|
ru.unix.bsd
- RU.UNIX.BSD ------------------------------------------------------------------
From : Alexander Chagadaev 2:5020/400 12 Feb 2005 14:18:07
To : All
Subject : ipfw правила для гейта
--------------------------------------------------------------------------------
Hi All,
Гляньте, пожалуйста, на правила - всё работает, но наверняка что-то сделано не
лучшим образом или просто небезопасно. Заранее спасибо!
oif/iif - внешний/внутренний интерфейс, onet/inet - внешняя/внутренняя сеть
Вопросы:
1) Мои NAT'ом не сможет воспользоваться никто, кроме юзеров ${inet}?
2) Имеет ли смысл разбивать правило для natd на два, то есть писать
так
${fwcmd} add divert natd ip from any to any via ${oif}
или так
${fwcmd} add divert natd ip from ${inet} to any via ${oif}
${fwcmd} add divert natd ip from any to ${oip} via ${oif}
rc.conf:
natd_flags="-deny_incoming -log_denied -use_sockets -same_ports
-unregistered_only"
ipfw.rules:
############
# Suck in the configuration variables.
#
if [ -z "${source_rc_confs_defined}" ]; then
if [ -r /etc/defaults/rc.conf ]; then
. /etc/defaults/rc.conf
source_rc_confs
elif [ -r /etc/rc.conf ]; then
. /etc/rc.conf
fi
fi
############
# Set quiet mode if requested
#
case ${firewall_quiet} in [Yy][Ee][Ss])
fwcmd="/sbin/ipfw -q"
;;
*)
fwcmd="/sbin/ipfw"
;;
esac
############
# Flush out the list before we begin
#
${fwcmd} -f flush
# Check dynamic rules
${fwcmd} add check-state
# Stop spoofing
${fwcmd} add deny log ip from ${inet} to any in via ${oif}
${fwcmd} add deny log ip from ${onet} to any in via ${iif}
# Rules for lo0
${fwcmd} add allow ip from any to any via lo0
# Rules for ppp0. Хожу только я, поэтому такое правило
${fwcmd} add allow ip from any to any via ppp0 keep-state
# Stop some ICMP pakets and allow other
${fwcmd} add allow icmp from any to any in not icmptype 5,9,13,14,15,16,17
# Allow all outgoing from server
${fwcmd} add allow ip from ${oip} to any keep-state
${fwcmd} add allow ip from ${iip} to any keep-state
# Allow access to our services
${fwcmd} add allow ip from any to ${oip}
ftp\\-data,ftp,49152-65535,ssh,smtp,smtps,domain,http,https,pop3,pop3s,imap,ima
ps,24554 keep-state
${fwcmd} add allow ip from any to ${iip}
ftp\\-data,ftp,49152-65535,ssh,smtp,smtps,domain,http,https,pop3,pop3s,imap,ima
ps,24554 keep-state
############
# Rules for gateway only
#
case ${natd_enable} in [Yy][Ee][Ss])
# Block users
${fwcmd} add deny ip from 192.168.0.92 to any
# Network Address Translation
#${fwcmd} add divert natd ip from any to any via ${oif}
${fwcmd} add divert natd ip from ${inet} to any via ${oif}
${fwcmd} add divert natd ip from any to ${oip} via ${oif}
# Rules for NATed packets
${fwcmd} add allow ip from ${oip} to any
# Allow users to have Internet
${fwcmd} add allow ip from ${inet} to any
${fwcmd} add allow ip from any to ${inet}
esac
############
# Drop all connections w/out logging: - on netbios ports
${fwcmd} add deny ip from any to any 135,137,138,139,microsoft-ds
# Drop all connections w/out logging: - broadcast
${fwcmd} add deny ip from any to 255.255.255.255
# Drop any other packets & log it
${fwcmd} add deny log ip from any to any
Wbr, adc.
--- ifmail v.2.15dev5.3
* Origin: FidoNet Online - http://www.fido-online.com (2:5020/400)
Вернуться к списку тем, сортированных по: возрастание даты уменьшение даты тема автор
|
