FreeBSD ipfw 防火墙基础指南
软件教程导读
互联网集市收集整理了【FreeBSD ipfw 防火墙基础指南】电脑软件教程,小编现在分享给大家,供广大互联网技能从业者学习和参考。文章包含3947字,纯文字阅读大概需要6分钟。
软件教程内容图文
/usr/src/sys/i386/conf/HQ_SuperServer
[code:1:66aaf20915]options IPFIREWALL
options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPDIVERT # IPDIVERT enables the divert IP sockets, used by ""ipfw divert""
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=30
#options IPFILTER #ipfilter support
#options IPFILTER_LOG #ipfilter logging
# traffic shaper, bandwidth manager and delay emulator
options DUMMYNET # enables the "dummynet" bandwidth limiter. You need IPFIREWALL as well.
# Statically Link in accept filters for a web server on this box
options ACCEPT_FILTER_DATA
options ACCEPT_FILTER_HTTP
options ICMP_BANDLIM # D.O.S. protection
options IPSTEALTH #To hide firewall from traceroute
options TCP_DROP_SYNFIN #To hide from nmap OS fingerprint, remove if create web server[/code:1:66aaf20915]
二、rc.conf配置
/etc/rc.conf
[code:1:66aaf20915]firewall_enable="YES"
firewall_logging="YES"
firewall_script="/etc/rc.firewall"
firewall_quIEt="NO" #change to YES once happy with rules
firewall_logging_enable="YES"
#extra firewalling options
log_in_vain="YES"
#This option prevents something known as OS fingerprinting, must have TCP_DROP_SYNFIN compiled into kernel to use
tcp_drop_synfin="NO" #change to NO if create webserver
tcp_restrict_rst="YES"
icmp_drop_redirect="YES"[/code:1:66aaf20915]
三、ipfw使用
[code:1:66aaf20915]ipfw add allow tcp from to in recv [/code:1:66aaf20915]
添加和除去规则例子:
[code:1:66aaf20915]$ sudo ipfw add deny tcp from 61.49.203.115 to 61.49.203.114 22 in recv fxp0
$ sudo ipfw -t list
$ sudo ipfw delete 00100[/code:1:66aaf20915]
禁止icmp
[code:1:66aaf20915]$ sudo ipfw add deny icmp from any to any in recv fxp0[/code:1:66aaf20915]
显示rules
[code:1:66aaf20915]$ sudo ipfw show[/code:1:66aaf20915]
按照序号显示规则
[code:1:66aaf20915]$ sudo ipfw -t list[/code:1:66aaf20915]
列出信息包的数目,和与它们相对应的规则匹配
[code:1:66aaf20915]$ sudo ipfw -a list[/code:1:66aaf20915]
四、/etc/ipfw.rules规则文件
[code:1:66aaf20915]allow 00010 udp from any to me 67 in via $iif
allow 00020 udp from me 68 to any out via $iif[/code:1:66aaf20915]
五、/etc/rc.firewall脚本
[code:1:66aaf20915]# mv /etc/rc.firewall /etc/rc.firewall.orig
# touch /etc/rc.firewall
# chmod u=+rx,og=-rwx /etc/ipfw.rules[/code:1:66aaf20915]
/etc/rc.firewall
[code:1:66aaf20915]#!/bin/sh
# This will flush the existing rules - sudo ipfw -f flush
# You can execute this script without dropping existing connections/states
fwcmd="/sbin/ipfw -q"
extif="fxp0"
myip="10.1.8.114"
mybcast="10.1.8.119"
mynetwork="10.1.8.112/29"
dns_server="10.1.8.1"
# Reset all rules in case script run multiple times
${fwcmd} -f flush
${fwcmd} add 200 check-state
# Block RFC 1918 networks - the , syntax only works in ipfw2
${fwcmd} add 210 deny all from 0.0.0.0/7,1.0.0.0/8,2.0.0.0/8,5.0.0.0/8,10.0.0.0/8,23.0.0.0/8,
27.0.0.0/8,31.0.0.0/8,67.0.0.0/8,68.0.0.0/6,72.0.0.0/5,80.0.0.0/4,96.0.0.0/3,127.0.0.0/8,
128.0.0.0/16,128.66.0.0/16,169.254.0.0/16,172.16.0.0/12,191.255.0.0/16,192.0.0.0/16,
192.168.0.0/16,197.0.0.0/8,201.0.0.0/8,204.152.64.0/23,224.0.0.0/3,240.0.0.0/8 to any
# Allow all via loopback to loopback
${fwcmd} add 220 allow all from any to any via lo0
# Allow from me to anywhere
${fwcmd} add 240 allow tcp from ${myip} to any setup keep-state
${fwcmd} add 260 allow udp from ${myip} to any keep-state
${fwcmd} add 280 allow icmp from ${myip} to any
# Allow local LAN to connect to us
${fwcmd} add 300 allow ip from ${mynetwork} to ${mynetwork}
# Allow INCOMING SSH,SMTP,HTTP from anywhere on the internet
${fwcmd} add 320 allow log tcp from any to ${myip} 22,25,80 in keep-state setup
# Disable icmp
${fwcmd} add 340 allow icmp from any to any icmptype 0,3,11
# Block all other traffic and log in
${fwcmd} add 360 deny log all from any to any
# End of /etc/rc.firewall[/code:1:66aaf20915]
六、 ipfw日志纪录配置
/etc/syslog.conf
[code:1:66aaf20915]!ipfw
*.* /var/log/ipfw.log[/code:1:66aaf20915]
[code:1:66aaf20915]$ sudo touch /var/log/ipfw.log
$ sudo killall -HUP syslogd[/code:1:66aaf20915]
软件教程总结
以上是互联网集市为您收集整理的【FreeBSD ipfw 防火墙基础指南】电脑软件教程的全部内容,希望文章能够帮你了解电脑软件教程FreeBSD ipfw 防火墙基础指南。 如果觉得互联网集市电脑软件教程内容还不错,欢迎将互联网集市网站推荐给好友。
软件教程备注
版权声明:本文内容由互联网用户贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 gblab@vip.qq.com 举报,一经查实,本站将立刻删除。
软件教程手机端
扫描二维码推送至手机访问。