OPENBSD上的ADSL和防火墙设置

llzqq

偶在翻阅了大量网上文档后，实验整理了一下OPENBSD环境中ADSL、PF的配置过程。希望对OPENBSD的初学者有些帮助。下面我用的是OPENBSD 3.6

配置ADSL：
# vi /etc/ppp/ppp.conf
========================ppp.conf=======================
default:
set log Phase Chat IPCP CCP tun command
set redial 15 0
set reconnect 15 10000
     
pppoe:
set device "!/usr/sbin/pppoe -i rl1"
disable acfcomp protocomp
deny acfcomp
set mtu max 1492
set crtscts off
set speed sync
enable lqr
set lqrperiod 5
set cd 5
set dial
set login
set timeout 0
set authname "sjz681a0156@adsl2"
set authkey 123456
add! default HISADDR
enable mssfixup
========================ppp.conf=======================

建立防火墙代理配置：
# vi /etc/pf.conf
=========================pf.conf=======================
ext_if = "tun0"
int_if = "{ dc0, rl0 }"
int_net = "{ 192.168.0.0/24, 192.168.10.0/24 }"
loop = "lo0"
tcp_services = "{ www, ftp }"
boss_ip = "{ 192.168.10.10, 192.168.10.11, 192.168.10.12, 192.168.10.13, 192.168.10.14, 192.168.10.15 }"
noroute = "{ 127.0.0.1/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 255.255.255.255/32 }"
set block-policy return
set loginterface $ext_if

set optimization aggressive

scrub in all

altq on $int_if cbq bandwidth 1200Kb queue { dflt, boss }
queue dflt bandwidth 300Kb cbq(default)
queue boss bandwidth 900Kb cbq(borrow)

nat on $ext_if from $int_net to any ->; $ext_if

block all

block return
block in quick on $ext_if os NMAP
block in quick on $ext_if from $noroute to any
block out quick on $ext_if from any to $noroute

pass in quick on $ext_if inet proto tcp from any to any port >; 60000 keep state
#pass in quick on $ext_if inet proto icmp all icmp-type 8 code 0 keep state
pass in quick on $ext_if inet proto tcp from any to any port $tcp_services flags S/SAFR keep state

pass quick on $loop all
pass in  on $int_if from $int_net
pass out on $int_if from any to $int_net
pass out on $int_if from any to $boss_ip queue boss
pass out on $ext_if all keep state

pass in on $ext_if inet proto tcp from any to any port = 80 flags S/SAFR keep state (max 200, source-track rule, max-src-nodes 200, max-src-states 2)                              
=========================pf.conf=======================

禁用系统自定义的PF规则

# vi /etc/rc.conf
pf=NO

启用IP转发：
# vi /etc/sysctl.conf
net.inet.ip.forwarding=1

设置开机启动ADSL拨号：

# mkdir /etc/rc.d
# vi /etc/rc.d/adsl.sh
--------------+----------------+---------------+-------------
#!/bin/sh
# /etc/rc.d/adsl.sh
# 7-11-2004
# llzqq@126.com

pppoe_status () {

        IP=$(/sbin/ifconfig tun0 | awk '/netmask/{print $2}')

        if [ ! -z "$IP" ]; then
                echo "pppoe link is up, ip: " $IP
        else
                echo "pppoe link is down"
        fi
}

pppoe_start () {

        echo -n "starting pppoe "; ppp -ddial pppoe >; /dev/null

        for i in 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0; do
               sleep 2; echo -n "."
              IP=$(/sbin/ifconfig tun0 | awk '/netmask/{print $2}')
              if [ ! -z "$IP" ]; then
                      break
              fi
        done
        echo "."
        pppoe_status
}

pppoe_stop () {

        PID=$(ps aux | awk '/ppp -ddial/{print $2}')
        kill $PID
        echo "pppoe link is down"
}

case "$1" in
        'start')
                pppoe_start
                ;;
        'stop')
                pppoe_stop
                ;;
        'status')
                pppoe_status
                ;;
        *)
                echo "Usage: $0 {start|stop|status}"
                exit 1
esac
--------------+----------------+---------------+-------------
# chmod 555 /etc/rc.d/adsl.sh

开机时自动进行ADSL拨号

# vi /etc/rc.local

if [ -f /etc/ppp/ppp.conf ]; then
       . /etc/rc.d/adsl.sh start
fi

# vi /etc/rc.shutdown
/etc/rc.d/adsl.sh stop

启用NAME缓存服务器(不是必须的)：
# vi /var/named/named.boot
options forward-only
forwarders 202.99.160.68 202.99.168.8

根据拨号需要加载和关闭防火墙：
# vi /etc/ppp/ppp.linkup
MYADDR:
! sh -c "/sbin/ifconfig pflog0 up"
! sh -c "/sbin/pflogd"
! sh -c "/sbin/pfctl -e -F all -f /etc/pf.conf"

# vi /etc/ppp/ppp.linkdown
MYADDR:
! sh -c "/sbin/pfctl -d -F all"
! sh -c "kill `cat /var/run/pflogd.pid`"
! sh -c "/sbin/ifconfig pflog0 down"
! sh -c "/sbin/route delete default"

配置动态域名更新：

# tar zxvf ez-ipupdate-3.0.10.tgz
# cd ez-ipupdate-3.0.10
# vi conf_file.c
增加一行：
#include <errno.h>;

# vi ez-ipupdate.c
注释掉下面几行(4515行)：
//else
//  {
//   fprintf(stderr, "no update needed at this time\n");
//  }

# ./configure
# make
# make install

设置拨号后自动运行：

# vi /etc/ppp/ppp.linkup
MYADDR:
! sh -c "/sbin/ifconfig pflog0 up"
! sh -c "/sbin/pflogd"
! sh -c "/sbin/pfctl -e -F all -f /etc/pf.conf"
!bg /usr/local/bin/ez-ipupdate -i tun0 -h nero.3322.org -S qdns -w wildcard -u user:pwd

解决通过PF防火墙用主动模式连接外网FTP服务器的问题：

# vi /etc/pf.conf
rdr on $int_if proto tcp from any to any port 21 ->; 127.0.0.1 port 8021

# vi /etc/inetd.conf
127.0.0.1:8021 stream tcp nowait root /usr/libexec/ftp-proxy ftp-proxy

# reboot

设置SQUID的透明代理：

# vi /etc/squid/squid.conf
http_port 127.0.0.1:3128

# vi /etc/pf.conf
rdr on $int_if proto tcp from $int_net to any port 80 -> 127.0.0.1 port 3128

[ 本帖最后由 llzqq 于 2006-2-21 07:13 编辑 ]

剑心通明

不错，继续继续，呵呵

llzqq

大力支持剑心老弟把BSD版搞好，努力啊

mafa

llzqq真是快服了你，什么都搞而且还什么都好！

congli

好!
llzqq支持你!

mafa

多来点netbsd的，这个版太少了。

mouseshow

看了一下pf.conf文档,我没有做ADSL网关的经验,但发现pf.conf文档中有几处不明白的地方,请教一下.
pass in quick on $ext_if inet proto tcp from any to any port > 60000 keep state
把60000以上的端口打开,这是基于什么理由?
pass out on $int_if from any to $boss_ip queue boss
pass out on $ext_if all keep state
~~~~~~~~~~~~~~~~~~~~~\这条不是多余的吗?
pass in on $ext_if inet proto tcp from any to $web_server port = 80 flags S/SAFR keep state (max 200, source-track rule, max-src-nodes 200, max-src-states 2) queue boss

设置了boss和dflt两个queue,却只见boss,不见dflt,特别是最后一条,boss是内网的,$web_server也是网内的,却在外网卡上做一条pass规则,还要queue,这是怎么回事?

jim0769

学习

大鬼不动

谢谢楼主经验分享正在做这方面研究！

axlrose

对于ADSL, nat on $ext_if from $int_net to any -> $ext_if   用 nat on $ext_if from $int_net to any ->($ext_if) 会更好点吧

rdr on $int_if proto tcp from $int_net to any port 80 -> 127.0.0.1 port 3128  听说电信要开始封80端口了，像3322这种架WEB可能要换端口了，一切为了“护花”

[ 本帖最后由 axlrose 于 2010-1-4 09:33 编辑 ]