30.6 IPFW

¡¡¡¡IPFIREWALL (IPFW) ÊÇÒ»¸öÓÉ FreeBSD ·¢ÆðµÄ·À»ðǽӦÓÃÈí¼þ£¬ ËüÓÉ FreeBSD µÄÖ¾Ô¸Õß³ÉÔ±±àдºÍά»¤¡£ ËüʹÓÃÁË´«Í³µÄÎÞ״̬¹æÔòºÍ¹æÔò±àд·½Ê½£¬ ÒÔÆÚ´ïµ½¼òµ¥×´Ì¬Âß¼­ËùÆÚÍûµÄÄ¿±ê¡£

¡¡¡¡±ê×¼µÄ FreeBSD °²×°ÖУ¬ IPFW Ëù¸ø³öµÄ¹æÔò¼¯ÑùÀý (¿ÉÒÔÔÚ /etc/rc.firewall ºÍ /etc/rc.firewall6 ÖÐÕÒµ½) ·Ç³£¼òµ¥£¬ ½¨Òé²»Òª²»¼ÓÐ޸ĵØÖ±½ÓʹÓᣠ¸ÃÑùÀýÖÐûÓÐʹÓÃ״̬¹ýÂË£¬ ¶ø¸Ã¹¦ÄÜÔڴ󲿷ֵÄÅäÖÃÖж¼ÊǷdz£ÓÐÓõģ¬ Òò´ËÕâÒ»½Ú²¢²»ÒÔϵͳ×Ô´øµÄÑùÀý×÷Ϊ»ù´¡¡£

¡¡¡¡IPFW µÄÎÞ״̬¹æÔòÓï·¨£¬ ÊÇÓÉÒ»ÖÖÌṩ¸´ÔÓµÄÑ¡ÔñÄÜÁ¦µÄ¼¼ÊõÖ§³ÖµÄ£¬ ÕâÖÖ¼¼ÊõÔ¶Ô¶³¬³öÁËÒ»°ãµÄ·À»ðǽ°²×°ÈËÔ±µÄ֪ʶˮƽ¡£ IPFW ÊÇΪÂú×ãרҵÓû§£¬ ÒÔ¼°ÕÆÎÕÏȽø¼¼ÊõµÄµçÄÔ°®ºÃÕßÃǶÔÓڸ߼¶µÄ°üÑ¡ÔñÐèÇó¶øÉè¼ÆµÄ¡£ ÒªÍêÈ«ÊÍ·Å IPFW µÄ¹æÔòËùÓµÓеÄÇ¿´óÄÜÁ¦£¬ ÐèÒª¶Ô²»Í¬µÄЭÒéµÄϸ½ÚÓÐÉîÈëµÄÁ˽⣬ ²¢¸ù¾ÝËüÃǶÀÌØµÄ°üÍ·ÐÅÏ¢À´±àд¹æÔò¡£ ÕâÒ»¼¶±ðµÄÏêϸ²ûÊö³¬³öÁËÕâ±¾ÊÖ²áµÄ·¶Î§¡£

¡¡¡¡IPFW Óɯߏö²¿·Ö×é³É£¬ ÆäÖ÷Òª×é¼þÊÇÄں˵ķÀ»ðǽ¹ýÂ˹æÔò´¦ÀíÆ÷£¬ ¼°Æä¼¯³ÉµÄÊý¾Ý°ü¼ÇÕʹ¤¾ß¡¢ ÈÕÖ¾¹¤¾ß¡¢ ÓÃÒÔ´¥·¢ NAT ¹¤¾ßµÄ divert (ת·¢) ¹æÔò¡¢ ¸ß¼¶ÌØÊâÓÃ;¹¤¾ß¡¢ dummynet Á÷Á¿ÕûÐλúÖÆ£¬ fwd rule ת·¢¹¤¾ß£¬ ÇŽӹ¤¾ß£¬ ÒÔ¼° ipstealth ¹¤¾ß¡£ IPFW Ö§³Ö IPv4 ºÍ IPv6¡£

30.6.1 ÆôÓÃ IPFW

¡¡¡¡IPFW ÊÇ»ù±¾µÄ FreeBSD °²×°µÄÒ»²¿·Ö£¬ ÒÔµ¥¶ÀµÄ¿É¼ÓÔØÄÚºËÄ£¿éµÄÐÎʽÌṩ¡£ Èç¹ûÔÚ rc.conf ÖмÓÈë firewall_enable="YES" Óï¾ä£¬ ¾Í»á×Ô¶¯µØ¼ÓÔØ¶ÔÓ¦µÄÄÚºËÄ£¿é¡£ ³ý·ÇÄú´òËãʹÓÃÓÉËüÌṩµÄ NAT ¹¦ÄÜ£¬ Ò»°ãÇé¿öϲ¢²»ÐèÒª°Ñ IPFW ±à½ø FreeBSD µÄÄںˡ£

¡¡¡¡Èç¹û½« firewall_enable="YES" ¼ÓÈëµ½ rc.conf Öв¢ÖØÐÂÆô¶¯ÏµÍ³£¬ ÔòÏÂÁÐÐÅÏ¢½«ÔÚÆô¶¯¹ý³ÌÖУ¬ ÒÔ¸ßÁÁµÄ°×É«ÏÔʾ³öÀ´£º

ipfw2 initialized, divert disabled, rule-based forwarding disabled, default to deny, logging disabled

¡¡¡¡¿É¼ÓÔØÄÚºËÄ£¿éÔÚ±àÒëʱ¼ÓÈëÁ˼ǼÈÕÖ¾µÄÄÜÁ¦¡£ ÒªÆôÓÃÈÕÖ¾¹¦ÄÜ£¬ ²¢ÅäÖÃÏêϸÈÕÖ¾¼Ç¼µÄÏÞÖÆ£¬ ÐèÒªÔÚ /etc/sysctl.conf ÖмÓÈëһЩÅäÖᣠÕâЩÉèÖý«ÔÚÖØÐÂÆô¶¯Ö®ºóÉúЧ£º

net.inet.ip.fw.verbose=1
net.inet.ip.fw.verbose_limit=5

30.6.2 ÄÚºËÑ¡Ïî

¡¡¡¡°ÑÏÂÁÐÑ¡ÏîÔÚ±àÒë FreeBSD ÄÚºËʱ¾Í¼ÓÈ룬 ²¢²»ÊÇÆôÓà IPFW Ëù±ØÐèµÄ£¬ ³ý·ÇÄúÐèҪʹÓà NAT ¹¦ÄÜ¡£ ÕâÀïÖ»Êǽ«ÕâЩѡÏî×÷Ϊ±³¾°ÖªÊ¶À´½éÉÜ¡£

options    IPFIREWALL

¡¡¡¡Õâ¸öÑ¡Ï IPFW ×÷ΪÄں˵ÄÒ»²¿·ÖÀ´ÆôÓá£

options    IPFIREWALL_VERBOSE

¡¡¡¡Õâ¸öÑ¡ÏÆôÓüǼͨ¹ý IPFW µÄÆ¥ÅäÁ˰üº¬ log ¹Ø¼ü×Ö¹æÔòµÄÿһ¸ö°üµÄ¹¦ÄÜ¡£

options    IPFIREWALL_VERBOSE_LIMIT=5

¡¡¡¡ÒÔÿÏîµÄ·½Ê½£¬ ÏÞÖÆÍ¨¹ý syslogd(8) ¼Ç¼µÄ°üµÄ¸öÊý¡£ Èç¹ûÔڱȽ϶ñÁӵĻ·¾³Ï¼Ç¼·À»ðǽµÄ»î¶¯¿ÉÄÜ»áÐèÒªÕâ¸öÑ¡Ïî¡£ ËüÄܹ»±ÜÃâDZÔÚµÄÕë¶Ô syslog µÄºéˮʽ¾Ü¾ø·þÎñ¹¥»÷¡£

options    IPFIREWALL_DEFAULT_TO_ACCEPT

¡¡¡¡Õâ¸öÑ¡ÏîĬÈϵØÔÊÐíËùÓеİüͨ¹ý·À»ðǽ£¬ Èç¹ûÄúÊǵÚÒ»´ÎÅäÖ÷À»ðǽ£¬ ʹÓÃÕâ¸öÑ¡ÏÊÇÒ»¸ö²»´íµÄÖ÷Òâ¡£

options    IPDIVERT

¡¡¡¡ÕâһѡÏîÆôÓà NAT ¹¦ÄÜ¡£

×¢Òâ: Èç¹ûÄÚºËÑ¡ÏîÖÐûÓмÓÈë IPFIREWALL_DEFAULT_TO_ACCEPT£¬ ¶øÅäÖÃʹÓõĹæÔò¼¯ÖÐҲûÓÐÃ÷È·µØÖ¸¶¨ÔÊÐíÁ¬½Ó½øÈëµÄ¹æÔò£¬ ĬÈÏÇé¿öÏ£¬ ·¢µ½±¾»úºÍ´Ó±¾»ú·¢³öµÄËùÓаü¶¼»á±»×èÖ¹¡£

30.6.3 /etc/rc.conf Options

¡¡¡¡ÆôÓ÷À»ðǽ£º

firewall_enable="YES"

¡¡¡¡ÒªÑ¡ÔñÓÉ FreeBSD ÌṩµÄ¼¸ÖÖ·À»ðǽÀàÐÍÖеÄÒ»ÖÖÀ´×÷ΪĬÈÏÅäÖ㬠ÄúÐèÒªÔĶÁ /etc/rc.firewall Îļþ²¢Ñ¡³öºÏÊʵÄÀàÐÍ£¬ È»ºóÔÚ /etc/rc.conf ÖмÓÈëÀàËÆÏÂÃæµÄÅäÖãº

firewall_type="open"

¡¡¡¡Äú»¹¿ÉÒÔÖ¸¶¨ÏÂÁÐÅäÖùæÔòÖ®Ò»£º

¡¡¡¡ÓÐÁ½ÖÖ¼ÓÔØ×Ô¶¨Òå ipfw ·À»ðǽ¹æÔòµÄ·½·¨¡£ ÆäÒ»Êǽ«±äÁ¿ firewall_type ÉèΪ°üº¬²»´ø ipfw(8) ÃüÁîÐÐÑ¡ÏîµÄ ·À»ðǽ¹æÔò ÎļþµÄÍêÕû·¾¶¡£ ÏÂÃæÊÇÒ»¸ö¼òµ¥µÄ¹æÔò¼¯Àý×Ó£º

add deny in
add deny out

¡¡¡¡³ý´ËÖ®Í⣬ Ò²¿ÉÒÔ½« firewall_script ±äÁ¿ÉèΪ°üº¬ ipfw ÃüÁîµÄ¿ÉÖ´Ðнű¾£¬ ÕâÑùÕâ¸ö½Å±¾»áÔÚÆô¶¯Ê±×Ô¶¯Ö´ÐС£ ÓëÇ°Ãæ¹æÔò¼¯ÎļþµÈ¼ÛµÄ¹æÔò½Å±¾ÈçÏ£º

¡¡¡¡ipfw ÃüÁîÊÇÔÚ·À»ðǽÔËÐÐʱ£¬ ÓÃÓÚÔÚÆäÄÚ²¿¹æÔò±íÖÐÊÖ¹¤ÖðÌõÌí¼Ó»òɾ³ý·À»ðǽ¹æÔòµÄ±ê×¼¹¤¾ß¡£ ÕâÒ»·½·¨µÄÎÊÌâÔÚÓÚ£¬ Ò»µ©ÄúµÄ¹Ø±Õ¼ÆËã»ú»òÍ£»ú£¬ ÔòËùÓÐÔö¼Ó»òɾ³ý»òÐ޸ĵĹæÔòÒ²¾Í¶ªµôÁË¡£ °ÑËùÓеĹæÔò¶¼Ð´µ½Ò»¸öÎļþÖУ¬ ²¢ÔÚÆô¶¯Ê±Ê¹ÓÃÕâ¸öÎļþÀ´¼ÓÔØ¹æÔò£¬ »òÒ»´Î´óÅúÁ¿µØÌæ»»·À»ðǽ¹æÔò£¬ ÄÇÃ´ÍÆ¼öʹÓÃÕâÀï½éÉܵķ½·¨¡£

¡¡¡¡ipfw µÄÁíÒ»¸ö·Ç³£ÊµÓõŦÄÜÊǽ«ËùÓÐÕýÔÚÔËÐеķÀ»ðǽ¹æÔòÏÔʾ³öÀ´¡£ IPFW µÄ¼ÇÕË»úÖÆ»áΪÿһ¸ö¹æÔò¶¯Ì¬µØ´´½¨¼ÆÊýÆ÷£¬ ÓÃÒԼǼÓëËüÃÇÆ¥ÅäµÄ°üµÄÊýÁ¿¡£ ÔÚ²âÊÔ¹æÔòµÄ¹ý³ÌÖУ¬ Áгö¹æÔò¼°Æä¼ÆÊýÆ÷ÊÇÁ˽âËüÃÇÊÇ·ñ¹¤×÷Õý³£µÄÖØÒªÊֶΡ£

¡¡¡¡°´Ë³ÐòÁгöËùÓеĹæÔò£º

# ipfw list

¡¡¡¡ÁгöËùÓеĹæÔò£¬ ͬʱ¸ø³ö×îºóÒ»´ÎÆ¥ÅäµÄʱ¼ä´Á£º

# ipfw -t list

¡¡¡¡ÁгöËùÓеļÇÕËÐÅÏ¢¡¢ Æ¥Å乿ÔòµÄ°üµÄÊýÁ¿£¬ ÒÔ¼°¹æÔò±¾Éí¡£ µÚÒ»ÁÐÊǹæÔòµÄ±àºÅ£¬ ËæºóÊÇ·¢³ö°üÆ¥ÅäµÄÊýÁ¿£¬ ½øÈë°üµÄÆ¥ÅäÊýÁ¿£¬ ×îºóÊǹæÔò±¾Éí¡£

# ipfw -a list

¡¡¡¡ÁгöËùÓеĶ¯Ì¬¹æÔòºÍ¾²Ì¬¹æÔò£º

# ipfw -d list

¡¡¡¡Í¬Ê±ÏÔʾÒѹýÆÚµÄ¶¯Ì¬¹æÔò£º

# ipfw -d -e list

¡¡¡¡½«¼ÆÊýÆ÷ÇåÁ㣺

# ipfw zero

¡¡¡¡Ö»°Ñ¹æÔòºÅΪ NUM µÄ¼ÆÊýÆ÷ÇåÁ㣺

# ipfw zero NUM

30.6.4 IPFW ¹æÔò¼¯

¡¡¡¡¹æÔò¼¯ÊÇÖ¸Ò»×é±àдºÃµÄÒÀ¾Ý°üµÄÖµ¾ö²ßÔÊÐíͨ¹ý»ò×èÖ¹ IPFW ¹æÔò¡£ °üµÄË«Ïò½»»»×é³ÉÁËÒ»¸ö»á»°½»»¥¡£ ·À»ðǽ¹æÔò¼¯»á×÷ÓÃÓÚÀ´×ÔÓÚ Internet ¹«ÍøµÄ°üÒÔ¼°ÓÉϵͳ·¢³öÀ´»ØÓ¦ÕâЩ°üµÄÊý¾Ý°ü¡£ ÿһ¸ö TCP/IP ·þÎñ (ÀýÈç telnet, www, ÓʼþµÈµÈ) ¶¼ÓÉЭÒéÔ¤Ïȶ¨ÒåÁËÆäÌØÈ¨ (¼àÌý) ¶Ë¿Ú¡£ ·¢µ½Ìض¨·þÎñµÄ°ü»á´ÓÔ´µØÖ·Ê¹Ó÷ÇÌØÈ¨ (¸ß±àºÅ) ¶Ë¿Ú·¢³ö£¬ ²¢·¢µ½Ìض¨·þÎñÔÚÄ¿µÄµØÖ·µÄ¶ÔÓ¦¶Ë¿Ú¡£ ËùÓÐÕâЩ²ÎÊý (ÀýÈ磺 ¶Ë¿ÚºÍµØÖ·£© ¶¼ÊÇ¿ÉÒÔΪ·À»ðǽ¹æÔòËùÀûÓõģ¬ ÅбðÊÇ·ñÔÊÐí·þÎñͨ¹ýµÄ±ê×¼¡£

¡¡¡¡µ±ÓÐÊý¾Ý°ü½øÈë·À»ðǽʱ£¬ »á´Ó¹æÔò¼¯ÀïµÄµÚÒ»¸ö¹æÔò¿ªÊ¼½øÐбȽϣ¬ ²¢×Ô¶¥ÏòϵؽøÐÐÆ¥Åä¡£ µ±°üÓëij¸öÑ¡Ôñ¹æÔò²ÎÊýÏàÆ¥Åäʱ£¬ ½«»áÖ´ÐйæÔòËù¶¨ÒåµÄ¶¯×÷£¬ ²¢Í£Ö¹¹æÔò¼¯ËÑË÷¡£ ÕâÖÖ²ßÂÔ£¬ ͨ³£Ò²±»³Æ×÷ ¡°×îÏÈÆ¥ÅäÕß»ñʤ¡± µÄËÑË÷·½·¨¡£ Èç¹ûûÓÐÈκÎÓë°üÏàÆ¥ÅäµÄ¹æÔò£¬ ÄÇôËü¾Í»á¸ù¾ÝÇ¿ÖÆµÄ IPFW ĬÈϹæÔò£¬ Ò²¾ÍÊÇ 65535 ºÅ¹æÔò½Ø»ñ¡£ Ò»°ãÇé¿öÏÂÕâ¸ö¹æÔòÊÇ×èÖ¹°ü£¬ ¶øÇÒ²»¸ø³öÈκλØÓ¦¡£

×¢Òâ: Èç¹û¹æÔò¶¨ÒåµÄ¶¯×÷ÊÇ count¡¢ skipto »ò tee ¹æÔòµÄ»°£¬ ËÑË÷»á¼ÌÐø¡£

¡¡¡¡ÕâÀïËù½éÉܵĹæÔò£¬ ¶¼ÊÇʹÓÃÁËÄÇЩ°üº¬×´Ì¬¹¦Äܵģ¬ Ò²¾ÍÊÇ keep state¡¢ limit¡¢ in¡¢ out ÒÔ¼° via Ñ¡ÏîµÄ¹æÔò¡£ ÕâÊDZàдÃ÷ʾÔÊÐí·À»ðǽ¹æÔò¼¯ËùÐèµÄ»ù±¾¿ò¼Ü¡£

¾¯¸æ: ÔÚ²Ù×÷·À»ðǽ¹æÔòʱӦ½÷É÷ÐÐÊ£¬ Èç¹û²Ù×÷²»µ±£¬ ºÜÈÝÒ×½«×Ô¼º·´ËøÔÚÍâÃæ¡£

30.6.4.1 ¹æÔòÓï·¨

¡¡¡¡ÕâÀïËù½éÉܵĹæÔòÓï·¨ÒѾ­¾­¹ýÁ˼ò»¯£¬ Ö»°üÀ¨Á˽¨Á¢±ê×¼µÄÃ÷ʾÔÊÐí·À»ðǽ¹æÔò¼¯Ëù±ØÐèµÄÄÇЩ¡£ ÒªÁ˽âÍêÕûµÄ¹æÔòÓ﷨˵Ã÷£¬ Çë²Î¼û ipfw(8) Áª»úÊֲᡣ

¡¡¡¡¹æÔòÊÇÓɹؼü×Ö×é³ÉµÄ£º ÕâЩ¹Ø¼ü×Ö±ØÐëÒÔÌØ¶¨µÄ˳Ðò´Ó×óµ½ÓÒÊéд¡£ ÏÂÃæµÄ½éÉÜÖУ¬ ¹Ø¼ü×ÖʹÓôÖÌå±íʾ¡£ ijЩ¹Ø¼ü×Ö»¹°üÀ¨ÁË×ÓÑ¡Ï ÕâЩ×ÓÑ¡Ïî±¾Éí¿ÉÄÜÒ²Êǹؼü×Ö£¬ ÓÐЩ»¹¿ÉÒÔ°üº¬¸ü¶àµÄ×ÓÑ¡Ïî¡£

¡¡¡¡# ÓÃÓÚ±íʾ¿ªÊ¼Ò»¶Î×¢ÊÍ¡£ Ëü¿ÉÒÔ³öÏÖÔÚÒ»¸ö¹æÔòµÄºóÃæ£¬ Ò²¿ÉÒÔ¶ÀÕ¼Ò»ÐС£ ¿ÕÐлᱻºöÂÔ¡£

¡¡¡¡CMD RULE_NUMBER ACTION LOGGING SELECTION STATEFUL

30.6.4.1.1 CMD

¡¡¡¡Ã¿Ò»¸öÐµĹæÔò¶¼Ó¦ÒÔ add ×÷Ϊǰ׺£¬ Ëü±íʾ½«¹æÔò¼ÓÈëÄÚ²¿±í¡£

30.6.4.1.2 RULE_NUMBER

¡¡¡¡Ã¿Ò»¸ö¹æÔò¶¼±ØÐë°üº¬Ò»¸ö¹æÔò±àºÅ¡£

30.6.4.1.3 ACTION

¡¡¡¡Ã¿Ò»¸ö¹æÔò¿ÉÒÔÓëÏÂÁе͝×÷Ö®Ò»Ïà¹ØÁª£¬ ËùÖ¸¶¨µÄ¶¯×÷½«ÔÚ½øÈëµÄÊý¾Ý°üÓë¹æÔòËùÖ¸¶¨µÄÑ¡Ôñ±ê×¼ÏàÆ¥ÅäʱִÐС£

¡¡¡¡allow | accept | pass | permit

¡¡¡¡ÕâЩ¹Ø¼ü×Ö¶¼±íʾÔÊÐíÆ¥Å乿ÔòµÄ°üͨ¹ý·À»ðǽ£¬ ²¢Í£Ö¹¼ÌÐøËÑË÷¹æÔò¡£

¡¡¡¡check-state

¡¡¡¡¸ù¾Ý¶¯Ì¬¹æÔò±í¼ì²éÊý¾Ý°ü¡£ Èç¹ûÆ¥Å䣬 ÔòÖ´ÐйæÔòËùÖ¸¶¨µÄ¶¯×÷£¬ Ò༴Éú³É¶¯Ì¬¹æÔò£» ·ñÔò£¬ ×ªÒÆµ½ÏÂÒ»¸ö¹æÔò¡£ check-state ¹æÔòûÓÐÑ¡Ôñ±ê×¼¡£ Èç¹û¹æÔò¼¯ÖÐûÓÐ check-state ¹æÔò£¬ Ôò»áÔÚµÚÒ»¸ö keep-state »ò limit ¹æÔò´¦£¬ ¶Ô¶¯Ì¬¹æÔò±íʵʩ¼ì²é¡£

¡¡¡¡deny | drop

¡¡¡¡ÕâÁ½¸ö¹Ø¼ü×Ö¶¼±íʾ¶ªÆúÆ¥Å乿ÔòµÄ°ü¡£ ͬʱ£¬ Í£Ö¹¼ÌÐøËÑË÷¹æÔò¡£

30.6.4.1.4 LOGGING

¡¡¡¡log or logamount

¡¡¡¡µ±Êý¾Ý°üÓë´ø log ¹Ø¼ü×ֵĹæÔòÆ¥Åäʱ£¬ ½«Í¨¹ýÃûΪ SECURITY µÄ facility À´°ÑÏûÏ¢¼Ç¼µ½ syslogd(8)¡£ Ö»ÓÐÔڼǼµÄ´ÎÊýûÓг¬¹ý logamount ²ÎÊýËùÖ¸¶¨µÄ´ÎÊýʱ£¬ ²Å»á¼Ç¼ÈÕÖ¾¡£ Èç¹ûûÓÐÖ¸¶¨ logamount£¬ Ôò»áÒÔ sysctl ±äÁ¿ net.inet.ip.fw.verbose_limit ËùÖ¸¶¨µÄÏÞÖÆÎª×¼¡£ Èç¹û½«ÕâÁ½ÖÖÏÞÖÆÖµÖ®Ò»Ö¸¶¨ÎªÁ㣬 Ôò±íʾ²»×÷ÏÞÖÆ¡£ Èç¹û´ïµ½ÁËÏÞÖÆÊý£¬ ¿ÉÒÔͨ¹ý½«¹æÔòµÄÈÕÖ¾¼ÆÊý»ò°ü¼ÆÊýÇåÁãÀ´ÖØÐÂÆôÓÃÈÕÖ¾£¬ Çë²Î¼û ipfw reset log ÃüÁîÀ´Á˽âϸ½Ú¡£

×¢Òâ: ÈÕÖ¾ÊÇÔÚËùÓÐÆäËûÆ¥ÅäÌõ¼þ¶¼ÑéÖ¤³É¹¦Ö®ºó£¬ ÔÚÕë¶Ô°üʵʩ×îÖÕ¶¯×÷ (accept, deny) ֮ǰ½øÐеġ£ Äú¿ÉÒÔ×ÔÐоö¶¨ÄÄЩ¹æÔòÓ¦ÆôÓÃÈÕÖ¾¡£

30.6.4.1.5 SELECTION

¡¡¡¡ÕâÒ»½ÚËù½éÉܵĹؼü×ÖÖ÷ÒªÓÃÀ´ÃèÊö¼ì²é°üµÄÄÄЩÊôÐÔ£¬ ÓÃÒÔÅжϰüÊÇ·ñÓë¹æÔòÏàÆ¥Åä¡£ ÏÂÃæÊÇһЩͨÓõÄÓÃÓÚÆ¥Åä°üÌØÕ÷µÄÊôÐÔ£¬ ËüÃDZØÐ밴˳ÐòʹÓãº

¡¡¡¡udp | tcp | icmp

¡¡¡¡Ò²¿ÉÒÔÖ¸¶¨ÔÚ /etc/protocols ÖÐËù¶¨ÒåµÄЭÒé¡£ Õâ¸öÖµ¶¨ÒåµÄÊÇÆ¥ÅäµÄЭÒ飬 ÔÚ¹æÔòÖбØÐëÖ¸¶¨Ëü¡£

¡¡¡¡from src to dst

¡¡¡¡from ºÍ to ¹Ø¼ü×ÖÓÃÓÚÆ¥Åä IP µØÖ·¡£ ¹æÔòÖбØÐë ͬʱ Ö¸¶¨Ô´ºÍÄ¿µÄÁ½¸ö²ÎÊý¡£ Èç¹ûÐèҪƥÅäÈÎÒâ IP µØÖ·£¬ ¿ÉÒÔʹÓÃÌØÊâ¹Ø¼ü×Ö any¡£ »¹ÓÐÒ»¸öÌØÊâ¹Ø¼ü×Ö£¬ ¼´ me£¬ ÓÃÓÚÆ¥ÅäÄúµÄ FreeBSD ϵͳÉÏËùÓÐÍøÂç½Ó¿ÚÉÏËùÅäÖÃµÄ IP µØÖ·£¬ Ëü¿ÉÒÔÓÃÓÚ±í´ïÍøÂçÉÏµÄÆäËû¼ÆËã»úµ½·À»ðǽ (Ò²¾ÍÊDZ¾»ú)£¬ ÀýÈç from me to any »ò from any to me »ò from 0.0.0.0/0 to any »ò from any to 0.0.0.0/0 »ò from 0.0.0.0 to any »ò from any to 0.0.0.0 ÒÔ¼° from me to 0.0.0.0¡£ IP µØÖ·¿ÉÒÔͨ¹ý ´øµãµÄ IP µØÖ·/ÑÚÂ볤¶È (CIDR ¼Ç·¨)£¬ »òÕßÒ»¸ö´øµãµÄ IP µØÖ·µÄÐÎʽÀ´Ö¸¶¨¡£ ÕâÊDZàд¹æÔòʱËù±ØÐèµÄ¡£ ʹÓà net-mgmt/ipcalc port ¿ÉÒÔÓÃÀ´¼ò»¯¼ÆËã¡£ ¹ØÓÚÕâ¸ö¹¤¾ßµÄ¸ü¶àÐÅÏ¢£¬ Ò²¿É²Î¿¼ËüµÄÖ÷Ò³£º http://jodies.de/ipcalc¡£

¡¡¡¡port number

¡¡¡¡Õâ¸ö²ÎÊýÖ÷ÒªÓÃÓÚÄÇЩ֧³Ö¶Ë¿ÚºÅµÄЭÒé (ÀýÈç TCP ºÍ UDP)¡£ Èç¹ûҪͨ¹ý¶Ë¿ÚºÅÆ¥Åäij¸öЭÒ飬 ¾Í±ØÐëÖ¸¶¨Õâ¸ö²ÎÊý¡£ ´ËÍ⣬ Ò²¿ÉÒÔͨ¹ý·þÎñµÄÃû×Ö (¸ù¾Ý /etc/services) À´Ö¸¶¨·þÎñ£¬ ÕâÑù»á±ÈʹÓÃÊý×ÖÖ¸¶¨¶Ë¿ÚºÅÖ±¹ÛһЩ¡£

¡¡¡¡in | out

¡¡¡¡ÏàÓ¦µØ£¬ Æ¥Åä½øÈëºÍ·¢³öµÄ°ü¡£ ÕâÀïµÄ in ºÍ out ¶¼Êǹؼü×Ö£¬ ÔÚ±àдƥÅ乿Ôòʱ£¬ ±ØÐè×÷ΪÆäËûÌõ¼þµÄÒ»²¿·ÖÀ´Ê¹Óá£

¡¡¡¡via IF

¡¡¡¡¸ù¾ÝÖ¸¶¨µÄÍøÂç½Ó¿ÚµÄÃû³Æ¾«È·µØÆ¥Åä½ø³öµÄ°ü¡£ ÕâÀïµÄ via ¹Ø¼ü×Ö½«Ê¹µÃ½Ó¿ÚÃû³Æ³ÉΪƥÅä¹ý³ÌµÄÒ»²¿·Ö¡£

¡¡¡¡setup

¡¡¡¡ÒªÆ¥Åä TCP »á»°µÄ·¢ÆðÇëÇó£¬ ¾Í±ØÐëʹÓÃËü¡£

¡¡¡¡keep-state

¡¡¡¡ÕâÊÇÒ»¸ö±ØÐëʹÓõĹؼü×Ö¡£ ÔÚ·¢ÉúÆ¥Åäʱ£¬ ·À»ðǽ½«´´½¨Ò»¸ö¶¯Ì¬¹æÔò£¬ ÆäĬÈÏÐÐΪÊÇ£¬ Æ¥ÅäʹÓÃͬһЭÒéµÄ¡¢´ÓÔ´µ½Ä¿µÄ IP/¶Ë¿Ú µÄË«ÏòÍøÂçÁ÷Á¿¡£

¡¡¡¡limit {src-addr | src-port | dst-addr | dst-port}

¡¡¡¡·À»ðǽֻÔÊÐíÆ¥Å乿Ôòʱ£¬ ÓëÖ¸¶¨µÄ²ÎÊýÏàͬµÄ N ¸öÁ¬½Ó¡£ ¿ÉÒÔÖ¸¶¨ÖÁÉÙÒ»¸öÔ´»òÄ¿µÄµØÖ·¼°¶Ë¿Ú¡£ limit ºÍ keep-state ²»ÄÜÔÚͬһ¹æÔòÖÐͬʱʹÓᣠlimit ÌṩÁËÓë keep-state ÏàͬµÄ¹¦ÄÜ£¬ ²¢Ôö¼ÓÁËһЩ¶ÀÓеÄÄÜÁ¦¡£

30.6.4.2 ״̬¹æÔòÑ¡Ïî

¡¡¡¡ÓÐ״̬¹ýÂ˽«ÍøÂçÁ÷Á¿µ±×÷Ò»ÖÖË«ÏòµÄ°ü½»»»À´´¦Àí¡£ ËüÌṩÁËÒ»ÖÖ¶îÍâµÄ¼ì²éÄÜÁ¦£¬ ÓÃÒÔ¼ì²â»á»°ÖеİüÊÇ·ñÀ´×Ô×î³õµÄ·¢ËÍÕߣ¬ ²¢ÔÚ×ñÑ­Ë«Ïò°ü½»»»µÄ¹æÔò½øÐлỰ¡£ Èç¹û°üÓëÕâЩ¹æÔò²»·û£¬ Ôò½«×Ô¶¯µØ¾Ü¾øËüÃÇ¡£

¡¡¡¡check-state ÓÃÀ´Ê¶±ðÔÚ IPFW ¹æÔò¼¯ÖеİüÊÇ·ñ·ûºÏ¶¯Ì¬¹æÔò»úÖÆµÄ¹æÔò¡£ Èç¹ûÆ¥Å䣬 ÔòÔÊÐí°üͨ¹ý£¬ ´Ëʱ·À»ðǽ½«´´½¨Ò»¸öÐµĶ¯Ì¬¹æÔòÀ´Æ¥ÅäË«Ïò½»»»ÖеÄÏÂÒ»¸ö°ü¡£ Èç¹û²»Æ¥Å䣬 Ôò½«¼ÌÐø³¢ÊÔ¹æÔò¼¯ÖеÄÏÂÒ»¸ö¹æÔò¡£

¡¡¡¡¶¯Ì¬¹æÔò»úÖÆÔÚ SYN-flood ¹¥»÷ÏÂÊÇ´àÈõµÄ£¬ ÒòΪÕâÖÖÇé¿ö»á²úÉú´óÁ¿µÄ¶¯Ì¬¹æÔò£¬ ´Ó¶øºÄ¾¡×ÊÔ´¡£ ΪÁ˵ֿ¹ÕâÖÖ¹¥»÷£¬ ´Ó FreeBSD ÖмÓÈëÁËÒ»¸ö½Ð×ö limit µÄÐÂÑ¡Ïî¡£ Õâ¸öÑ¡Ïî¿ÉÒÔÓÃÀ´ÏÞÖÆ·ûºÏ¹æÔòµÄ»á»°ÔÊÐíµÄ²¢·¢Á¬½ÓÊý¡£ Èç¹û¶¯Ì¬¹æÔò±íÖеĹæÔòÊý³¬¹ý limit µÄÏÞÖÆÊýÁ¿£¬ Ôò°ü½«±»¶ªÆú¡£

30.6.4.3 ¼Ç¼·À»ðǽÏûÏ¢

¡¡¡¡¼Ç¼ÈÕÖ¾µÄºÃ´¦ÊÇÏÔ¶øÒ×¼ûµÄ£º ËüÌṩÁËÔÚʺó¼ì²éËù·¢ÉúµÄ×´¿öµÄ·½·¨£¬ ÀýÈçÄÄЩ°ü±»¶ªÆúÁË£¬ ÕâЩ°üµÄÀ´Ô´ºÍÄ¿µÄµØ£¬ ´Ó¶øÎªÄúÌṩÕÒµ½¹¥»÷ÕßËùÐèµÄÖ¤¾Ý¡£

¡¡¡¡¼´Ê¹ÆôÓÃÁËÈÕÖ¾»úÖÆ£¬ IPFW Ò²²»»á×ÔÐÐÉú³ÉÈκιæÔòµÄÈÕÖ¾¡£ ·À»ðǽ¹ÜÀíÔ±ÐèÒªÖ¸¶¨¹æÔò¼¯ÖеÄÄÄЩ¹æÔòÓ¦¸Ã¼Ç¼ÈÕÖ¾£¬ ²¢ÔÚÕâЩ¹æÔòÉÏÔö¼Ó log ¶¯×÷¡£ Ò»°ãÀ´Ëµ£¬ Ö»ÓÐ deny ¹æÔòÓ¦¼Ç¼ÈÕÖ¾£¬ ÀýÈç¶ÔÓÚ½øÈëµÄ ICMP ping µÄ deny ¹æÔò¡£ ÁíÍ⣬ ¸´ÖÆ ¡°Ä¬È쵀 ipfw ÖÕ¼« deny ¹æÔò¡±£¬ ²¢¼ÓÈë log ¶¯×÷À´×÷ΪÄúµÄ¹æÔò¼¯µÄ×îºóÒ»Ìõ¹æÔòÒ²ÊǺܳ£¼ûµÄÓ÷¨¡£ ÕâÑù£¬ Äú¾ÍÄÜ¿´µ½Ã»ÓÐÆ¥ÅäÈκÎÒ»Ìõ¹æÔòµÄÄÇЩÊý¾Ý°ü¡£

¡¡¡¡ÈÕÖ¾ÊÇÒ»°ÑË«Èн££¬ Èç¹û²»½÷É÷µØ¼ÓÒÔÀûÓ㬠Ôò¿ÉÄÜ»áÏÝÈë¹ý¶àµÄÈÕÖ¾Êý¾ÝÖУ¬ ²¢µ¼Ö´ÅÅ̱»ÈÕÖ¾ÈûÂú¡£ ½«´ÅÅÌÌîÂúÊÇ DoS ¹¥»÷×îΪÀÏÌ×µÄÊÖ·¨Ö®Ò»¡£ ÓÉÓÚ syslogd ³ýÁ˻ὫÈÕ־дÈë´ÅÅÌÖ®Í⣬ »¹»áÊä³öµ½ root µÄ¿ØÖÆÌ¨ÆÁÄ»ÉÏ£¬ Òò´ËÓйý¶àµÄÈÕÖ¾ÐÅÏ¢ÊǺÜÈÃÈËÄÕ»ðµÄÊÂÇé¡£

¡¡¡¡IPFIREWALL_VERBOSE_LIMIT=5 ÄÚºËÑ¡ÏÏÞÖÆÍ¬Ò»¸ö¹æÔò·¢µ½ÏµÍ³ÈÕÖ¾³ÌÐò syslogd(8) µÄÁ¬ÐøÏûÏ¢µÄÊýÁ¿¡£ µ±ÄÚºËÆôÓÃÁËÕâ¸öÑ¡Ïîʱ£¬ Ä³Ò»ÌØ¶¨¹æÔòËù²úÉúµÄÁ¬ÐøÏûÏ¢µÄÊýÁ¿½«·â¶¥ÎªÕâ¸öÊý×Ö¡£ Ò»°ãÀ´Ëµ£¬ ûÓа취´ÓÁ¬Ðø 200 ÌõһģһÑùµÄÈÕÖ¾ÐÅÏ¢ÖлñÈ¡¸ü¶àÓÐÓõÄÐÅÏ¢¡£ ¾ÙÀýÀ´Ëµ£¬ Èç¹ûͬһ¸ö¹æÔò²úÉúÁË 5 ´ÎÏûÏ¢²¢±»¼Ç¼µ½ syslogd£¬ ÓàϵÄÏàͬµÄÏûÏ¢½«±»¼ÆÊý£¬ ²¢ÏñÏÂÃæÕâÑù·¢¸ø syslogd£º

last message repeated 45 times

¡¡¡¡ËùÓмǼµÄÊý¾Ý°ü°üÏûÏ¢£¬ ĬÈÏÇé¿öÏ»á×îÖÕдµ½ /var/log/security ÎļþÖУ¬ ºóÕßÔÚ /etc/syslog.conf ÎļþÀï½øÐÐÁ˶¨Òå¡£

30.6.4.4 ±àд¹æÔò½Å±¾

¡¡¡¡¾ø´ó¶àÊýÓо­ÑéµÄ IPFW Óû§»á´´½¨Ò»¸ö°üº¬¹æÔòµÄÎļþ£¬ ²¢ÇÒ£¬ °´Äܹ»ÒԽű¾ÐÎʽÔËÐеķ½Ê½À´Êéд¡£ ÕâÑù×ö×î´óµÄÒ»¸öºÃ´¦ÊÇ£¬ ¿ÉÒÔ´óÅúÁ¿µØË¢Ð·À»ðǽ¹æÔò£¬ ¶øÎÞÐëÖØÐÂÆô¶¯ÏµÍ³¾ÍÄܹ»¼¤»îËüÃÇ¡£ ÕâÖÖ·½·¨ÔÚ²âÊÔйæÔòʱ»á·Ç³£·½±ã£¬ ÒòΪͬһ¹ý³ÌÔÚÐèҪʱ¿ÉÒÔ¶à´ÎÖ´ÐС£ ×÷Ϊ½Å±¾£¬ Äú¿ÉÒÔʹÓ÷ûºÅÌæ»»À´×«Ð´ÄÇЩ¾­³£ÐèҪʹÓõÄÖµ£¬ ²¢ÓÃͬһ¸ö·ûºÅÔÚ¶à¸ö¹æÔòÖз´¸´µØ±í´ïËü¡£ ÏÂÃæ½«¸ø³öÒ»¸öÀý×Ó¡£

¡¡¡¡Õâ¸ö½Å±¾Ê¹ÓõÄÓ﷨ͬ sh(1)¡¢ csh(1) ÒÔ¼° tcsh(1) ½Å±¾¼æÈÝ¡£ ·ûºÅÌæ»»×Ö¶ÎʹÓÃÃÀÔª·ûºÅ $ ×÷Ϊǰ׺¡£ ·ûºÅ×ֶα¾Éí²¢²»Ê¹Óà $ ǰ׺¡£ ·ûºÅÌæ»»×ֶεÄÖµ±ØÐëʹÓà "Ë«ÒýºÅ" À¨ÆðÀ´¡£

¡¡¡¡¿ÉÒÔʹÓÃÀàËÆÏÂÃæµÄ¹æÔòÎļþ£º

############### start of example ipfw rules script #############
#
ipfw -q -f flush       # Delete all rules
# Set defaults
oif="tun0"             # out interface
odns="192.0.2.11"      # ISP's DNS server IP address
cmd="ipfw -q add "     # build rule prefix
ks="keep-state"        # just too lazy to key this each time
$cmd 00500 check-state
$cmd 00502 deny all from any to any frag
$cmd 00501 deny tcp from any to any established
$cmd 00600 allow tcp from any to any 80 out via $oif setup $ks
$cmd 00610 allow tcp from any to $odns 53 out via $oif setup $ks
$cmd 00611 allow udp from any to $odns 53 out via $oif $ks
################### End of example ipfw rules script ############

¡¡¡¡Õâ¾ÍÊÇËùÒª×öµÄÈ«²¿ÊÂÇéÁË¡£ Àý×ÓÖеĹæÔò²¢²»ÖØÒª£¬ ËüÃÇÖ÷ÒªÊÇÓÃÀ´±íʾÈçºÎʹÓ÷ûºÅÌæ»»¡£

¡¡¡¡Èç¹û°ÑÉÏÃæµÄÀý×Ó±£´æµ½ /etc/ipfw.rules ÎļþÖС£ ÏÂÃæµÄÃüÁîÀ´»áÖØÐ¼ÓÔØ¹æÔò¡£

# sh /etc/ipfw.rules

¡¡¡¡/etc/ipfw.rules Õâ¸öÎļþ¿ÉÒԷŵ½ÈκÎλÖ㬠Ҳ¿ÉÒÔÃüÃûÎªËæ±ãʲô±ðµÄÃû×Ö¡£

¡¡¡¡Ò²¿ÉÒÔÊÖ¹¤Ö´ÐÐÏÂÃæµÄÃüÁîÀ´´ïµ½ÀàËÆµÄÄ¿µÄ£º

# ipfw -q -f flush
# ipfw -q add check-state
# ipfw -q add deny all from any to any frag
# ipfw -q add deny tcp from any to any established
# ipfw -q add allow tcp from any to any 80 out via tun0 setup keep-state
# ipfw -q add allow tcp from any to 192.0.2.11 53 out via tun0 setup keep-state
# ipfw -q add 00611 allow udp from any to 192.0.2.11 53 out via tun0 keep-state

30.6.4.5 ´ø×´Ì¬¹æÔò¼¯

¡¡¡¡ÒÔϵÄÕâ×é·Ç-NAT ¹æÔò¼¯£¬ ÊÇÈçºÎ±àд·Ç³£°²È«µÄ 'Ã÷ʾÔÊÐí' ·À»ðǽµÄÒ»¸öÀý×Ó¡£ Ã÷ʾÔÊÐí·À»ðǽֻÔÊÐíÆ¥ÅäÁË pass ¹æÔòµÄ°üͨ¹ý£¬ ¶øÄ¬ÈÏ×èÖ¹ËùÓÐµÄÆäËûÊý¾Ý°ü¡£ ÓÃÀ´±£»¤Õû¸öÍø¶ÎµÄ·À»ðǽ£¬ ÖÁÉÙÐèÒªÓÐÁ½¸öÍøÂç½Ó¿Ú£¬ ²¢ÇÒÆäÉϱØÐëÅäÖùæÔò£¬ ÒÔ±ãÈ÷À»ðǽÕý³£¹¤×÷¡£

¡¡¡¡ËùÓÐÀà UNIX® ²Ù×÷ϵͳ£¬ Ò²°üÀ¨ FreeBSD£¬ ¶¼Éè¼ÆÎªÔÊÐíʹÓÃÍøÂç½Ó¿Ú lo0 ºÍ IP µØÖ· 127.0.0.1 À´Íê³É²Ù×÷ϵͳÄÚ²¿µÄͨѶ¡£ ·À»ðǽ±ØÐë°üº¬Ò»×鹿Ôò£¬ ʹÕâЩÊý¾Ý°üÄܹ»ÎÞÕϰ­µØÊÕ·¢¡£

¡¡¡¡½ÓÈë Internet ¹«ÍøµÄÄǸöÍøÂç½Ó¿ÚÉÏ£¬ Ó¦¸ÃÅäÖÃÊÚȨºÍ·ÃÎÊ¿ØÖÆ£¬ À´ÏÞÖÆ¶ÔÍâµÄ·ÃÎÊ£¬ ÒÔ¼°À´×Ô Internet ¹«ÍøµÄ·ÃÎÊ¡£ Õâ¸ö½Ó¿ÚºÜ¿ÉÄÜÊÇÄúµÄÓû§Ì¬ PPP ½Ó¿Ú£¬ ÀýÈç tun0£¬ »òÕßÄú½ÓÔÚ DSL »òµçÀ modem ÉϵÄÍø¿¨¡£

¡¡¡¡Èç¹ûÓÐÖÁÉÙÒ»¸öÍø¿¨½ÓÈëÁË·À»ðǽºóµÄÄÚÍø LAN£¬ Ôò±ØÐëΪÕâЩ½Ó¿ÚÅäÖùæÔò£¬ ÒÔ±ãÈÃÕâЩ½Ó¿ÚÖ®¼äµÄ°üÄܹ»Ë³³©µØÍ¨¹ý¡£

¡¡¡¡ËùÓеĹæÔòÓ¦±»×é֯ΪÈý¸ö²¿·Ö£¬ ËùÓÐÓ¦ÎÞ×è°­µØÍ¨¹ýµÄ¹æÔò£¬ ¹«ÍøµÄ·¢³ö¹æÔò£¬ ÒÔ¼°¹«ÍøµÄ½ÓÊÕ¹æÔò¡£

¡¡¡¡¹«Íø½Ó¿ÚÏà¹ØµÄ¹æÔòµÄ˳Ðò£¬ Ó¦¸ÃÊÇ×î¾­³£Óõ½µÄ·ÅÔÚ¾¡¿ÉÄÜ¿¿Ç°µÄλÖ㬠¶ø×îºóÒ»¸ö¹æÔò£¬ ÔòÓ¦¸ÃÊÇ×èÖ¹ÄǸö½Ó¿ÚÔÚÄÇÒ»·½ÏòÉϵİü¡£

¡¡¡¡·¢³ö²¿·ÖµÄ¹æÔòÖ»°üº¬Ò»Ð© allow ¹æÔò£¬ ÔÊÐíÑ¡¶¨µÄÄÇÐ©Î¨Ò»Çø·ÖЭÒéµÄ¶Ë¿ÚºÅËùÖ¸¶¨µÄЭÒéͨ¹ý£¬ ÒÔÔÊÐí·ÃÎÊ Internet ¹«ÍøÉϵÄÕâЩ·þÎñ¡£ ËùÓеĹæÔòÖж¼Ö¸¶¨ÁË proto¡¢ port¡¢ in/out¡¢ via ÒÔ¼° keep state ÕâЩѡÏî¡£ proto tcp ¹æÔòͬʱָ¶¨ setup Ñ¡Ï À´Çø·Ö¿ªÊ¼Ð­Òé»á»°µÄ°ü£¬ ÒÔ´¥·¢½«°ü·ÅÈë keep state ¹æÔò±íÖе͝×÷¡£

¡¡¡¡½ÓÊÕ²¿·ÖÔòÊ×ÏÈ×èÖ¹ËùÓв»Ï£ÍûµÄ°ü£¬ ÕâÑù×öÓÐÁ½¸ö²»Í¬µÄÔ­Òò¡£ ÆäÒ»ÊǶñÒâµÄ°ü¿ÉÄܺÍijЩÔÊÐíµÄÁ÷Á¿¹æÔò´æÔÚ²¿·ÖÆ¥Å䣬 ¶øÎÒÃÇÏ£Íû×èÖ¹£¬ ¶ø²»ÊÇÈÃÕâЩ°ü½ö½öÓë allow ¹æÔò²¿·ÖÆ¥Åä¾ÍÔÊÐíËüÃǽøÈë¡£ Æä¶þÊÇ£¬ ÒѾ­È·ÐÅÒª×èÖ¹µÄ°ü±»¾Ü¾øÕâ¼þÊ£¬ ÍùÍù²¢²»ÊÇÎÒÃÇÐèÒª¹Ø×¢µÄ£¬ Òò´ËÖ»Òª¼òµ¥µØÓèÒÔ×èÖ¹¼´¿É¡£ ·À»ðǽ¹æÔò¼¯ÖеÄÿ¸ö²¿·ÖµÄ×îºóÒ»Ìõ¹æÔò¶¼ÊÇ×èÖ¹²¢¼Ç¼°ü£¬ ÕâÓÐÖúÓÚΪ´þ²¶¹¥»÷ÕßÁôÏ·¨ÂÉËùÒªÇóµÄÖ¤¾Ý¡£

¡¡¡¡ÁíÍâÒ»¸öÐèҪעÒâµÄÊÂÇéÊÇÈ·±£ÏµÍ³¶Ô²»Ï£ÍûµÄÊý¾Ý°ü²»×ö»ØÓ¦¡£ ÎÞЧµÄ°üÓ¦±»¶ªÆúºÍÏûʧ¡£ ÕâÑù£¬ ¹¥»÷Õß±ãÎÞ·¨ÖªµÀ°üÊÇ·ñµ½´ïÁËÄúµÄϵͳ¡£ ¹¥»÷Õß¶ÔϵͳÁ˽âµÄÔ½ÉÙ£¬ Æä¹¥»÷µÄÄѶÈÒ²¾ÍÔ½´ó¡£ Èç¹û²»ÖªµÀ¶Ë¿ÚºÅ£¬ ¿ÉÒÔ²éÔÄ /etc/services/ »òµ½ http://www.securitystats.com/tools/portsearch.php ²¢²éÕÒһ϶˿ںţ¬ ÒÔÁ˽âÆäÓÃ;¡£ ÁíÍ⣬ ÄúÒ²¿ÉÒÔÔÚÕâ¸öÍøÒ³ÉÏÁ˽ⳣ¼ûľÂíËùʹÓõĶ˿ڣº http://www.simovits.com/trojans/trojans.html¡£

30.6.4.6 Ã÷ʾÔÊÐí¹æÔò¼¯µÄÀý×Ó

¡¡¡¡ÏÂÃæÊÇÒ»¸ö·Ç-NAT µÄ¹æÔò¼¯£¬ ËüÊÇÒ»¸öÍêÕûµÄÃ÷ʾÔÊÐí¹æÔò¼¯¡£ ʹÓÃËü×÷ΪÄúµÄ¹æÔò¼¯²»»áÓÐʲôÎÊÌâ¡£ Ö»Ðè°ÑÄÇЩ²»ÐèÒªµÄ·þÎñ¶ÔÓ¦µÄ pass ¹æÔò×¢Ê͵ô¾Í¿ÉÒÔÁË¡£ Èç¹ûÄúÔÚÈÕÖ¾Öп´µ½ÏûÏ¢£¬ ¶øÇÒ²»ÏëÔÙ¿´µ½ËüÃÇ£¬ Ö»ÐèÔÚ½ÓÊÕ²¿·ÖÔö¼ÓÒ»¸öÒ»¸ö deny ¹æÔò¡£ Äú¿ÉÄÜÐèÒª°Ñ dc0 ¸ÄΪ½ÓÈë¹«ÍøµÄ½Ó¿ÚµÄÃû×Ö¡£ ¶ÔÓÚʹÓÃÓû§Ì¬ PPP µÄÓû§¶øÑÔ£¬ Ó¦¸ÃÊÇ tun0¡£

¡¡¡¡ÕâЩ¹æÔò×ñÑ­Ò»¶¨µÄģʽ¡£

  • ËùÓÐÇëÇó Internet ¹«ÍøÉÏ·þÎñµÄ»á»°¿ªÊ¼°ü£¬ ¶¼Ê¹ÓÃÁË keep-state¡£

  • ËùÓÐÀ´×Ô Internet µÄÊÚȨ·þÎñÇëÇó£¬ ¶¼²ÉÓÃÁË limit Ñ¡ÏîÀ´·ÀÖ¹ºéˮʽ¹¥»÷¡£

  • ËùÓеĹæÔò¶¼Ê¹ÓÃÁË in »òÕß out À´ËµÃ÷·½Ïò¡£

  • ËùÓеĹæÔò¶¼Ê¹ÓÃÁË via ½Ó¿ÚÃû À´Ö¸¶¨Ó¦¸ÃÆ¥Åäͨ¹ýÄÄÒ»¸ö½Ó¿ÚµÄ°ü¡£

¡¡¡¡ÕâЩ¹æÔò¶¼Ó¦·Åµ½ /etc/ipfw.rules¡£

################ Start of IPFW rules file ###############################
# Flush out the list before we begin.
ipfw -q -f flush

# Set rules command prefix
cmd="ipfw -q add"
pif="dc0"     # public interface name of NIC
              # facing the public Internet

#################################################################
# No restrictions on Inside LAN Interface for private network
# Not needed unless you have LAN.
# Change xl0 to your LAN NIC interface name
#################################################################
#$cmd 00005 allow all from any to any via xl0

#################################################################
# No restrictions on Loopback Interface
#################################################################
$cmd 00010 allow all from any to any via lo0

#################################################################
# Allow the packet through if it has previous been added to the
# the "dynamic" rules table by a allow keep-state statement.
#################################################################
$cmd 00015 check-state

#################################################################
# Interface facing Public Internet (Outbound Section)
# Interrogate session start requests originating from behind the
# firewall on the private network or from this gateway server
# destine for the public Internet.
#################################################################

# Allow out access to my ISP's Domain name server.
# x.x.x.x must be the IP address of your ISP.s DNS
# Dup these lines if your ISP has more than one DNS server
# Get the IP addresses from /etc/resolv.conf file
$cmd 00110 allow tcp from any to x.x.x.x 53 out via $pif setup keep-state
$cmd 00111 allow udp from any to x.x.x.x 53 out via $pif keep-state

# Allow out access to my ISP's DHCP server for cable/DSL configurations.
# This rule is not needed for .user ppp. connection to the public Internet.
# so you can delete this whole group.
# Use the following rule and check log for IP address.
# Then put IP address in commented out rule & delete first rule
$cmd 00120 allow log udp from any to any 67 out via $pif keep-state
#$cmd 00120 allow udp from any to x.x.x.x 67 out via $pif keep-state

# Allow out non-secure standard www function
$cmd 00200 allow tcp from any to any 80 out via $pif setup keep-state

# Allow out secure www function https over TLS SSL
$cmd 00220 allow tcp from any to any 443 out via $pif setup keep-state

# Allow out send & get email function
$cmd 00230 allow tcp from any to any 25 out via $pif setup keep-state
$cmd 00231 allow tcp from any to any 110 out via $pif setup keep-state

# Allow out FBSD (make install & CVSUP) functions
# Basically give user root "GOD" privileges.
$cmd 00240 allow tcp from me to any out via $pif setup keep-state uid root

# Allow out ping
$cmd 00250 allow icmp from any to any out via $pif keep-state

# Allow out Time
$cmd 00260 allow tcp from any to any 37 out via $pif setup keep-state

# Allow out nntp news (i.e. news groups)
$cmd 00270 allow tcp from any to any 119 out via $pif setup keep-state

# Allow out secure FTP, Telnet, and SCP
# This function is using SSH (secure shell)
$cmd 00280 allow tcp from any to any 22 out via $pif setup keep-state

# Allow out whois
$cmd 00290 allow tcp from any to any 43 out via $pif setup keep-state

# deny and log everything else that.s trying to get out.
# This rule enforces the block all by default logic.
$cmd 00299 deny log all from any to any out via $pif

#################################################################
# Interface facing Public Internet (Inbound Section)
# Check packets originating from the public Internet
# destined for this gateway server or the private network.
#################################################################

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 00300 deny all from 192.168.0.0/16 to any in via $pif  #RFC 1918 private IP
$cmd 00301 deny all from 172.16.0.0/12 to any in via $pif     #RFC 1918 private IP
$cmd 00302 deny all from 10.0.0.0/8 to any in via $pif          #RFC 1918 private IP
$cmd 00303 deny all from 127.0.0.0/8 to any in via $pif        #loopback
$cmd 00304 deny all from 0.0.0.0/8 to any in via $pif            #loopback
$cmd 00305 deny all from 169.254.0.0/16 to any in via $pif   #DHCP auto-config
$cmd 00306 deny all from 192.0.2.0/24 to any in via $pif       #reserved for docs
$cmd 00307 deny all from 204.152.64.0/23 to any in via $pif  #Sun cluster interconnect
$cmd 00308 deny all from 224.0.0.0/3 to any in via $pif         #Class D & E multicast

# Deny public pings
$cmd 00310 deny icmp from any to any in via $pif

# Deny ident
$cmd 00315 deny tcp from any to any 113 in via $pif

# Deny all Netbios service. 137=name, 138=datagram, 139=session
# Netbios is MS/Windows sharing services.
# Block MS/Windows hosts2 name server requests 81
$cmd 00320 deny tcp from any to any 137 in via $pif
$cmd 00321 deny tcp from any to any 138 in via $pif
$cmd 00322 deny tcp from any to any 139 in via $pif
$cmd 00323 deny tcp from any to any 81 in via $pif

# Deny any late arriving packets
$cmd 00330 deny all from any to any frag in via $pif

# Deny ACK packets that did not match the dynamic rule table
$cmd 00332 deny tcp from any to any established in via $pif

# Allow traffic in from ISP's DHCP server. This rule must contain
# the IP address of your ISP.s DHCP server as it.s the only
# authorized source to send this packet type.
# Only necessary for cable or DSL configurations.
# This rule is not needed for .user ppp. type connection to
# the public Internet. This is the same IP address you captured
# and used in the outbound section.
#$cmd 00360 allow udp from any to x.x.x.x 67 in via $pif keep-state

# Allow in standard www function because I have apache server
$cmd 00400 allow tcp from any to me 80 in via $pif setup limit src-addr 2

# Allow in secure FTP, Telnet, and SCP from public Internet
$cmd 00410 allow tcp from any to me 22 in via $pif setup limit src-addr 2

# Allow in non-secure Telnet session from public Internet
# labeled non-secure because ID & PW are passed over public
# Internet as clear text.
# Delete this sample group if you do not have telnet server enabled.
$cmd 00420 allow tcp from any to me 23 in via $pif setup limit src-addr 2

# Reject & Log all incoming connections from the outside
$cmd 00499 deny log all from any to any in via $pif

# Everything else is denied by default
# deny and log all packets that fell through to see what they are
$cmd 00999 deny log all from any to any
################ End of IPFW rules file ###############################

30.6.4.7 Ò»¸ö NAT ºÍ´ø×´Ì¬¹æÔò¼¯µÄÀý×Ó

¡¡¡¡ÒªÊ¹Óà IPFW µÄ NAT ¹¦ÄÜ£¬ »¹ÐèÒª½øÐÐһЩ¶îÍâµÄÅäÖᣠ³ýÁËÆäËû IPFIREWALL Óï¾äÖ®Í⣬ »¹ÐèÒªÔÚÄں˱àÒëÅäÖÃÖмÓÉÏ option IPDIVERT Óï¾ä¡£

¡¡¡¡ÔÚ /etc/rc.conf ÖУ¬ ³ýÁËÆÕͨµÄ IPFW ÅäÖÃÖ®Í⣬ »¹ÐèÒª¼ÓÈ룺

natd_enable="YES"                   # Enable NATD function
natd_interface="rl0"                # interface name of public Internet NIC
natd_flags="-dynamic -m"            # -m = preserve port numbers if possible

¡¡¡¡½«´ø×´Ì¬¹æÔòÓë divert natd ¹æÔò (ÍøÂçµØÖ·×ª»») »áʹ¹æÔò¼¯µÄ±àд±äµÃ·Ç³£¸´ÔÓ¡£ check-state µÄλÖ㬠ÒÔ¼° divert natd ¹æÔò½«±äµÃ·Ç³£¹Ø¼ü¡£ ÕâÑùÒ»À´£¬ ¾Í²»ÔÙÓмòµ¥µÄ˳Ðò´¦ÀíÂß¼­Á÷³ÌÁË¡£ ÌṩÁËÒ»ÖÖÐµĶ¯×÷ÀàÐÍ£¬ ³ÆÎª skipto¡£ ҪʹÓà skipto ÃüÁ ¾Í±ØÐë¸øÃ¿Ò»¸ö¹æÔò½øÐбàºÅ£¬ ÒÔÈ·¶¨ skipto ¹æÔòºÅÊÇÄúÏ£ÍûÌø×ªµ½µÄλÖá£

¡¡¡¡ÏÂÃæ¸ø³öÁËһЩδ¼Ó×¢Ê͵ÄÀý×ÓÀ´ËµÃ÷ÈçºÎ±àдÕâÑùµÄ¹æÔò£¬ ÓÃÒÔ°ïÖúÄúÀí½â°ü´¦Àí¹æÔò¼¯µÄ´¦Àí˳Ðò¡£

¡¡¡¡´¦ÀíÁ÷³Ì´Ó¹æÔòÎļþ×îÉϱߵĵÚÒ»¸ö¹æÔò¿ªÊ¼´¦Àí£¬ ²¢×Ô¶¥Ïòϵس¢ÊÔÿһ¸ö¹æÔò£¬ Ö±µ½ÕÒµ½Æ¥ÅäµÄ¹æÔò£¬ ÇÒÊý¾Ý°ü´Ó·À»ðǽÖзųöΪֹ¡£ Çë×¢Òâ¹æÔòºÅ 100 101£¬ 450£¬ 500£¬ ÒÔ¼° 510 µÄλÖ÷dz£ÖØÒª¡£ ÕâЩ¹æÔò¿ØÖÆ·¢³öºÍ½ÓÊյİüµÄµØÖ·×ª»»¹ý³Ì£¬ ÕâÑùËüÃÇÔÚ keep-state ¶¯Ì¬±íÖеĶÔÓ¦ÏîÖоÍÄܹ»ÓëÄÚÍøµÄ LAN IP µØÖ·¹ØÁª¡£ ÁíÒ»¸öÐèҪעÒâµÄÊÇ£¬ ËùÓÐµÄ allow ºÍ deny ¹æÔò¶¼Ö¸¶¨Á˰üµÄ·½Ïò (Ò²¾ÍÊÇ outbound »ò inbound) ÒÔ¼°ÍøÂç½Ó¿Ú¡£ ×îºó£¬ Çë×¢ÒâËùÓз¢³öµÄ»á»°ÇëÇó¶¼»áÇëÇó skipto rule 500 ÒÔÍê³ÉÍøÂçµØÖ·×ª»»¡£

¡¡¡¡ÏÂÃæÒÔ LAN Óû§Ê¹Óà web ä¯ÀÀÆ÷·ÃÎÊÒ»¸ö web Ò³ÃæÎªÀý¡£ Web Ò³ÃæÊ¹Óà 80 À´Íê³ÉͨѶ¡£ µ±°ü½øÈë·À»ðǽʱ£¬ ¹æÔò 100 ²¢²»Æ¥Å䣬 ÒòΪËüÊÇ·¢³ö¶ø²»ÊÇÊÕµ½µÄ°ü¡£ ËüÄܹ»Í¨¹ý¹æÔò 101£¬ ÒòΪÕâÊǵÚÒ»¸ö°ü£¬ Òò¶øËü»¹Ã»ÓнøÈ붯̬״̬±£³Ö±í¡£ °ü×îÖÕµ½´ï¹æÔò 125£¬ ²¢Æ¥Åä¸Ã¹æÔò¡£ ×îÖÕ£¬ Ëü»áͨ¹ý½ÓÈë Internet ¹«ÍøµÄÍø¿¨·¢³ö¡£ Õâ֮ǰ£¬ °üµÄÔ´µØÖ·ÈÔÈ»ÊÇÄÚÍø IP µØÖ·¡£ Ò»µ©Æ¥ÅäÕâ¸ö¹æÔò£¬ ¾Í»á´¥·¢Á½¸ö¶¯×÷¡£ keep-state Ñ¡Ïî»á°ÑÕâ¸ö¹æÔò·¢µ½ keep-state ¶¯Ì¬¹æÔò±íÖУ¬ ²¢Ö´ÐÐËùÖ¸¶¨µÄ¶¯×÷¡£ ¶¯×÷ÊÇ·¢µ½¹æÔò±íÖеÄÐÅÏ¢µÄÒ»²¿·Ö¡£ ÔÚÕâ¸öÀý×ÓÖУ¬ Õâ¸ö¶¯×÷ÊÇ skipto rule 500¡£ ¹æÔò 500 NAT °üµÄ IP µØÖ·£¬ ²¢½«Æä·¢³ö¡£ ÇëÎñ±ØÀμǣ¬ ÕâÒ»²½·Ç³£ÖØÒª¡£ ½ÓÏÂÀ´£¬ Êý¾Ý°ü½«µ½´ïÄ¿µÄµØ£¬ Ö®ºó·µ»Ø²¢´Ó¹æÔò¼¯µÄµÚÒ»Ìõ¹æÔò¿ªÊ¼´¦Àí¡£ ÕâÒ»´Î£¬ Ëü½«Óë¹æÔò 100 Æ¥Å䣬 ÆäÄ¿µÄ IP µØÖ·½«±»Ó³É仨¶ÔÓ¦µÄÄÚÍø LAN IP µØÖ·¡£ Æäºó£¬ Ëü»á±» check-state ¹æÔò´¦Àí£¬ ½ø¶øÔÚôß´æ»á»°±íÖÐÕÒµ½¶ÔÓ¦Ï ²¢·¢µ½ LAN¡£ Êý¾Ý°ü½ÓÏÂÀ´·¢µ½ÁËÄÚÍø LAN PC ÉÏ£¬ ¶øºóÕßÔò»á·¢ËÍ´ÓÔ¶³Ì·þÎñÆ÷ÇëÇóÏÂÒ»¶ÎÊý¾ÝµÄÐÂÊý¾Ý°ü¡£ Õâ¸ö°ü»áÔÙ´ÎÓÉ check-state ¹æÔò¼ì²é£¬ ²¢ÕÒµ½·¢³öµÄ±íÏ ²¢Ö´ÐÐÆä¹ØÁªµÄ¶¯×÷£¬ ¼´ skipto 500¡£ °üÌø×ªµ½¹æÔò 500 ²¢±» NAT ºó·¢³ö¡£

¡¡¡¡ÔÚ½ÓÊÕÒ»²à£¬ ÒѾ­´æÔڵĻỰµÄÊý¾Ý°ü»á±» check-state ¹æÔò×Ô¶¯µØ´¦Àí£¬ ²¢×ªµ½ divert nat ¹æÔò¡£ ÎÒÃÇÐèÒª½â¾öµÄÎÊÌâÊÇ£¬ ×èÖ¹ËùÓеϵÊý¾Ý°ü£¬ ¶øÖ»ÔÊÐíÊÚȨµÄ·þÎñ¡£ ÀýÈçÔÚ·À»ðǽÉÏÔËÐÐÁË Apache ·þÎñ£¬ ¶øÎÒÃÇÏ£ÍûÈËÃÇÔÚ·ÃÎÊ Internet ¹«ÍøµÄͬʱ£¬ Ò²Äܹ»·ÃÎʱ¾µØµÄ web Õ¾µã¡£ еĽÓÈ뿪ʼÇëÇó°ü½«Æ¥Å乿Ôò 100£¬ ¶ø IP µØÖ·ÔòΪ·À»ðǽËùÔڵķþÎñÆ÷¶øÓ³Éäµ½ÁË LAN IP¡£ ´Ëºó£¬ °ü»áÆ¥ÅäËùÓÐÎÒÃÇÏ£Íû¼ì²éµÄÄÇЩÁîÈËÉúÑáµÄ¶«Î÷£¬ ²¢×îÖÕÆ¥Å乿Ôò 425¡£ Ò»µ©·¢ÉúÆ¥Å䣬 »á·¢ÉúÁ½¼þÊ¡£ Êý¾Ý°ü»á±»·¢µ½ keep-state ¶¯Ì¬±í£¬ µ«´Ëʱ£¬ ËùÓÐÀ´×ÔÄǸöÔ´ IP µÄ»á»°ÇëÇóµÄÊýÁ¿»á±»ÏÞÖÆÎª 2¡£ ÕâÒ»×ö·¨Äܹ»´ì°ÜÕë¶ÔÖ¸¶¨¶Ë¿ÚÉÏ·þÎñµÄ DoS ¹¥»÷¡£ ¶¯×÷ͬʱָ¶¨ÁË allow °üÓ¦±»·¢µ½ LAN ÉÏ¡£ °ü·µ»ØÊ±£¬ check-state ¹æÔò»áʶ±ð³ö°üÊôÓÚijһÒѾ­´æÔڵĻỰ½»»¥£¬ ²¢Ö±½Ó°ÑËü·¢µ½¹æÔò 500 ×ö NAT£¬ ²¢·¢µ½·¢³ö½Ó¿Ú¡£

¡¡¡¡Ê¾·¶¹æÔò¼¯ #1:

#!/bin/sh
cmd="ipfw -q add"
skip="skipto 500"
pif=rl0
ks="keep-state"
good_tcpo="22,25,37,43,53,80,443,110,119"

ipfw -q -f flush

$cmd 002 allow all from any to any via xl0  # exclude LAN traffic
$cmd 003 allow all from any to any via lo0  # exclude loopback traffic

$cmd 100 divert natd ip from any to any in via $pif
$cmd 101 check-state

# Authorized outbound packets
$cmd 120 $skip udp from any to xx.168.240.2 53 out via $pif $ks
$cmd 121 $skip udp from any to xx.168.240.5 53 out via $pif $ks
$cmd 125 $skip tcp from any to any $good_tcpo out via $pif setup $ks
$cmd 130 $skip icmp from any to any out via $pif $ks
$cmd 135 $skip udp from any to any 123 out via $pif $ks


# Deny all inbound traffic from non-routable reserved address spaces
$cmd 300 deny all from 192.168.0.0/16  to any in via $pif  #RFC 1918 private IP
$cmd 301 deny all from 172.16.0.0/12   to any in via $pif  #RFC 1918 private IP
$cmd 302 deny all from 10.0.0.0/8      to any in via $pif  #RFC 1918 private IP
$cmd 303 deny all from 127.0.0.0/8     to any in via $pif  #loopback
$cmd 304 deny all from 0.0.0.0/8       to any in via $pif  #loopback
$cmd 305 deny all from 169.254.0.0/16  to any in via $pif  #DHCP auto-config
$cmd 306 deny all from 192.0.2.0/24    to any in via $pif  #reserved for docs
$cmd 307 deny all from 204.152.64.0/23 to any in via $pif  #Sun cluster
$cmd 308 deny all from 224.0.0.0/3     to any in via $pif  #Class D & E multicast

# Authorized inbound packets
$cmd 400 allow udp from xx.70.207.54 to any 68 in $ks
$cmd 420 allow tcp from any to me 80 in via $pif setup limit src-addr 1


$cmd 450 deny log ip from any to any

# This is skipto location for outbound stateful rules
$cmd 500 divert natd ip from any to any out via $pif
$cmd 510 allow ip from any to any

######################## end of rules  ##################

¡¡¡¡ÏÂÃæµÄÕâ¸ö¹æÔò¼¯»ù±¾ÉϺÍÉÏÃæÒ»Ñù£¬ µ«Ê¹ÓÃÁËÒ×ÓÚ¶Á¶®µÄ±àд·½Ê½£¬ ²¢¸ø³öÁËÏ൱¶àµÄ×¢½â£¬ ÒÔ°ïÖú¾­Ñé½ÏÉÙµÄ IPFW ¹æÔò±àдÕ߸üºÃµØÀí½âÕâЩ¹æÔòµ½µ×ÔÚ×öʲô¡£

¡¡¡¡Ê¾·¶¹æÔò¼¯ #2£º

#!/bin/sh
################ Start of IPFW rules file ###############################
# Flush out the list before we begin.
ipfw -q -f flush

# Set rules command prefix
cmd="ipfw -q add"
skip="skipto 800"
pif="rl0"     # public interface name of NIC
              # facing the public Internet

#################################################################
# No restrictions on Inside LAN Interface for private network
# Change xl0 to your LAN NIC interface name
#################################################################
$cmd 005 allow all from any to any via xl0

#################################################################
# No restrictions on Loopback Interface
#################################################################
$cmd 010 allow all from any to any via lo0

#################################################################
# check if packet is inbound and nat address if it is
#################################################################
$cmd 014 divert natd ip from any to any in via $pif

#################################################################
# Allow the packet through if it has previous been added to the
# the "dynamic" rules table by a allow keep-state statement.
#################################################################
$cmd 015 check-state

#################################################################
# Interface facing Public Internet (Outbound Section)
# Check session start requests originating from behind the
# firewall on the private network or from this gateway server
# destined for the public Internet.
#################################################################

# Allow out access to my ISP's Domain name server.
# x.x.x.x must be the IP address of your ISP's DNS
# Dup these lines if your ISP has more than one DNS server
# Get the IP addresses from /etc/resolv.conf file
$cmd 020 $skip tcp from any to x.x.x.x 53 out via $pif setup keep-state


# Allow out access to my ISP's DHCP server for cable/DSL configurations.
$cmd 030 $skip udp from any to x.x.x.x 67 out via $pif keep-state

# Allow out non-secure standard www function
$cmd 040 $skip tcp from any to any 80 out via $pif setup keep-state

# Allow out secure www function https over TLS SSL
$cmd 050 $skip tcp from any to any 443 out via $pif setup keep-state

# Allow out send & get email function
$cmd 060 $skip tcp from any to any 25 out via $pif setup keep-state
$cmd 061 $skip tcp from any to any 110 out via $pif setup keep-state

# Allow out FreeBSD (make install & CVSUP) functions
# Basically give user root "GOD" privileges.
$cmd 070 $skip tcp from me to any out via $pif setup keep-state uid root

# Allow out ping
$cmd 080 $skip icmp from any to any out via $pif keep-state

# Allow out Time
$cmd 090 $skip tcp from any to any 37 out via $pif setup keep-state

# Allow out nntp news (i.e. news groups)
$cmd 100 $skip tcp from any to any 119 out via $pif setup keep-state

# Allow out secure FTP, Telnet, and SCP
# This function is using SSH (secure shell)
$cmd 110 $skip tcp from any to any 22 out via $pif setup keep-state

# Allow out whois
$cmd 120 $skip tcp from any to any 43 out via $pif setup keep-state

# Allow ntp time server
$cmd 130 $skip udp from any to any 123 out via $pif keep-state

#################################################################
# Interface facing Public Internet (Inbound Section)
# Check packets originating from the public Internet
# destined for this gateway server or the private network.
#################################################################

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 300 deny all from 192.168.0.0/16  to any in via $pif  #RFC 1918 private IP
$cmd 301 deny all from 172.16.0.0/12   to any in via $pif  #RFC 1918 private IP
$cmd 302 deny all from 10.0.0.0/8      to any in via $pif  #RFC 1918 private IP
$cmd 303 deny all from 127.0.0.0/8     to any in via $pif  #loopback
$cmd 304 deny all from 0.0.0.0/8       to any in via $pif  #loopback
$cmd 305 deny all from 169.254.0.0/16  to any in via $pif  #DHCP auto-config
$cmd 306 deny all from 192.0.2.0/24    to any in via $pif  #reserved for docs
$cmd 307 deny all from 204.152.64.0/23 to any in via $pif  #Sun cluster
$cmd 308 deny all from 224.0.0.0/3     to any in via $pif  #Class D & E multicast

# Deny ident
$cmd 315 deny tcp from any to any 113 in via $pif

# Deny all Netbios service. 137=name, 138=datagram, 139=session
# Netbios is MS/Windows sharing services.
# Block MS/Windows hosts2 name server requests 81
$cmd 320 deny tcp from any to any 137 in via $pif
$cmd 321 deny tcp from any to any 138 in via $pif
$cmd 322 deny tcp from any to any 139 in via $pif
$cmd 323 deny tcp from any to any 81  in via $pif

# Deny any late arriving packets
$cmd 330 deny all from any to any frag in via $pif

# Deny ACK packets that did not match the dynamic rule table
$cmd 332 deny tcp from any to any established in via $pif

# Allow traffic in from ISP's DHCP server. This rule must contain
# the IP address of your ISP's DHCP server as it's the only
# authorized source to send this packet type.
# Only necessary for cable or DSL configurations.
# This rule is not needed for 'user ppp' type connection to
# the public Internet. This is the same IP address you captured
# and used in the outbound section.
$cmd 360 allow udp from x.x.x.x to any 68 in via $pif keep-state

# Allow in standard www function because I have Apache server
$cmd 370 allow tcp from any to me 80 in via $pif setup limit src-addr 2

# Allow in secure FTP, Telnet, and SCP from public Internet
$cmd 380 allow tcp from any to me 22 in via $pif setup limit src-addr 2

# Allow in non-secure Telnet session from public Internet
# labeled non-secure because ID & PW are passed over public
# Internet as clear text.
# Delete this sample group if you do not have telnet server enabled.
$cmd 390 allow tcp from any to me 23 in via $pif setup limit src-addr 2

# Reject & Log all unauthorized incoming connections from the public Internet
$cmd 400 deny log all from any to any in via $pif

# Reject & Log all unauthorized out going connections to the public Internet
$cmd 450 deny log all from any to any out via $pif

# This is skipto location for outbound stateful rules
$cmd 800 divert natd ip from any to any out via $pif
$cmd 801 allow ip from any to any

# Everything else is denied by default
# deny and log all packets that fell through to see what they are
$cmd 999 deny log all from any to any
################ End of IPFW rules file ###############################

±¾ÎĵµºÍÆäËüÎĵµ¿É´ÓÕâÀïÏÂÔØ£ºftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.

Èç¹û¶ÔÓÚFreeBSDÓÐÎÊÌ⣬ÇëÏÈÔĶÁÎĵµ£¬Èç²»Äܽâ¾öÔÙÁªÏµ<questions@FreeBSD.org>.
¹ØÓÚ±¾ÎĵµµÄÎÊÌâÇë·¢ÐÅÁªÏµ <doc@FreeBSD.org>.