.16.0.0/12 to any     #RFC 1918 private IP
block in quick on dc0 from 10.0.0.0/8 to any        #RFC 1918 private IP
block in quick on dc0 from 127.0.0.0/8 to any       #loopback
block in quick on dc0 from 0.0.0.0/8 to any         #loopback
block in quick on dc0 from 169.254.0.0/16 to any    #DHCP auto-config
block in quick on dc0 from 192.0.2.0/24 to any      #reserved for docs
block in quick on dc0 from 204.152.64.0/23 to any   #Sun cluster interconnect
block in quick on dc0 from 224.0.0.0/3 to any       #Class D & E multicast

##### Block a bunch of different nasty things. ############
# That I do not want to see in the log

# Block frags
block in quick on dc0 all with frags

# Block short tcp packets
block in quick on dc0 proto tcp all with short

# block source routed packets
block in quick on dc0 all with opt lsrr
block in quick on dc0 all with opt ssrr

# Block nmap OS fingerprint attempts
# Log first occurrence of these so I can get their IP address
block in log first quick on dc0 proto tcp from any to any flags FUP

# Block anything with special options
block in quick on dc0 all with ipopts

# Block public pings
block in quick on dc0 proto icmp all icmp-type 8

# Block ident
block in quick on dc0 proto tcp from any to any port = 113

# Block all Netbios service. 137=name, 138=datagram, 139=session
# Netbios is MS/Windows sharing services.
# Block MS/Windows hosts2 name server requests 81
block in log first quick on dc0 proto tcp/udp from any to any port = 137
block in log first quick on dc0 proto tcp/udp from any to any port = 138
block in log first quick on dc0 proto tcp/udp from any to any port = 139
block in log first quick on dc0 proto tcp/udp from any to any port = 81

# Allow traffic in from ISP's DHCP server. This rule must contain
# the IP address of your ISP's DHCP server as it's the only
# authorized source to send this packet type. Only necessary for
# cable or DSL configurations. This rule is not needed for
# 'user ppp' type connection to the public Internet.
# This is the same IP address you captured and
# used in the outbound section.
pass in quick on dc0 proto udp from z.z.z.z to any port = 68 keep state

# Allow in standard www function because I have apache server
pass in quick on dc0 proto tcp from any to any port = 80 flags S keep state

# Allow in non-secure Telnet session from public Internet
# labeled non-secure because ID/PW passed over public Internet as clear text.
# Delete this sample group if you do not have telnet server enabled.
#pass in quick on dc0 proto tcp from any to any port = 23 flags S keep state

# Allow in secure FTP, Telnet, and SCP from public Internet
# This function is using SSH (secure shell)
pass in quick on dc0 proto tcp from any to any port = 22 flags S keep state

# Block and log only first occurrence of all remaining traffic
# coming into the firewall. The logging of only the first
# occurrence avoids filling up disk with Denial of Service logs.
# This rule implements the default block.
block in log first quick on dc0 all
################### End of rules file #####################################

30.5.14 NAT

¡¡¡¡NAT ÊÇ ÍøÂçµØÖ·×ª»»(Network Address Translation) µÄËõд¡£ ¶ÔÓÚÄÇЩÊìϤ Linux® µÄÈËÀ´Ëµ£¬ Õâ¸ö¸ÅÄî½Ð×ö IP αװ (Masquerading)£» NAT ºÍ IP αװÊÇÍêȫһÑùµÄ¸ÅÄî¡£ ÓÉ IPF µÄ NAT ÌṩµÄÒ»ÏÄÜÊÇ£¬ ½«·À»ðǽºóµÄ±¾µØ¾ÖÓòÍø (LAN) ¹²ÏíÒ»¸ö ISP ÌṩµÄ IP µØÖ·À´½ÓÈë Internet ¹«Íø¡£

¡¡¡¡ÓÐЩÈË¿ÉÄÜ»áÎÊ£¬ ΪʲôÐèÒªÕâô×ö¡£ Ò»°ã¶øÑÔ£¬ ISP »áΪ·ÇÉÌÒµÓû§Ìṩ¶¯Ì¬µÄ IP µØÖ·¡£ ¶¯Ì¬µØÖ·Òâζ×Åÿ´ÎµÇ¼µ½ ISP ¶¼ÓпÉÄܵõ½²»Í¬µÄ IP µØÖ·£¬ ÎÞÂÛÊDzÉÓõ绰²¦ºÅµÇ¼£¬ »òʹÓà cable ÒÔ¼° DSL µ÷ÖÆ½âµ÷Æ÷µÄ·½Ê½¡£ Õâ¸ö IP ÊÇÄúÓë Internet ¹«Íø½»»¥Ê±Ê¹ÓõÄÉí·Ý¡£

¡¡¡¡ÏÖÔÚ¿¼ÂǼÒÖÐÓÐÎą̊ PC ÐèÒª·ÃÎÊ Internet µÄÇéÐΡ£ Äú¿ÉÄÜÐèÒªÏò ISP Ϊÿһ̨ PC ËùʹÓõĶÀÁ¢µÄ Internet Õ˺Ÿ¶·Ñ£¬ ²¢ÇÒÓµÓÐÎå¸ùµç»°Ïß¡£

¡¡¡¡ÓÐÁË NAT£¬ Äú¾ÍÖ»ÐèÒªÒ»¸ö ISP Õ˺ţ¬ È»ºó½«ÁíÍâËĄ̈ PC µÄÍø¿¨Í¨¹ý½»»»»úÁ¬½ÓÆðÀ´£¬ ²¢Í¨¹ýÔËÐÐ FreeBSD ϵͳµÄÄÇ̨»úÆ÷×÷ÎªÍø¹ØÁ¬½Ó³öÈ¥¡£ NAT »á×Ô¶¯µØ½«Ã¿Ò»Ì¨ PC ÔÚÄÚÍøµÄ LAN IP µØÖ·£¬ ÔÚÀ뿪·À»ðǽʱת»»Îª¹«ÍøµÄ IP µØÖ·¡£ ´ËÍ⣬ µ±Êý¾Ý°ü·µ»ØÊ±£¬ Ò²½«½øÐÐÄæÏòµÄת»»¡£

¡¡¡¡ÔÚ IP µØÖ·¿Õ¼äÖУ¬ ÓÐÒ»Ð©ÌØÊâµÄ·¶Î§ÊDZ£Áô¹©¾­¹ý NAT µÄÄÚÍø LAN IP µØÖ·Ê¹Óõġ£ ¸ù¾Ý RFC 1918£¬ ¿ÉÒÔʹÓÃÏÂÃæÕâЩ IP ·¶Î§ÓÃÓÚÄÚÍø£¬ ËüÃDz»»áÔÚ Internet ¹«ÍøÉÏ·ÓÉ£º

Æðʼ IP 10.0.0.0 - ½áÊø IP 10.255.255.255
Æðʼ IP 172.16.0.0 - ½áÊø IP 172.31.255.255
Æðʼ IP 192.168.0.0 - ½áÊø IP 192.168.255.255

30.5.15 IPNAT

¡¡¡¡NAT ¹æÔòÊÇͨ¹ý ipnat ÃüÁî¼ÓÔØµÄ¡£ ĬÈÏÇé¿öÏ£¬ NAT ¹æÔò»á±£´æÔÚ /etc/ipnat.rules ÎļþÖС£ Çë²Î¼û ipnat(1) Á˽â¸ü¶àµÄÏêÇé¡£

¡¡¡¡Èç¹ûÔÚ NAT ÒѾ­Æô¶¯Ö®ºóÏëÒªÐÞ¸Ä NAT ¹æÔò£¬ ¿ÉÒÔÐ޸ı£´æ NAT ¹æÔòµÄÄǸöÎļþ£¬ È»ºóÔÚÖ´ÐÐ ipnat ÃüÁîʱ¼ÓÉÏ -CF ²ÎÊý£¬ ÒÔɾ³ýÔÚÓÃµÄ NAT ÄÚ²¿¹æÔò±í£¬ ÒÔ¼°ËùÓеØÖ··­Òë±íÖÐÒÑÓеÄÏî¡£

¡¡¡¡ÒªÖØÐ¼ÓÔØ NAT ¹æÔò£¬ ¿ÉÒÔʹÓÃÀàËÆÏÂÃæµÄÃüÁ

# ipnat -CF -f /etc/ipnat.rules

¡¡¡¡Èç¹ûÏëÒª¿´¿´ÄúϵͳÉÏ NAT µÄͳ¼ÆÐÅÏ¢£¬ ¿ÉÒÔÓÃÏÂÃæµÄÃüÁ

# ipnat -s

¡¡¡¡ÒªÁгöµ±Ç°µÄ NAT ±íµÄÓ³Éä¹ØÏµ£¬ ʹÓÃÏÂÃæµÄÃüÁ

# ipnat -l

¡¡¡¡ÒªÏÔʾÏêϸµÄÐÅÏ¢²¢ÏÔʾÓë¹æÔò´¦ÀíºÍµ±Ç°µÄ¹æÔò/±íÏ

# ipnat -v

30.5.16 IPNAT ¹æÔò

¡¡¡¡NAT ¹æÔò·Ç³£µÄÁé»î£¬ Äܹ»ÊÊÓ¦ÉÌÒµÓû§ºÍ¼ÒÍ¥Óû§µÄ¸÷ÖÖ²»Í¬µÄÐèÇó¡£

¡¡¡¡ÕâÀïËù½éÉܵĹæÔòÓï·¨ÒѾ­±»¼ò»¯£¬ ÒÔÊÊÓ¦·ÇÉÌÓû·¾³ÖеÄÒ»°ãÇé¿ö¡£ ÍêÕûµÄ¹æÔòÓï·¨ÃèÊö£¬ Çë²Î¿¼ ipnat(5) Áª»úÊÖ²áÖеĽéÉÜ¡£

¡¡¡¡NAT ¹æÔòµÄд·¨ÓëÏÂÃæµÄÀý×ÓÀàËÆ£º

map IF LAN_IP_RANGE -> PUBLIC_ADDRESS

¡¡¡¡¹Ø¼ü´Ê map ³öÏÖÔÚ¹æÔòµÄ×îÇ°Ãæ¡£

¡¡¡¡½« IF Ìæ»»Îª¶ÔÍâµÄÍøÂç½Ó¿ÚÃû¡£

¡¡¡¡LAN_IP_RANGE ÊÇÄÚÍøÖеĿͻ§»úʹÓõĵØÖ··¶Î§¡£ ͨ³£Çé¿öÏ£¬ ÕâÓ¦¸ÃÊÇÀàËÆ 192.168.1.0/24 µÄµØÖ·¡£

¡¡¡¡PUBLIC_ADDRESS ¼È¿ÉÒÔÊÇÍâÍøµÄ IP µØÖ·£¬ Ò²¿ÉÒÔÊÇ 0/32 Õâ¸öÌØÊâµÄ¹Ø¼ü×Ö£¬ Ëü±íʾ·ÖÅäµ½ IF ÉϵÄËùÓеØÖ·¡£

30.5.17 NAT µÄ¹¤×÷Ô­Àí

¡¡¡¡µ±°ü´Ó LAN µ½´ï·À»ðǽ£¬ ¶øÄ¿µÄµØÖ·Êǹ«ÍøµØÖ·Ê±£¬ ËüÊ×ÏÈ»áͨ¹ý outbound ¹ýÂ˹æÔò¡£ ½ÓÏÂÀ´£¬ NAT »áµÃµ½°ü£¬ ²¢°´×Ô¶¥ÏòϵÄ˳Ðò´¦Àí¹æÔò£¬ ¶øµÚÒ»¸öÆ¥ÅäµÄ¹æÔò½«ÉúЧ¡£ NAT ½ÓÏÂÀ´»á¸ù¾Ý°ü¶ÔÓ¦µÄ½Ó¿ÚÃû×ÖºÍÔ´ IP µØÖ·¼ì²éËùÓеĹæÔò¡£ Èç¹û°üºÍij¸ö NAT ¹æÔòÆ¥Å䣬 Ôò»á¼ì²é°üµÄ (Ô´ IP µØÖ·£¬ ÀýÈ磬 ÄÚÍøµÄ IP µØÖ·) ÊÇ·ñÔÚ NAT ¹æÔòÖмýÍ·×ó²àÖ¸¶¨µÄ IP µØÖ··¶Î§Æ¥Åä¡£ Èç¹ûÆ¥Å䣬 Ôò°üµÄÔ­µØÖ·½«±»¸ù¾ÝÓà 0/32 ¹Ø¼ü×ÖÖ¸¶¨µÄ IP µØÖ·ÖØÐ´¡£ NAT ½«ÏòËüµÄÄÚ²¿ NAT ±í·¢Ëʹ˵ØÖ·£¬ ÕâÑù£¬ µ±°ü´Ó Internet ¹«ÍøÖзµ»ØÊ±£¬ ¾ÍÄܹ»°ÑµØÖ·Ó³Éä»ØÔ­ÏȵÄÄÚÍø IP µØÖ·£¬ ²¢ÔÚËæºóʹÓùýÂËÆ÷¹æÔòÀ´´¦Àí¡£

30.5.18 ÆôÓÃ IPNAT

¡¡¡¡ÒªÆôÓà IPNAT£¬ Ö»ÐèÔÚ /etc/rc.conf ÖмÓÈëÏÂÃæÒ»Ð©Óï¾ä¡£

¡¡¡¡Ê¹»úÆ÷Äܹ»ÔÚ²»Í¬µÄÍøÂç½Ó¿ÚÖ®¼ä½øÐаüµÄת·¢£¬ ÐèÒª£º

gateway_enable="YES"

¡¡¡¡Ã¿´Î¿ª»úʱ×Ô¶¯Æô¶¯ IPNAT£º

ipnat_enable="YES"

¡¡¡¡Ö¸¶¨ IPNAT ¹æÔò¼¯Îļþ£º

ipnat_rules="/etc/ipnat.rules"

30.5.19 ´óÐÍ LAN ÖÐµÄ NAT

¡¡¡¡¶ÔÓÚÔÚÒ»¸ö LAN ÖÐÓдóÁ¿ PC£¬ ÒÔ¼°°üº¬¶à¸ö LAN µÄÇéÐΣ¬ °ÑËùÓеÄÄÚÍø IP µØÖ·¶¼Ó³É䵽ͬһ¸ö¹«Íø IP ÉϻᵼÖÂ×ÊÔ´²»¹»µÄÎÊÌ⣬ ÒòΪͬһ¸ö¶Ë¿Ú¿ÉÄÜÔÚÐí¶à×öÁË NAT µÄ LAN PC Éϱ»¶à´ÎʹÓ㬠²¢µ¼ÖÂÅöײ¡£ ÓÐÁ½ÖÖ·½·¨À´»º½âÕâ¸öÄÑÌâ¡£

30.5.19.1 Ö¸¶¨Ê¹ÓÃÄÄЩ¶Ë¿Ú

¡¡¡¡ÆÕͨµÄ NAT ¹æÔòÀàËÆÓÚ£º

map dc0 192.168.1.0/24 -> 0/32

¡¡¡¡ÉÏÃæµÄ¹æÔòÖУ¬ °üµÄÔ´¶Ë¿ÚÔÚ°üͨ¹ý IPNAT ʱʱ²»»á·¢Éú±ä»¯µÄ¡£ ͨ¹ýʹÓà portmap ¹Ø¼ü×Ö£¬ Äú¿ÉÒÔÒªÇó IPNAT ֻʹÓÃÖ¸¶¨·¶Î§ÄڵĶ˿ڵØÖ·¡£ ±ÈÈç˵£¬ ÏÂÃæµÄ¹æÔò½«Èà IPNAT °ÑÔ´¶Ë¿Ú¸ÄΪָ¶¨·¶Î§ÄڵĶ˿ڣº

map dc0 192.168.1.0/24 -> 0/32 portmap tcp/udp 20000:60000

¡¡¡¡Ê¹Óà auto ¹Ø¼ü×Ö¿ÉÒÔÈÃÅäÖñäµÃ¸ü¼òµ¥Ò»Ð©£¬ Ëü»áÒªÇó IPNAT ×Ô¶¯µØ¼ì²â¿ÉÓõĶ˿ڲ¢Ê¹Óãº

map dc0 192.168.1.0/24 -> 0/32 portmap tcp/udp auto

30.5.19.2 ʹÓù«ÍøµØÖ·³Ø

¡¡¡¡¶ÔºÜ´óµÄ LAN ¶øÑÔ£¬ ×ÜÓÐÒ»Ìì»á´ïµ½ÕâÑùÒ»¸öÁÙ½çÖµ£¬ ´ËʱµÄ LAN µØÖ·ÒѾ­¶àµ½ÁËÎÞ·¨Ö»ÓÃÒ»¸ö¹«ÍøµØÖ·±íÏֵij̶ȡ£ Èç¹ûÓпÉÓõÄÒ»¿é¹«Íø IP µØÖ·£¬ Ôò¿ÉÒÔ½«ÕâЩµØÖ·×÷Ϊһ¸ö ¡°µØÖ·³Ø¡± À´Ê¹Ó㬠Èà IPNAT À´´ÓÕâЩ¹«Íø IP µØÖ·ÖÐÌôÑ¡ÓÃÓÚ·¢°üµÄµØÖ·£¬ ²¢½«ÆäΪÕâЩ°ü´´½¨Ó³Éä¹ØÏµ¡£

¡¡¡¡ÀýÈ磬 Èç¹û½«ÏÂÃæÕâ¸ö°ÑËùÓаü¶¼Ó³É䵽ͬһ¹«Íø IP µØÖ·µÄ¹æÔò£º

map dc0 192.168.1.0/24 -> 204.134.75.1

¡¡¡¡ÉÔ×÷Ð޸ģ¬ ¾Í¿ÉÒÔÓÃ×ÓÍøÑÚÂëÀ´±í´ï IP µØÖ··¶Î§£º

map dc0 192.168.1.0/24 -> 204.134.75.0/255.255.255.0

¡¡¡¡»òÕßÓà CIDR ¼Ç·¨À´Ö¸¶¨µÄÒ»×鵨ַÁË£º

map dc0 192.168.1.0/24 -> 204.134.75.0/24

30.5.20 ¶Ë¿ÚÖØ¶¨Ïò

¡¡¡¡·Ç³£Á÷ÐеÄÒ»ÖÖ×ö·¨ÊÇ£¬ ½« web ·þÎñÆ÷¡¢ Óʼþ·þÎñÆ÷¡¢ Êý¾Ý¿â·þÎñÆ÷ÒÔ¼° DNS ·Ö±ð·Åµ½ LAN ÉϵIJ»Í¬µÄ PC ÉÏ¡£ ÕâÖÖÇé¿öÏ£¬ À´×ÔÕâЩ·þÎñÆ÷µÄÍøÂçÁ÷Á¿ÈÔȻӦ¸Ã±» NAT£¬ µ«±ØÐëÓа취°Ñ½øÈëµÄÁ÷Á¿·¢µ½¶ÔÓ¦µÄ¾ÖÓòÍøµÄ PC ÉÏ¡£ IPNAT ÌṩÁË NAT ÖØ¶¨Ïò»úÖÆÀ´½â¾öÕâ¸öÎÊÌâ¡£ ¿¼ÂÇÏÂÃæµÄÇé¿ö£¬ ÄúµÄ web ·þÎñÆ÷µÄ LAN µØÖ·ÊÇ 10.0.10.25£¬ ¶øÄúµÄΨһµÄ¹«Íø IP µØÖ·ÊÇ 20.20.20.5£¬ Ôò¿ÉÒÔ±àдÕâÑùµÄ¹æÔò£º

rdr dc0 20.20.20.5/32 port 80 -> 10.0.10.25 port 80

¡¡¡¡»òÕߣº

rdr dc0 0.0.0.0/0 port 80 -> 10.0.10.25 port 80

¡¡¡¡ÁíÍ⣬ Ò²¿ÉÒÔÈà LAN µØÖ· 10.0.10.33 ÉÏÔËÐÐµÄ LAN DNS ·þÎñÆ÷À´´¦Àí¹«ÍøÉ쵀 DNS ÇëÇó£º

rdr dc0 20.20.20.5/32 port 53 -> 10.0.10.33 port 53 udp

30.5.21 FTP ºÍ NAT

¡¡¡¡FTP ÊÇÒ»¸öÔÚ Internet Èç½ñÌìÕâÑùΪÈËËùÊì֪֮ǰ¾ÍÒѾ­³öÏֵĿÖÁú£¬ ÄÇʱ£¬ Ñо¿»ú¹¹ºÍ´óѧÊÇͨ¹ý×âÓõÄÏß·Á¬µ½Ò»ÆðµÄ£¬ ¶ø FTP Ôò±»ÓÃÓÚÔÚ¿ÆÑÐÈËÔ±Ö®¼ä¹²Ïí´óÎļþ¡£ ÄÇʱ£¬ Êý¾ÝµÄ°²È«ÐÔ²¢²»ÊÇÐèÒª¿¼ÂǵÄÊÂÇé¡£ Èô¸ÉÄêÖ®ºó£¬ FTP ЭÒéÔò±»Âñ½øÁËÕýÔÚÐγÉÖÐµÄ Internet ¹Ç¸É£¬ ¶øËüʹÓÃÃ÷ÎÄÀ´½»»»Óû§ÃûºÍ¿ÚÁîµÄȱµã£¬ ²¢Ã»ÓÐËæ×ÅгöÏÖµÄһЩ°²È«ÐèÇó¶øµÃµ½¸Ä±ä¡£ FTP ÌṩÁËÁ½ÖÖ²»Í¬µÄ·ç¸ñ£¬ ¼´Ö÷¶¯Ä£Ê½ºÍ±»¶¯Ä£Ê½¡£ Á½ÕßµÄÇø±ðÔÚÓÚÊý¾ÝͨµÀµÄ½¨Á¢·½Ê½¡£ ±»¶¯Ä£Ê½Ïà¶Ô¶øÑÔÒª¸ü¼Ó°²È«£¬ ÒòΪÊý¾ÝͨµÀÊÇÓÉ·¢Æð ftp »á»°µÄÒ»·½½¨Á¢µÄ¡£ ¹ØÓÚ FTP ÒÔ¼°ËüËùÌṩµÄ²»Í¬Ä£Ê½£¬ ÔÚ http://www.slacksite.com/other/ftp.html ½øÐÐÁ˺ܺõIJûÊö¡£

30.5.21.1 IPNAT ¹æÔò

¡¡¡¡IPNAT ÌṩÁËÒ»¸öÄÚ½¨µÄ FTP ´úÀíÑ¡Ï Ëü¿ÉÒÔÔÚ NAT map ¹æÔòÖÐÖ¸¶¨¡£ ËüÄܹ»¼àÊÓËùÓÐÍâ·¢µÄ FTP Ö÷¶¯»ò±»¶¯Ä£Ê½µÄ»á»°¿ªÊ¼ÇëÇó£¬ ²¢¶¯Ì¬µØ´´½¨ÁÙʱÐԵĹýÂËÆ÷¹æÔò£¬ Ö»´ò¿ªÓÃÓÚÊý¾ÝͨµÀµÄ¶Ë¿ÚºÅ¡£ ÕâÑù£¬ ¾ÍÏû³ýÁË FTP Ò»°ã»á¸ø·À»ðǽ´øÀ´µÄ£¬ ÐèÒª´ó·¶Î§µØ´ò¿ª¸ß¶Ë¿ÚËù¿ÉÄÜ´øÀ´µÄ°²È«Òþ»¼¡£

¡¡¡¡ÏÂÃæµÄ¹æÔò¿ÉÒÔ´¦ÀíÀ´×ÔÄÚÍøµÄ FTP ·ÃÎÊ£º

map dc0 10.0.10.0/29 -> 0/32 proxy port 21 ftp/tcp

¡¡¡¡Õâ¸ö¹æÔòÄܹ»´¦ÀíÀ´×ÔÍø¹ØµÄ FTP ·ÃÎÊ£º

map dc0 0.0.0.0/0 -> 0/32 proxy port 21 ftp/tcp

¡¡¡¡Õâ¸öÔò´¦ÀíËùÓÐÀ´×ÔÄÚÍøµÄ·Ç FTP ÍøÂçÁ÷Á¿£º

map dc0 10.0.10.0/29 -> 0/32

¡¡¡¡FTP map ¹æÔòÓ¦¸ÃÔÚÆÕͨµÄ map ¹æÔò֮ǰ³öÏÖ¡£ ËùÓеİü»á´Ó×îÉÏÃæµÄµÚÒ»¸ö¹æÔò¿ªÊ¼½øÐмì²é¡£ Æ¥ÅäµÄ˳ÐòÊÇÍø¿¨Ãû³Æ£¬ ÄÚÍøÔ´ IP µØÖ·£¬ ÒÔ¼°ËüÊÇ·ñÊÇ FTP °ü¡£ Èç¹ûËùÓÐÕâЩ¹æÔò¶¼Æ¥Åä³É¹¦£¬ Ôò FTP ´úÀí½«½¨Á¢Ò»¸öÁÙʱµÄ¹ýÂ˹æÔò£¬ ÒÔ±ãÈà FTP »á»°µÄÊý¾Ý°üÄܹ»Õý³£³öÈ룬 ͬʱ¶ÔÕâЩ°ü½øÐÐ NAT¡£ ËùÓÐµÄ LAN Êý¾Ý°ü£¬ Èç¹ûûÓÐÆ¥ÅäµÚÒ»Ìõ¹æÔò£¬ Ôò»á¼ÌÐø³¢ÊÔÆ¥ÅäÏÂÃæµÄ¹æÔò£¬ ²¢×îÖÕ±» NAT¡£

30.5.21.2 IPNAT FTP ¹ýÂ˹æÔò

¡¡¡¡Èç¹ûʹÓÃÁË NAT FTP ´úÀí£¬ ÔòÖ»ÐèҪΪ FTP ´´½¨Ò»¸ö¹æÔò¡£

¡¡¡¡Èç¹û²»Ê¹Óà FTP ´úÀí£¬ ¾ÍÐèÒªÏÂÃæÕâÈý¸ö¹æÔò£º

# Allow out LAN PC client FTP to public Internet
# Active and passive modes
pass out quick on rl0 proto tcp from any to any port = 21 flags S keep state

# Allow out passive mode data channel high order port numbers
pass out quick on rl0 proto tcp from any to any port > 1024 flags S keep state

# Active mode let data channel in from FTP server
pass in quick on rl0 proto tcp from any to any port = 20 flags S keep state

±¾ÎĵµºÍÆäËüÎĵµ¿É´ÓÕâÀïÏÂÔØ£ºftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.

Èç¹û¶ÔÓÚFreeBSDÓÐÎÊÌ⣬ÇëÏÈÔĶÁÎĵµ£¬Èç²»Äܽâ¾öÔÙÁªÏµ<questions@FreeBSD.org>.
¹ØÓÚ±¾ÎĵµµÄÎÊÌâÇë·¢ÐÅÁªÏµ <doc@FreeBSD.org>.