标题: 关于ipfw的疑问 [打印本页] 作者: overdose 时间: 2009-06-09 10:28 标题: 关于ipfw的疑问 各位兄弟大家好
今天我仔细查看了下面文档中的 http://www.freebsd.org/doc/en_US ... firewalls-ipfw.html]http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipfw.html
一个InclusiveRuleset例子：
30.6.5.6 An Example InclusiveRuleset
我的疑问是
它既然是Inclusive的规则，也就是说ipfw的65535号规则必然是deny ip from any to any
那为何又要在规则中加入deny规则行？
比如下面的：
# Deny all inbound traffic from non-routable reserved address spaces
$cmd 00300 deny all from 192.168.0.0/16 to any in via $pif #RFC 1918 private IP
$cmd 00301 deny all from 172.16.0.0/12 to any in via $pif #RFC 1918 private IP
$cmd 00302 deny all from 10.0.0.0/8 to any in via $pif #RFC 1918 private IP
$cmd 00303 deny all from 127.0.0.0/8 to any in via $pif #loopback
$cmd 00304 deny all from 0.0.0.0/8 to any in via $pif #loopback
$cmd 00305 deny all from 169.254.0.0/16 to any in via $pif #DHCP auto-config
$cmd 00306 deny all from 192.0.2.0/24 to any in via $pif #reserved for docs
$cmd 00307 deny all from 204.152.64.0/23 to any in via $pif #Sun cluster interconnect
$cmd 00308 deny all from 224.0.0.0/3 to any in via $pif #Class D & E multicast
这不是画蛇添足吗？
请知道其原因者指点一二。
谢谢作者: lsstarboy 时间: 2009-06-09 15:16
它既然是Inclusive的规则，也就是说ipfw的65535号规则必然是deny ip from any to any