5 ¥Õ¥¡¥¤¥¢¥¦¥©¡¼¥ë¤Ø¤Î¥ë¡¼¥ë¥»¥Ã¥È

¤³¤³¤Ç¤¢¤Ê¤¿¤Î¥·¥¹¥Æ¥àÍѤΥե¡¥¤¥¢¥¦¥©¡¼¥ë¥ë¡¼¥ë¤òÄêµÁ¤·¤Þ¤¹¡£ »ä¤¿¤Á¤¬µ­½Ò¤¹¤ë¥ë¡¼¥ë¥»¥Ã¥È¤Ï¡¢ÂçÉôʬ¤Î¥À¥¤¥¢¥ë¥¢¥Ã¥×¥æ¡¼¥¶¸þ¤±¤Î °ìÈÌŪ¤Ê¿÷·¿¤Ç¤¹¡£¥æ¡¼¥¶Ëè¤ÎÍ×µá¤Ë¤Ô¤Ã¤¿¤ê¹ç¤ï¤Ê¤¤¤Ç¤·¤ç¤¦¤¬¡¢IPFW ¤Îưºî¤Ë¤Ä¤¤¤Æ´ðËÜŪ¤ÊÍý²ò¤òÆÀ¤é¤ì¡¢Í×µá¤Ë¹ç¤ï¤»¤ÆÀßÄê¤òÊѹ¹¤¹¤ë ¤Î¤Ï·ë¹½´Êñ¤Ê¤Ï¤º¤Ç¤¹¡£

¤Þ¤º¤Ï¡¢Êĺ¿Åª¤Ê¥Õ¥¡¥¤¥¢¥¦¥©¡¼¥ë¤Î´ðÁ䫤é»Ï¤á¤Þ¤·¤ç¤¦¡£Êĺ¿Åª¤Ê ¥Õ¥¡¥¤¥¢¥¦¥©¡¼¥ë¤Ï¡¢ÀßÄ꤬¤Ê¤¤¾ì¹ç¤Ï¤¹¤Ù¤ÆµñÈݤ¹¤ë¤È¤¤¤¦¹Í¤¨¤Ë ´ð¤Å¤¤¤Æ¤¤¤Þ¤¹¡£¤½¤ì¤«¤é¡¢´ÉÍý¼Ô¤Ïµö²Ä¤·¤¿¤¤ÄÌ¿®ÍѤΥ롼¥ë¤òÌÀ¼¨Åª¤Ë ÄɲäǤ­¤Þ¤¹¡£ÄÌ¿®ÍѤΥ롼¥ë¤Ï¡¢µö²Ä¤¬Àè¤Ç¤½¤ì¤«¤éµñÈݤȤ¤¤¦ ½çÈ֤Ǥ¢¤ë¤Ù¤­¤Ç¤¹¡£µö²Ä¤·¤¿¤¤¤â¤Î¤¹¤Ù¤Æ¤Ë¤Ä¤¤¤Æ¥ë¡¼¥ë¤òÄɲ䷤ơ¢ ¤½¤ì°Ê³°¤Ï¤¹¤Ù¤Æ¼«Æ°Åª¤ËµñÈݤµ¤ì¤ë¤³¤È¤òÁ°Äó¤È¤·¤Þ¤¹¡£

¤½¤ì¤Ç¤Ï¡¢¥Õ¥¡¥¤¥¢¥¦¥©¡¼¥ë¤Î¥ë¡¼¥ë¤òÊݸ¤¹¤ë¥Ç¥£¥ì¥¯¥È¥ê¤ò ºîÀ®¤·¤Þ¤·¤ç¤¦¡£¤³¤ÎÎã¤Ç¤Ï¡¢ /etc/firewall ¤òÍѤ¤¤Þ¤¹¡£ ¥Ç¥£¥ì¥¯¥È¥ê¤ò¤½¤³¤ØÊѹ¹¤·¡¢ rc.conf ¤Çµ¬Äꤷ¤¿ fwrules ¥Õ¥¡¥¤¥ë¤òÊÔ½¸¤·¤Þ¤¹¡£ ¤³¤Î¥Õ¥¡¥¤¥ë̾¤ò¼«Ê¬¤¬Ë¾¤àǤ°Õ¤Î¤â¤Î¤ËÊѹ¹¤Ç¤­¤ë¤È¤¤¤¦¤³¤È¤Ëµ¤¤ò¤Ä¤±¤Æ¤¯¤À¤µ¤¤¡£ ¤³¤Î¼ê°ú¤­¤Ï¤¢¤Ê¤¿¤¬»È¤ª¤¦¤È¤¹¤ë¤«¤â¤·¤ì¤Ê¤¤¥Õ¥¡¥¤¥ë̾¤Î°ìÎã¤ò Í¿¤¨¤ë¤À¤±¤Ç¤¹¡£

¤½¤ì¤Ç¤Ï¡¢¤­¤Á¤ó¤ÈÃí¼á¤¬»Ü¤µ¤ì¤¿¥Õ¥¡¥¤¥¢¥¦¥©¡¼¥ë¥Õ¥¡¥¤¥ë¤Î Îã¤ò¸«¤Æ¤ß¤Þ¤·¤ç¤¦¡£

# (/etc/rc.firewall ¤Ë¤¢¤ë¤è¤¦¤Ë) »²¾È¤ò´Êñ¤Ë¤¹¤ë¤¿¤á¤Ë¥Õ¥¡¥¤¥¢¥¦¥©¡¼¥ë¤Î
# ¥³¥Þ¥ó¥É¤òÄêµÁ¤·¤Þ¤¹¡£ÆÉ¤ß¤ä¤¹¤¯¤¹¤ë¤Î¤ËÌòΩ¤Á¤Þ¤¹¡£
fwcmd="/sbin/ipfw"

# ³°¸þ¤±¥¤¥ó¥¿¥Õ¥§¡¼¥¹¤òÄêµÁ¤·¤Þ¤¹¡£¥æ¡¼¥¶¡¼¥é¥ó¥É ppp ¤Ç¤Ï¡¢
# ²¿¤âÀßÄꤷ¤Ê¤¤¤È tun0 ¤Ë¤Ê¤ê¤Þ¤¹¡£
oif="tun0"

# Æâ¸þ¤±¥¤¥ó¥¿¥Õ¥§¡¼¥¹¤òÄêµÁ¤·¤Þ¤¹¡£Ä̾ï¤Ï¥Í¥Ã¥È¥ï¡¼¥¯¥«¡¼¥É¤Ë
# ¤Ê¤ê¤Þ¤¹¡£¤³¤ì¤òɬ¤º¤¢¤Ê¤¿¤Î¥Í¥Ã¥È¥ï¡¼¥¯¥¤¥ó¥¿¥Õ¥§¡¼¥¹¤Ë
# ¹ç¤ï¤»¤ÆÊѹ¹¤¹¤ë¤è¤¦¤Ë¤·¤Æ¤¯¤À¤µ¤¤¡£
iif="fxp0"

# ¥ë¡¼¥ë¤òºÆÆÉ¹þ¤ß¤¹¤ëÁ°¤Ë¡¢¸½ºß¤Î¥ë¡¼¥ë¤ò¶¯À©Åª¤Ë¾Ãµî¤·¤Þ¤¹¡£
$fwcmd -f flush

# ¤¹¤Ù¤Æ¤Î¥Ñ¥±¥Ã¥È¤Î¾õÂÖ¤ò³Îǧ¤·¤Þ¤¹¡£
$fwcmd add check-state

# ³°¸þ¤±¥¤¥ó¥¿¥Õ¥§¡¼¥¹Â¦¤Ç¤Ê¤ê¤¹¤Þ¤·¤òËɤ®¤Þ¤¹¡£
$fwcmd add deny ip from any to any in via $oif not verrevpath

# »ä¤¿¤Á¤¬³«»Ï¤·¤¿Àܳ¤Ï¤¹¤Ù¤Æµö²Ä¤·¡¢¾õÂÖ¤òÊݸ¤·¤Þ¤¹¡£
# ¤·¤«¤·¡¢Æ°Åª¤Ê¥ë¡¼¥ë¤ò»ý¤¿¤Ê¤¤³ÎΩ¤·¤¿Àܳ¤ÏµñÈݤ·¤Þ¤¹¡£
$fwcmd add allow ip from me to any out via $oif keep-state
$fwcmd add deny tcp from any to any established in via $oif

# ¥Í¥Ã¥È¥ï¡¼¥¯Æâ¤ÎÀܳ¤Ï¤¹¤Ù¤Æµö²Ä¤·¤Þ¤¹¡£
$fwcmd add allow ip from any to any via $iif

# ¥í¡¼¥«¥ë¤ÊÄÌ¿®¤ò¤¹¤Ù¤Æµö²Ä¤·¤Þ¤¹¡£
$fwcmd add allow all from any to any via lo0
$fwcmd add deny all from any to 127.0.0.0/8
$fwcmd add deny ip from 127.0.0.0/8 to any

# ¥¤¥ó¥¿¡¼¥Í¥Ã¥È¦¤Î¥æ¡¼¥¶¤Ë 22 ÈÖ¤È 80 È֥ݡ¼¥È¤ØÀܳ¤¹¤ë¤³¤È¤ò
# µö²Ä¤·¤Þ¤¹¡£¤³¤ÎÎã¤Ç¤Ï¡¢sshd ¤È¥¦¥§¥Ö¥µ¡¼¥Ð¤Ø¤ÎÀܳ¤òÆÃ¤Ëµö²Ä¤·¤Æ¤¤¤Þ¤¹¡£
$fwcmd add allow tcp from any to me dst-port 22,80 in via $oif setup keep-state

# ICMP ¥Ñ¥±¥Ã¥È¤òµö²Ä¤·¤Þ¤¹¡£¥Û¥¹¥È¤ò ping(8) ¤Ë±þÅú¤µ¤»¤¿¤¯¤Ê¤±¤ì¤Ð¡¢
# icmptypes ¤«¤é 8 ¤òºï½ü¤·¤Æ¤¯¤À¤µ¤¤¡£
$fwcmd add allow icmp from any to any via $oif icmptypes 0,3,8,11,12

# »Ä¤ê¤Î¤¹¤Ù¤Æ¤òµñÈݤ·¤Æµ­Ï¿¤·¤Þ¤¹¡£
$fwcmd add deny log ip from any to any

22 ÈÖ¤È 80 È֥ݡ¼¥È¤Ø¤ÎÀܳ¤Î¤ß¤òµö²Ä¤·¡¢¤½¤ì°Ê³°¤Ë»î¤ß¤é¤ì¤¿ Àܳ¤Ï¤¹¤Ù¤Æµ­Ï¿¤¹¤ë¡¢´°Á´¤Ëµ¡Ç½¤¹¤ë¥Õ¥¡¥¤¥¢¥¦¥©¡¼¥ë¤¬¤Ç¤­¤Þ¤·¤¿¡£ ¤³¤ì¤Ç°ÂÁ´¤ËºÆµ¯Æ°¤¹¤ë¤³¤È¤¬¤Ç¤­¡¢¥Õ¥¡¥¤¥¢¥¦¥©¡¼¥ë¤¬¼«Æ°Åª¤Ë µ¯Æ°¤·¤Æ¥ë¡¼¥ë¥»¥Ã¥È¤¬ÆÉ¤ß¹þ¤Þ¤ì¤ë¤Ï¤º¤Ç¤¹¡£ ¤â¤·¤³¤ì¤Ë²¿¤«´Ö°ã¤¤¤ò¸«¤Ä¤±¤¿¤ê¡¢²¿¤«ÌäÂê¤ËÅö¤¿¤Ã¤¿¤ê¡¢ ¤³¤Î¥Ú¡¼¥¸¤ò²þÁ±¤¹¤ëÄ󰯤¬¤¢¤ë¤Ê¤é¡¢ ¤É¤¦¤«»ä¤ËÅŻҥ᡼¥ë¤òÁ÷¤Ã¤Æ²¼¤µ¤¤¡£

ËÜʸ½ñ¡¢¤ª¤è¤Ó¾¤Îʸ½ñ¤Ï ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/ ¤«¤é¥À¥¦¥ó¥í¡¼¥É¤Ç¤­¤Þ¤¹¡£

FreeBSD ¤Ë´Ø¤¹¤ë¼ÁÌ䤬¤¢¤ë¾ì¹ç¤Ë¤Ï¡¢¥É¥­¥å¥á¥ó¥È ¤òÆÉ¤ó¤À¾å¤Ç <questions@FreeBSD.org> ¤Þ¤Ç (±Ñ¸ì¤Ç) Ï¢Íí¤·¤Æ¤¯¤À¤µ¤¤¡£
ËÜʸ½ñ¤Ë´Ø¤¹¤ë¼ÁÌä¤Ë¤Ä¤¤¤Æ¤Ï¡¢<doc@FreeBSD.org> ¤Þ¤ÇÅŻҥ᡼¥ë¤ò (±Ñ¸ì¤Ç) Á÷¤Ã¤Æ¤¯¤À¤µ¤¤¡£