- 论坛徽章:
- 0
|
一台服务器只运行WEB,HTTPS,SSH跟FTP之外其它都不会对外开放!但~~很奇怪我用内网机器去访问这台服务器竟然可以访问得到25跟110端口,我明明已经block掉了!!5555555555555555555555555555555
为什么会这样???大家救救我啊!!
具体规则是这样的:
#宏定义内网网段与网卡
net_card="rl0"
in_net="192.168.1.0/24"
#设置运行属性
set optimization normal
set limit { states 2500,frags 5000,src-nodes 1000 }
set timeout frag 30
set block-policy return
set skip on lo0
scrub in on $net_card all
#宏定义输入规则与TCP状态标记
pass_in = "pass in quick on rl0 proto "
post_in = " to rl0 "
flag = "flags S/SA"
#建立表
table <bad_hosts> persist
#具体规则
block all
block return
block in quick on $net_card fastroute proto udp from any to any port 33434 >< 33465
block quick on $net_card proto tcp from any port { 25,110 } to any
$pass_in tcp from $in_net $post_in port = 22 $flag keep state
#web's rules
$pass_in tcp from any $post_in port = 80 $flag synproxy state \
(max-src-conn 100,max-src-conn-rate 15/5,overload <bad_hosts> flush global)
$pass_in tcp from any $post_in port = 443 $flag synproxy state \
(max-src-conn 100,max-src-conn-rate 15/5,overload <bad_hosts> flush global)
#ftp's rules
$pass_in tcp from $in_net $post_in port = 21 $flag keep state
$pass_in tcp from $in_net $post_in port > 41951 $flag keep state
#dns and ping rules
$pass_in icmp from $in_net $post_in keep state
$pass_in udp from any port = 53 $post_in keep state
pass out quick on $net_card proto tcp from $net_card to any keep state
pass out quick on rl0 proto icmp from rl0 to any \
icmp-type 8 keep state
pass out quick on $net_card proto udp from $net_card to any port = 53 keep state
不知道怎么用xscan与SSS软件,或者使用telnet命令进行测试都是可以访问得到25跟110端口,而且我用netstat -an 查看过系统根本就没有25跟110端口启动!我还把一些关于sendmail的配置文件把sendmail停止掉了!苦想了N天,实在想不通!!但是防火墙却可以禁止其它端口如80这些是没问题的!!晕死了 |
|
免费注册
发表于 2006-02-16 13:07
发表于 2006-02-16 14:41
