- 论坛徽章:
- 0
|
本人用的是BSD5.4系统,我看了剑心通明兄弟的FreeBSD＋IPFILTER实现整网
的文章,首先我编译内核.改动如下:
options IPFILTER
options IPFILTER_LOG
options IPFILTER_DEFAULT_BLOCK
options IPFIREWALL
options IPFIREWALL_DEFAULT_TO_ACCEPT
options DUMMYNET
编译核心后成功从新启动,由于"options IPFILTER_DEFAULT_BLOCK"默认拒绝了所有的收发包,我现在要允许我的内部可以SSH,而且允许这个BSD可以上网络.
/etc/rc.conf里面的设置:
ipfilter_enable="YES"
ipfilter_program="/sbin/ipf"
ipfilter_rules="/etc/ipf.conf"
ipfilter_flags=""
ipnat_enable="YES"
ipnat_program="/sbin/ipnat -CF -f"
ipnat_rules="/etc/ipnat.conf"
ipmon_enable="YES"
ipmon_flags="-D /var/log/ipf.log"
/etc/ipf.conf内容:
block in quick all with ipopts
block in quick all with frag
block in quick all with short
pass in quick on lo0 all
pass out quick on lo0 all
# Inside Interface
pass out quick on rl0 all head 1
pass out quick on rl0 proto tcp from any to any keep state group 1
pass out quick on rl0 proto udp from any to any keep state group 1
pass out quick on rl0 proto icmp from any to any keep state group 1
block out quick on rl0 all group 1
# Allow in all TCP, UDP, and ICMP traffic & keep state
pass in quick on em1 all head 2
pass in quick on em1 proto tcp from 192.168.201.0/24 to any port = 22 flags S keep state group 2
block in quick on em1 proto tcp from any to any port = 22 flags S keep state group 2
pass in quick on rl0 proto tcp from any to any keep state group 2
pass in quick on rl0 proto udp from any to any keep state group 2
pass in quick on rl0 proto icmp from any to any keep state group 2
block in quick on rl0 all group 2
从新启动!
我的BSD还是上不了INTERNET呀,而且内部网络PING不通BSD机器,在BSD机器PING内部机器也不通讯
ping www.163.com 或者ping 192.168.201.1
提示:
ping : sendto: No route to host |
|
免费注册
发表于 2005-11-07 10:39
发表于 2005-11-07 10:43
ptions IPFIREWALL
