pf+nat+dmz 问题求助

zayi

刚接触PF，边学边写的一个规则

有几个问题，请大家看看
1、ext_if 必须允许from any to any port 80的数据报进入，否则DMZ服务器不能访问，改目标地址为dmz服务器的外网地址就不行
2、内网用户能ping通DMZ服务器内网地址，但不能用服务器的内网地址10.1.1.10访问web服务,只能用外网地址

1.    
   
2.           电 信
   
3.              \
   
4.               \
   
5.                \  fxp0 222.222.222.209/28
   
6.               __\______
   
7.              |         |
   
8.              | PF防火墙|
   
9.              |_________|      
   
10.            fxp1/    \fxp2
    
11.               /      \
    
12.              /        \
    
13.         DMZ /          \内网
    
14.      servip:10.1.1.10   192.168.0.0/24
    

复制代码

         
rc.conf

1. 
   
2. defaultrouter="222.222.222.209"
   
3. hostname="www.kkkk.net"
   
4. ifconfig_fxp0="inet 222.222.222.219  netmask 255.255.255.240"
   
5. ifconfig_fxp0_alias0="inet 222.222.222.220 netmask 255.255.255.240"
   
6. ifconfig_fxp1="inet 10.1.1.20 netmask 255.255.255.224"
   
7. ifconfig_fxp2="inet 192.168.0.1 netmask 255.255.255.0"
   
8. linux_enable="YES"
   
9. sshd_enable="YES"
   
10. inetd_enable="YES"
    
11. gateway_enable="YES"
    
12. pf_enable="YES"
    
13. pf_rules="/etc/pf.conf"
    
14. pflog_enable="YES"
    
15. syslogd_flags="-ss"
    
16. sendmail_enable="NO"
    
17. sendmail_submit_enable="NO"
    
18. sendmail_outbound_enable="NO"
    
19. sendmail_msp_queue_enable="NO"
    

复制代码

pf.conf

1. 
   
2. ext_if="fxp0"
   
3. int_if="fxp2"
   
4. dmz_if="fxp1"
   
5. serv_intip="10.1.1.10"
   
6. serv_extip="222.222.222.220"
   
7. 
   
8. priv_net="{127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"
   
9. icmp_types="echoreq"
   
10. drop_tcpports="{135,139,445,9996,593,6667,15436,137}"
    
11. drop_udpports="{135,139,445,5554,9996,593,137}"
    
12. 
    
13. set limit { states 100000, frags 50000 }
    
14. set loginterface fxp0
    
15. set optimization aggressive
    
16. set block-policy drop
    
17. 
    
18. scrub on $ext_if all reassemble tcp
    
19. 
    
20. #NAT规则
    
21. nat on $ext_if from $int_if:network to any ->; $ext_if:0
    
22. binat on $ext_if from $serv_intip to any ->; $serv_extip
    
23. rdr on {$int_if,$dmz_if} proto tcp from any to any port 21 ->; 127.0.0.1 port 8021
    
24. rdr on $int_if proto tcp from $int_if:network to $serv_extip port 80 ->; 127.0.0.1 port 9000
    
25. 
    
26. #过滤规则
    
27. block all
    
28. pass quick on lo0 all
    
29. block in quick on $ext_if from $priv_net to any
    
30. block out quick on $ext_if from any to $priv_net
    
31. 
    
32. 
    
33. block quick on {$ext_if,$int_if,$dmz_if} proto tcp from any to any port $drop_tcpports
    
34. block quick on {$ext_if,$int_if,$dmz_if} proto udp from any to any port $drop_udpports
    
35. 
    
36. pass in quick on $int_if proto {tcp,udp,icmp} from $int_if:network to any modulate state
    
37. 
    
38. pass out quick on $ext_if proto {tcp,udp,icmp} from $ext_if:network to any modulate state
    
39. pass in quick on $ext_if inet proto icmp from any to any icmp-type $icmp_types keep state
    
40. pass in quick on $ext_if proto tcp from any to $ext_if:0 port 22 flags S/SA synproxy state
    
41. pass in quick on $ext_if proto tcp from any to any port 80 flags S/SA synproxy state
    
42.      
    
43. pass out quick on $dmz_if proto tcp from any to $serv_intip port 80 synproxy state
    
44. pass in quick on $dmz_if proto {tcp,udp,icmp} from $dmz_if:network to any modulate state
    
45. pass out quick on $dmz_if inet proto icmp from any to $dmz_if:network icmp-type $icmp_types keep state
    

复制代码

zayi

自己顶，用PF的朋友帮帮忙呀

congli

感觉访问DMZ路径是:内网->;外网->;DMZ.所以内网能Ping,不能直接访问Web

building

内网到DMZ是要路由的

zayi

内网到dmz能ping通，还需要路由吗？

congli

Ping:内网->;外网->;DMZ

zayi

我在内网用tracert 10.1.1.10 可以看到路由是从内网—网关—DMZ

zayi

我的理解是这样的

要让外网能够访问dmz服务器80端口，首先必须要有一个外网地址与其映射

1. binat on $ext_if from $serv_intip to any ->; $serv_extip

复制代码

然后在外网接口上要允许目标地址为DMZ外网IP PORT 80的数据包进入防火墙（这里是any to any 应该限制到目标地址）

1. pass in quick on $ext_if proto tcp from any to any port 80 flags S/SA synproxy state

复制代码

数据包进入防火墙后，通过rdr，找到与之对应的是DMZ下私有地址10.1.1.10，最后允许数据包从DMZ接口出去到达dmz服务器 10.1.1.10

1. pass out quick on $dmz_if proto tcp from any to $serv_intip port 80 synproxy state  

复制代码

内网用户访问DMZ服务器内部IP时，首先在内网接口上允许内网对目标为any的{tcp,udp,icmp}访问进入防火墙

1. pass in quick on $int_if proto {tcp,udp,icmp} from int_if:network to any modulate state

复制代码

然后允许数据包从DMZ接口出去到达dmz服务器 10.1.1.10

1. pass out quick on $dmz_if proto tcp from any to $serv_intip port 80 synproxy state  

复制代码

硬-盘

#firewall by tds 20050601

#macros
wanif="fxp0"
lanif="fxp1"
dmzif="fxp2"
tcpsrv="{22,113}"
lan0="{192.168.0.0/27}"
lan1="{192.168.1.0/24}"
lan2="{192.168.2.0/24}"
lan3="{192.168.3.0/24}"
wwwsrv="192.168.10.254"
ftpsrv="192.168.0.8"
bt1="192.168.0.25"
bt2="192.168.0.26"
bt3="192.168.0.27"
noroute="{127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"

#options
set block-policy return
set loginterface $wanif
set optimization aggressive

#scrub
scrub in all

#nat and rdr
nat on $wanif from $lan0 to any ->; $wanif
#nat on $wanif from $lan3 to any ->; $wanif
#nat on $wanif from $lan1 to any ->; $wanif
#nat on $wanif from $lan2 to any ->; $wanif

rdr on $wanif proto tcp from any to any port 80 ->; $wwwsrv
rdr on $wanif proto tcp from any to any port 554 ->; $wwwsrv
rdr on $wanif proto tcp from any to any port 5500 ->; $wwwsrv
rdr on $wanif proto tcp from any to any port 21 ->; $ftpsrv
rdr on $wanif proto tcp from any to any port 1433 ->; $ftpsrv
rdr on $wanif proto tcp from any to any port 19999 ->; $bt1
rdr on $wanif proto tcp from any to any port 18888 ->; $bt2
rdr on $wanif proto tcp from any to any port 20000 ->; $bt3
rdr on $wanif proto tcp from any to any port 4662 ->; $bt2
rdr on $wanif proto tcp from any to any port 4663 ->; $bt3
rdr on $wanif proto tcp from any to any port 3389 ->; $bt2

#filter rules
block all
block drop in quick on $wanif from $noroute
block drop out quick on $wanif from any to $noroute
block drop out quick on $wanif from any to 202.103.67.53
pass quick on lo0 all
pass in quick on $lanif from $lanif:network to any keep state
pass out quick on $lanif from any to $lanif:network keep state

pass out quick on $dmzif proto tcp from any to $wwwsrv port {80,554,5500} flags S/SA keep state
pass out quick on $dmzif proto tcp from $bt2 to $wwwsrv port {20,21,3389} flags S/SA keep state
pass in quick on $dmzif from $dmzif:network to any keep state

pass in quick on $wanif proto tcp from any to $wanif port $tcpsrv flags S/SA keep state
pass in quick on $wanif proto tcp from any to $wwwsrv port 80 flags S/SA synproxy state
pass in quick on $wanif proto tcp from any to $wwwsrv port {554,5500} flags S/SA keep state
pass in quick on $wanif proto tcp from any to $ftpsrv port 21 flags S/SA keep state
pass in quick on $wanif proto tcp from any to $bt1 port 19999 flags S/SA keep state
pass in quick on $wanif proto tcp from any to $bt2 port {20,4662,3389,18888} flags S/SA keep state
pass in quick on $wanif proto tcp from any to $bt3 port {4663,20000} flags S/SA keep state
pass in quick on $wanif proto tcp from any to $ftpsrv port 1433 flags S/SA keep state
pass out on $wanif proto tcp all flags S/SA keep state
pass out on $wanif proto {udp,icmp} all keep state