关于IPFW明示允许规则集的一些疑问

migoumigou

初学ipfw，是小菜，所以有些疑问请教
内核编译的时候，已经放入了options    IPFIREWALL_DEFAULT_TO_ACCEPT
现在想要做一个明示允许的规则集，除了规则集中列出的MAC列表allow，其他都deny，这样写的：
ipfw -q -f flush
ipfw -q add 00050 divert 8668 ip4 from any to any via bge0
ipfw -q add 00100 allow ip from any to any via lo0
ipfw -q add 00200 deny ip from any to 127.0.0.0/8
ipfw -q add 00300 deny ip from 127.0.0.0/8 to any
ipfw -q add 00400 allow ip from any to any MAC x0:0x:0x:0x:0x:0x any
ipfw -q add 00500 allow ip from any to any MAC x0:0x:0x:0x:0x:0x any
ipfw -q add 00600 allow ip from any to any MAC x0:0x:0x:0x:0x:0x any
ipfw -q add 65535 deny ip from any to any
重启加载规则后ipfw list，前面的几项规则都显示正常，唯独65535还是
65535 allow ip from any to any
然后规则中MAC列表以外的机器仍可以正常通过防火墙连接外网

请问是规则集写的有问题吗？烦请指出哪里有问题？
如果规则集没有问题，那是不是明示允许的规则，前提是必须把内核中的options    IPFIREWALL_DEFAULT_TO_ACCEPT拿掉，重新编译内核，才能让上面的规则集正常运作？

fender0107401

kernel里面的那个是最后的默认设置吧。

lsstarboy

那你就用下面一句，65535那句你不可能把它重新定义，而是会有两个65535，加上65534后，65535永远不起作用：
ipfw -q add 65534 deny ip from any to any

fender0107401

Check this！

1. ################################################################################
   
2. 
   
3. # delete all rules
   
4. 
   
5. ipfw -q -f flush
   
6. 
   
7. # variable declaration
   
8. 
   
9. nic="re0"
   
10. 
    
11. dns1="+++"
    
12. 
    
13. dns2="+++"
    
14. 
    
15. dhcp="192.168.1.1"
    
16. 
    
17. cmd="ipfw -q add "
    
18. 
    
19. ks="keep-state"
    
20. 
    
21. ################################################################################
    
22. 
    
23. # loopback
    
24. 
    
25. $cmd 00100 allow all from any to any via lo0
    
26. 
    
27. $cmd 00200 check-state
    
28. 
    
29. ################################################################################
    
30. 
    
31. # dns
    
32. 
    
33. $cmd 00300 allow tcp from me to $dns1 53 out via $nic setup $ks
    
34. 
    
35. $cmd 00400 allow udp from me to $dns2 53 out via $nic $ks
    
36. 
    
37. $cmd 00500 allow tcp from me to $dns1 53 out via $nic setup $ks
    
38. 
    
39. $cmd 00600 allow udp from me to $dns2 53 out via $nic $ks
    
40. 
    
41. # dhcp
    
42. 
    
43. $cmd 00700 allow udp from me to $dhcp 67 out via $nic $ks
    
44. 
    
45. ################################################################################
    
46. 
    
47. # www
    
48. 
    
49. $cmd 00800 allow tcp from me to any 80 out via $nic setup $ks
    
50. 
    
51. # secure www
    
52. 
    
53. $cmd 00920 allow tcp from me to any 443 out via $nic setup $ks
    
54. 
    
55. # email
    
56. 
    
57. $cmd 01000 allow tcp from me to any 587 out via $nic setup $ks
    
58. 
    
59. $cmd 01100 allow tcp from me to any 995 out via $nic setup $ks
    
60. 
    
61. # irc
    
62. 
    
63. $cmd 01200 allow tcp from me to any 7000 out via $nic setup $ks
    
64. 
    
65. # ftp
    
66. 
    
67. $cmd 01300 allow tcp from me to any 21 out via $nic setup $ks
    
68. 
    
69. $cmd 01400 allow tcp from me to any 1024-65535 out via $nic setup $ks
    
70. 
    
71. # ntp
    
72. 
    
73. $cmd 01500 allow udp from me to any 123 out via $nic $ks
    
74. 
    
75. # csup
    
76. 
    
77. $cmd 01600 allow tcp from me to any out via $nic setup $ks uid root
    
78. 
    
79. ################################################################################

复制代码

migoumigou

那你就用下面一句，65535那句你不可能把它重新定义，而是会有两个65535，加上65534后，65535永远不起作用： ...
lsstarboy 发表于 2011-04-22 19:08

先谢~
    这样可以哦？好的，我试试看...

migoumigou

Check this！
fender0107401 发表于 2011-04-22 19:18

    谢谢
规则定义的很详细，必然要拿来试试看，辛苦辛苦~