- 论坛徽章:
- 0
|
FreeBSD6.2下配置ipfw+pf+bridge+VLAN
编绎过程如下:
# cd /sys/i386/conf
# cp GENERIC ./kernel_fw
打开内核配置文件：
# ee ./kernel_fw
内核选项:
#------------------------------------
device vlan //VLAN
device if_bridge //bridge
options IPFIREWALL
options IPDIVERT //支持NAT
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=10
options IPSTEALTH
options ACCEPT_FILTER_DATA
options ACCEPT_FILTER_HTTP
options IPFIREWALL_FORWARD
options IPFIREWALL_DEFAULT_TO_ACCEPT //允许所有
options DUMMYNET //加载流控
options IPSTEALTH
options TCP_DROP_SYNFIN
options TCP_RESTRICT_RST
#------------------------------
device pf
device pflog
device pfsync
options IPFILTER //启用 “IPFILTER” 防火墙的支持
options IPFILTER_LOG //用于启用 IPF 的日志支持。
options IPFILTER_DEFAULT_BLOCK //将改变防火墙的默认动作, 所有不匹配防火墙的 pass 规则的包都会被阻止。
options ALTQ //启用 ALTQ 框架的支持。
options ALTQ_CBQ //用于启用基于分类的队列 (CBQ) 支持。
options ALTQ_RED 将启用随机预检测 (RED)。 RED 是一种用于防止网络拥塞的技术。
options ALTQ_RIO //将启用出入的随机预检测。
options ALTQ_HFSC //启用层次式公平服务平滑包调度器。
options ALTQ_PRIQ //启用优先队列 (PRIQ)。 PRIQ 首先允许高优先级队列中的包通过。
options ALTQ_NOPCC // 启用 ALTQ 的 SMP 支持。 如果是 SMP 系统， 则必须使用它。
options HZ=1000
options DEVICE_POLLING
#----------------------------------------------
编译内核：
# /usr/sbin/config kernel_fw
# cd ../compile/kernel_fw
# make depend
# make
# make install
#-----------------------------------
必要的配置文件:
/boot/loader.conf
if_vlan_load="YES"
if_bridge_load="YES"
ipdivert_load="YES"
/etc/sysctl.conf
net.link.ether.ipfw=1
net.link.bridge.ipfw=1
net.link.bridge.ipfw_arp=1
net.link.bridge.pfil_member=1
net.link.bridge.pfil_onlyip=1
/etc/rc.conf
pf_enable="YES"
pf_rules="/etc/pf.rule"
pflog_enable="YES"
pflog_file="/var/log/pflog"
firewall_enable="YES"
firewall_script="/etc/ipfw.rule"
firewall_type="/etc/ipfw.conf"
firewall_type="OPEN"
firewall_quiet="NO"
firewall_logging_enable="YES"
ifconfig_xl0="up"
ifconfig_xl0="up polling"
cloned_interfaces="bridge0 vlan2 vlan3 vlan4"
ifconfig_vlan2="vlan 2000 vlandev xl0 up"
ifconfig_vlan3="vlan 3000 vlandev xl0 up"
ifconfig_vlan4="vlan 4000 vlandev xl0 up"
fconfig_xl1="up"
autobridge_interfaces="bridge0"
autobridge_bridge0="xl1 vlan2 vlan3 vlan4"
ifconfig_ath0="inet channel 11 ssid 108m mode 11g mediaopt hostap"
ifconfig_bridge0="addm xl0 addm xl1 addm vlan2 addm vlan3 addm vlan4 up"
ifconfig_xl0="up"
ifconfig_xl1="up"
defaultrouter="172.16.140.254"
clear_tcp_enable="YES"
#------------------------------------------------
ifconfig运行:
home# ifconfig
xl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=49<RXCSUM,VLAN_MTU,POLLING>
ether 00:04:76:a0:13:68
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
xl1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=49<RXCSUM,VLAN_MTU,POLLING>
ether 00:04:79:66:84:42
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
inet6 ::1 prefixlen 128
inet 127.0.0.1 netmask 0xff000000
pfsync0: flags=0<> mtu 2020
syncpeer: 224.0.0.240 maxupd: 128
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33208
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet 172.16.140.10 netmask 0xffffff00 broadcast 172.16.140.255
ether 12:6b:4a:ac:e5:4d
priority 32768 hellotime 2 fwddelay 15 maxage 20
member: vlan4 flags=3<LEARNING,DISCOVER>
member: vlan3 flags=3<LEARNING,DISCOVER>
member: vlan2 flags=3<LEARNING,DISCOVER>
member: xl1 flags=3<LEARNING,DISCOVER>
member: xl0 flags=3<LEARNING,DISCOVER>
vlan2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether 00:04:76:a0:13:68
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
vlan: 2000 parent interface: xl0
vlan3: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether 00:04:76:a0:13:68
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
vlan: 3000 parent interface: xl0
vlan4: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether 00:04:76:a0:13:68
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
vlan: 4000 parent interface: xl0
#-----------------------------------------------------------------
三层交换机配置:
VLAN ID : 3000
Name : dx1
VLAN Type : Normal
IP Address : 220.16.62.65/27
Mac address : 00:05:3b:04:63:80
Tagged Ports : 2
Untagged Ports :
VLAN ID : 4000
Name : dx2
VLAN Type : Normal
IP Address : 220.16.62.33/27
Mac address : 00:05:3b:04:63:80
Tagged Ports : 2
Untagged Ports :
VLAN ID : 2000
Name : wt
VLAN Type : Normal
IP Address : 221.110.96.73/28
Mac address : 00:05:3b:04:63:80
Tagged Ports : 2
二层交换机配置:
Description : normal
VLAN ID : 2000
Name : v2000
Mac address : 00:05:3b:14:04:5d
Tagged Ports : 5
Untagged Ports : 2
Description : normal
VLAN ID : 3000
Name : v3000
Mac address : 00:05:3b:14:04:5d
Tagged Ports : 5
Untagged Ports : 3
Description : normal
VLAN ID : 4000
Name : v4000
Mac address : 00:05:3b:14:04:5d
Tagged Ports : 5
Untagged Ports : 4
Description : normal
小结：
pf 做桥时必须给定桥地址，不论是虚拟桥[bridge0]或上联网路接口[xl0]，两者合二为一，只能给他们一个地址，因为他们对外MAC是相同的。
以上的结果 bridge0这个桥是通了, 只是有断线情况问题,原因下来再找.
通过三层交换机打VLAN(802.1q)下来的数据就不能通过.
如果不经过bridge0, 直接用网线联接三层到二层是可以通过的. 也就说一定是bridge0和vlan的设置问题.
所有的配置都贴下了, 请大家帮看看. |
|
免费注册
发表于 2008-11-11 14:42
