|
一、内核配置dAwLinux联盟
/usr/src/sys/i386/conf/HQ_SuperServer 代码:dAwLinux联盟
options IPFIREWALLdAwLinux联盟
options IPFIREWALL_DEFAULT_TO_ACCEPTdAwLinux联盟
options IPDIVERT # IPDIVERT enables the divert IP sockets, used by ''ipfw divert''dAwLinux联盟
options IPFIREWALL_VERBOSEdAwLinux联盟
options IPFIREWALL_VERBOSE_LIMIT=30 #options IPFILTER #ipfilter supportdAwLinux联盟
#options IPFILTER_LOG #ipfilter logging # traffic shaper, bandwidth manager and delay emulatordAwLinux联盟
options DUMMYNET # enables the "dummynet" bandwidth limiter. You need IPFIREWALL as well.dAwLinux联盟
# Statically Link in accept filters for a web server on this boxdAwLinux联盟
options ACCEPT_FILTER_DATAdAwLinux联盟
options ACCEPT_FILTER_HTTPdAwLinux联盟
options ICMP_BANDLIM # D.O.S. protectiondAwLinux联盟
options IPSTEALTH #To hide firewall from traceroutedAwLinux联盟
options TCP_DROP_SYNFIN #To hide from nmap OS fingerprint, remove if create web serverdAwLinux联盟
二、rc.conf配置dAwLinux联盟
/etc/rc.conf 代码:dAwLinux联盟
firewall_enable="YES"dAwLinux联盟
firewall_logging="YES"dAwLinux联盟
firewall_script="/etc/rc.firewall"dAwLinux联盟
firewall_quiet="NO" #change to YES once happy with rulesdAwLinux联盟
firewall_logging_enable="YES" #extra firewalling optionsdAwLinux联盟
log_in_vain="YES"dAwLinux联盟
#This option prevents something known as OS fingerprinting, must have TCP_DROP_SYNFIN compiled into kernel to usedAwLinux联盟
tcp_drop_synfin="NO" #change to NO if create webserverdAwLinux联盟
tcp_restrict_rst="YES"dAwLinux联盟
icmp_drop_redirect="YES" 三、ipfw使用 代码:dAwLinux联盟
ipfw add allow tcp from to in recvdAwLinux联盟
添加和除去规则例子：dAwLinux联盟
代码:dAwLinux联盟
$ sudo ipfw add deny tcp from 61.49.203.115 to 61.49.203.114 22 in recv fxp0dAwLinux联盟
$ sudo ipfw -t listdAwLinux联盟
$ sudo ipfw delete 00100dAwLinux联盟
禁止icmpdAwLinux联盟
代码:dAwLinux联盟
$ sudo ipfw add deny icmp from any to any in recv fxp0dAwLinux联盟
显示rulesdAwLinux联盟
代码:dAwLinux联盟
$ sudo ipfw showdAwLinux联盟
按照序号显示规则dAwLinux联盟
代码:dAwLinux联盟
$ sudo ipfw -t listdAwLinux联盟
列出信息包的数目，和与它们相对应的规则匹配dAwLinux联盟
代码:dAwLinux联盟
$ sudo ipfw -a list 四、/etc/ipfw.rules规则文件dAwLinux联盟
代码:dAwLinux联盟
allow 00010 udp from any to me 67 in via $iifdAwLinux联盟
allow 00020 udp from me 68 to any out via $iifdAwLinux联盟
五、/etc/rc.firewall脚本 代码:dAwLinux联盟
# mv /etc/rc.firewall /etc/rc.firewall.origdAwLinux联盟
# touch /etc/rc.firewalldAwLinux联盟
# chmod u=+rx,og=-rwx /etc/ipfw.rulesdAwLinux联盟
/etc/rc.firewall 代码:dAwLinux联盟
#!/bin/sh # This will flush the existing rules - sudo ipfw -f flushdAwLinux联盟
# You can execute this script without dropping existing connections/states fwcmd="/sbin/ipfw -q"dAwLinux联盟
extif="fxp0"dAwLinux联盟
myip="10.1.8.114"dAwLinux联盟
mybcast="10.1.8.119"dAwLinux联盟
mynetwork="10.1.8.112/29"dAwLinux联盟
dns_server="10.1.8.1" # Reset all rules in case script run multiple timesdAwLinux联盟
${fwcmd} -f flush ${fwcmd} add 200 check-state # Block RFC 1918 networks - the , syntax only works in ipfw2dAwLinux联盟
${fwcmd} add 210 deny all from 0.0.0.0/7,1.0.0.0/8,2.0.0.0/8,5.0.0.0/8,10.0.0.0/8,23.0.0.0/8,\dAwLinux联盟
27.0.0.0/8,31.0.0.0/8,67.0.0.0/8,68.0.0.0/6,72.0.0.0/5,80.0.0.0/4,96.0.0.0/3,127.0.0.0/8,\dAwLinux联盟
128.0.0.0/16,128.66.0.0/16,169.254.0.0/16,172.16.0.0/12,191.255.0.0/16,192.0.0.0/16,\dAwLinux联盟
192.168.0.0/16,197.0.0.0/8,201.0.0.0/8,204.152.64.0/23,224.0.0.0/3,240.0.0.0/8 to any # Allow all via loopback to loopbackdAwLinux联盟
${fwcmd} add 220 allow all from any to any via lo0 # Allow from me to anywheredAwLinux联盟
${fwcmd} add 240 allow tcp from ${myip} to any setup keep-statedAwLinux联盟
${fwcmd} add 260 allow udp from ${myip} to any keep-statedAwLinux联盟
${fwcmd} add 280 allow icmp from ${myip} to any # Allow local LAN to connect to usdAwLinux联盟
${fwcmd} add 300 allow ip from ${mynetwork} to ${mynetwork} # Allow INCOMING SSH,SMTP,HTTP from anywhere on the internetdAwLinux联盟
${fwcmd} add 320 allow log tcp from any to ${myip} 22,25,80 in keep-state setup # Disable icmpdAwLinux联盟
${fwcmd} add 340 allow icmp from any to any icmptype 0,3,11 # Block all other traffic and log indAwLinux联盟
${fwcmd} add 360 deny log all from any to any # End of /etc/rc.firewalldAwLinux联盟
六、 ipfw日志纪录配置dAwLinux联盟
/etc/syslog.confdAwLinux联盟
代码:dAwLinux联盟
!ipfwdAwLinux联盟
*.* /var/log/ipfw.logdAwLinux联盟
代码:dAwLinux联盟
$ sudo touch /var/log/ipfw.logdAwLinux联盟
$ sudo killall -HUP syslogd
Linux联盟收集整理 ,转贴请标明原始链接,如有任何疑问欢迎来本站Linux论坛讨论 |
|
