论坛徽章:: 0

电梯直达

1楼 [收藏(0)] [报告]

发表于 2005-04-24 17:19 |只看该作者 |倒序浏览

摸索好久才把IPFilter 的配置搞定，和大家分享，不妥之处还得请教。\r\n\r\nSolaris 9发行光盘里好像没有IPfilter 的这样的工具，先是安装IPfilter工具包。从http://coombs.anu.edu.au/~avalon/官方网站，下得ip_fil4.1.8.tar.gz+ pfil-2.1.6.tar.gz,很感动，是免费的。好了，我们开始工作吧。\r\n\r\nbash-2.05#cd /opt\r\nbash-2.05#mkdir tmp\r\nbash-2.05#cd tmp\r\nbash-2.05#pwd\r\n/opt/tmp\r\nbash-2.05# wget\r\nbash: wget: command not found\r\nbash-2.05# find / -name wget -print\r\n/usr/sfw/bin/wget\r\n^C\r\nbash-2.05# /usr/sfw/bin/wget http://coombs.anu.edu.au/~avalon/ip_fil4.1.8.tar.gz\r\n--15:42:45-- http://coombs.anu.edu.au/%7Eavalon/ip_fil4.1.8.tar.gz\r\n =>; `ip_fil4.1.8.tar.gz\'\r\nConnecting to coombs.anu.edu.au:80... connected!\r\nHTTP request sent, awaiting response... 200 OK\r\nLength: 1,000,270 [application/x-tar]\r\n.............\r\n.............\r\n.............\r\n\r\n15:43:08 (44.01 KB/s) - `ip_fil4.1.8.tar.gz\' saved [1000270/1000270]\r\n\r\nbash-2.05# /usr/sfw/bin/wget ftp://coombs.anu.edu.au/pub/net/ip-filter/pfil-2.1.6.tar.gz\r\n--15:47:09-- ftp://coombs.anu.edu.au/pub/net/ip-filter/pfil-2.1.6.tar.gz\r\n =>; `pfil-2.1.6.tar.gz\'\r\nConnecting to coombs.anu.edu.au:21... connected!\r\nLogging in as anonymous ... Logged in!\r\n==>; SYST ... done. ==>; PWD ... done.\r\n==>; TYPE I ... done. ==>; CWD /pub/net/ip-filter ... done.\r\n==>; PORT ... done. ==>; RETR pfil-2.1.6.tar.gz ... \r\n\r\n...........\r\n...........\r\n...........\r\n\r\n还好，网速可以，很快就可以下下这两个工具，Let\'s Go...\r\n\r\nbash-2.05# ls\r\nip_fil4.1.8.tar.gz pfil-2.1.6.tar.gz\r\nbash-2.05# gzip -d ip_fil4.1.8.tar.gz\r\nbash-2.05# gzip -d pfil-2.1.6.tar.gz\r\nbash-2.05# ls\r\nip_fil4.1.8.tar pfil-2.1.6.tar\r\nbash-2.05# tar -xvf ip_fil4.1.8.tar \r\nbash-2.05# tar -xvf pfil-2.1.6.tar \r\nbash-2.05# ls\r\nip_fil4.1.8 ip_fil4.1.8.tar pfil pfil-2.1.6.tar\r\n\r\nOk,终于搞定了这两个工具包，记得先要安装 pfil ,再安装 ip_fil4.1.8, 不然装了IPfilter 系统重启时会提示模块没有识别等等错误，小心哦。Let\'s Go.\r\n\r\nbash-2.05# cd pfil\r\nbash-2.05# make\r\nbash-2.05# make install\r\n\r\n(哦，

,搞忘了告诉你这里的make 是基于 GNU的编辑器，注意设置系统PATH相关的路径，不然会提示出错的。设置如下：\r\n#vi ~/.profile\r\nPATH=$PATH:/usr/sbin:/usr/bin:usr/ccs/bin:/opt/SUNWspro/bin\r\nexport PATH\r\nbash-2.05# make\r\nmake: Fatal error: No arguments to build\r\n\r\n当看到如此的提示时，表示系统找到了Make的设置路径了。OK,终于可以继续了，

\r\n)\r\n\r\nbash-2.05# cd ip_fil4.1.8\r\nbash-2.05# make solaris\r\nbash-2.05# cd SunOS5\r\nbash-2.05# make install\r\n\r\n(ok,

,碰到错误没有,没有的话，一切还好。如果碰到错误，无非是 \'\'cc not find \",

,记不起来怎么样的语句,记得 cc的编辑器是使用 Solaris的cc 编译器，否则有很多错误哦, 记得系统原本没有带这个编辑器,从Solaris的发行工具包中 Bonus Softwar 中, Forte Developer 7找到这个编辑器。其实,上面的配置已经设置了,如opt/SUNWspro/bin,好期待没有错误吧，警告少不了的 :em11: )\r\n\r\n好了,可以继续了...\r\n\r\nbash-2.05# init 6\r\n\r\n如果系统启动正常，表示ipfilter 安装成功。很好！！

\r\n\r\n现在开始说说网络的使用了。我是采用两张网卡：hme0(内网,ip:a.b.c.d)和eri0(外网，ip:w,x,y,z).Ipfilter 一方面启到包过滤的作用，另一方面启到NAT的作用，很好，这正是我所要的。当然要使IPFilter 在Solaris下正常工作，少不了设置ip_ forwarding的参数，OK，Let\'s Go:\r\n\r\nbash-2.05# vi /etc/rc2.d/S69ipforward \r\n#!/bin/sh\r\n case \"$1\" in\r\n start)\r\n echo \"Activating IP Forwarding ...\"\r\n /usr/sbin/ndd -set /dev/tcp ip_forwarding 1\r\n /usr/sbin/ndd -set /dev/tcp tcp_smallest_anon_port 25000\r\n /usr/sbin/ndd -set /dev/ip ip_respond_to_echo_broadcast 0\r\n ;;\r\n stop)\r\n echo \"De-activating IP Forwarding ... \"\r\n /usr/sbin/ndd -set /dev/tcp ip_forwarding 0\r\n /usr/sbin/ndd -set /dev/tcp tcp_smallest_anon_port 32768\r\n /usr/sbin/ndd -set /dev/ip ip_respond_to_echo_broadcast 1\r\n ;;\r\n *)\r\n echo \"Usage: $0 (start|stop)\" >;&2\r\n exit 1\r\n ;;\r\n esac\r\n exit 0\r\n\r\n(

,哦，哦，我也设置了其他两个参数，具体可以查考其他说明，

)\r\n\r\nbash-2.05# chmod 744 /etc/rc2.d/S69ipforward\r\nbash-2.05# cd /etc/opt/ipf\r\nbash-2.05# ls\r\nipf.conf\r\n\r\nOK，ipf.conf是设置包过滤方面的,ipnat.conf是设置NAT方面的,可以查看/etc/rc2.d/S65ipfboot的启动文件,发现主要是靠这两个配置文件来使IPFilter工作的。对了刚开始没有ipnat.conf文件,自己建一个吧。Let\'s GO:\r\n\r\nbash-2.05# vi /etc/opt/ipf/ipnat.conf\r\n\r\nmap eri0 a.b.c.0/24 ->; w.x.y.z/32 portmap tcp/udp 10000:39999\r\nmap eri0 a.b.c.0/24 ->; w.x.y.z/32\r\n#上面两句是NAT地址转换,全靠你们啊。\r\n\r\nrdr eri0 w.x.y.z/32 port 40000-60000 ->; a.b.c.d port 40000 tcp\r\nmap eri0 a.b.c.0/24 ->; w.x.y.z/32 proxy port ftp ftp/tcp\r\n#上面两句是Ftp 处于Passive模式端口的对应模式,

,我是要使用Ftp的。\r\n\r\nrdr eri0 w.x.y.z/32 port 80 ->; a.b.c.d port 80\r\nrdr eri0 w.x.y.z/32 port 21 ->; a.b.c.d port 21\r\nrdr eri0 w.x.y.z/32 port 25 ->; a.b.c.d port 25\r\nrdr eri0 w.x.y.z/32 port 110 ->; a.b.c.d port 110\r\nrdr eri0 w.x.y.z/32 port 139 ->; a.b.c.d port 139\r\nrdr hme0 w.x.y.z/32 port 80 ->; a.b.c.d port 80\r\nrdr hme0 w.x.y.z/32 port 21 ->; a.b.c.d port 21\r\nrdr hme0 w.x.y.z/32 port 25 ->; a.b.c.d port 25\r\nrdr hme0 w.x.y.z/32 port 110 ->; a.b.c.d port 110\r\nrdr hme0 w.x.y.z/32 port 139 ->; a.b.c.d port 139\r\n#上面的几句是让外网能够访问内网的www、ftp、mail、网络共享服务\r\n(

,记得把w.x.y.z, a.b.c.d 换成你对应的IP啊).\r\n\r\n好了,NAT设置好了,我们继续设置ipf.conf吧，很重要的哦。\r\n\r\nbash-2.05# vi /etc/opt/ipf/ipf.conf\r\n\r\nblock in log quick all with short\r\nblock in log quick all with ipopts\r\nblock in log quick all with frag\r\nblock in log quick all with opt lsrr\r\nblock in log quick all with opt ssrr\r\n\r\npass out on hme0 all\r\npass in on hme0 all\r\npass out quick on lo0 all\r\npass in quick on lo0 all\r\n\r\nblock out on eri0 all\r\n\r\nblock out log on eri0 from any to 192.168.0.0/16\r\nblock out log quick on eri0 from any to 0.0.0.0/8\r\nblock out log quick on eri0 from any to 169.254.0.0/8\r\nblock out log quick on eri0 from any to 10.0.0.0/8\r\nblock out log quick on eri0 from any to 127.16.0.0/12\r\nblock out log quick on eri0 from any to 127.0.0.0/8\r\nblock out log quick on eri0 from any to 192.0.2.0/24\r\nblock out log quick on eri0 from any to 204.152.64.0/23\r\nblock out log quick on eri0 from any to 224.0.0.0/3\r\n\r\npass out log on eri0 proto tcp/udp from any to any keep state\r\npass out log on eri0 proto icmp all keep state\r\n\r\nSave, 保存好我们的设置吧,简单的防火墙,我们已经架起来了。\r\n\r\nbash-2.05# init 6\r\n\r\nOK, 重启后我们的Solaris工作站开始正常运作了,\r\n\r\nbash-2.05# ping www.sina.com.cn\r\nwww.sina.com.cn is alive\r\n\r\n客户端设置如下\r\n IP：a.b.c.x(

, x != d)\r\n NetMask:255.255.255.0\r\n Gateway:a.b.c.d\r\n\r\n DNS: ~ ~ ~ ~ (

，自己查了)\r\n winxp: Com模式\r\n：Microsoft Windows XP [版本 5.1.2600]\r\n(C) 版权所有 1985-2001 Microsoft Corp.\r\n\r\nC:\\>;ping www.sina.com.cn\r\n\r\nPinging jupiter.sina.com.cn [202.205.3.143] with 32 bytes of data:\r\n\r\nReply from 202.205.3.143: bytes=32 time=16ms TTL=53\r\nReply from 202.205.3.143: bytes=32 time=16ms TTL=53\r\nReply from 202.205.3.143: bytes=32 time=17ms TTL=53\r\nReply from 202.205.3.143: bytes=32 time=15ms TTL=53\r\n\r\nPing statistics for 202.205.3.143:\r\n Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),\r\nApproximate round trip times in milli-seconds:\r\n Minimum = 15ms, Maximum = 17ms, Average = 16ms\r\n\r\nok,我们的可爱的客户也能上网啊，

, 想跳楼， :wink: .\r\n\r\n(忘了说说，IPFilter的使用了。\r\nbash-2.05#ipmon -o N\r\n(实时显示当前NAT的状态)\r\nbash-2.05#ipf -F i (入)\r\nbash-2.05#ipf -F o(出)\r\n(清除入和出的防火墙规则)\r\nbash-2.05#ipf -f /etc/opt/ipf/ipf.conf\r\n(加载新设定的防火墙规则)\r\nbash-2.05#ipnat -CF\r\n(清除 NAT 规则)\r\nbash-2.05#ipnat -f /etc/opt/ipf/ipnat.conf\r\n(加载 NAT 规则)\r\n\r\nOVER, :em12: .)