ipfilter的疑问

wuming122

奇怪啊,我编译内核加了:
options IPFILTER
options IPFILTER_LOG
options IPFILTER_DEFAULT_BLOCK
以后连ping都ping不通了,提示我no route to host怎么回事啊?

carpyu

原帖由 "wuming122" 发表：

options IPFILTER_DEFAULT_BLOCK

wuming122

我把那句话注释掉了还不对啊

wuming122

我在内核里只加了这么两句:
options IPFILTER
options IPFILTER_LOG
/etc/rc.conf里也加了:
firewall_enable="NO"                              

gateway_enable="YES"
ipfilter_enable="YES"
ipf -C  -f  /etc/ipf.conf
ipfilter_flags="-E"
ipnat的我没加,因为我只要它作防火墙的.
/etc/ipf.conf 如下：
block in log quick all with short
block in log quick all with ipopts
block in log quick all with frag
block in log quick all with opt lsrr
block in log quick all with opt ssrr

pass in  on r10 all
pass out on r10  all
pass in  quick on lo0  all
pass out quick on lo0  all

pass in  quick on r10  from any to any port < 1024
pass out quick on r10  from any to any port < 1024

这样有问题吗???

wuming122

加了一句ipfilter_program="/etc/ipf.conf" 以后可以用了,不过options IPFILTER_DEFAULT_BLOCK
内核里是注释掉的,我再加上试试

wuming122

完蛋了,把内核里加了options IPFILTER_DEFAULT_BLOCK 之后,在rc.conf里去掉了ipf -C -f /etc/ipf.conf ,重新启动以后执行:
ipf -Fa
ipf -f /etc/ipf.conf
只能ping通127.0.0.1了,ping其他还是提示no route to host啊

wuming122

我又试试,内核里还是:
options IPFILTER
options IPFILTER_LOG
options IPFILTER_DEFAULT_BLOCK
然后在/etc/ipf.conf里只写两句:
pass in quick all
pass out quick all
这样都可以了,但我只想开个www和ftp服务,想让ssh可以连接,该如何写这个规则?还有看了好多资料,上面的那句:
pass out quick on lo0 all
那个lo0是干什么的?我只有一个网卡r10,是不是只需要写个:
pass out on r10 all
pass in on r10 all就行了?