- 论坛徽章:
- 0
|
1) "gateway_enable="YES" # 启动网关" is not necessary unless your system is multi-homed.
2) "firewall_enable="YES" # 激活firewall防火墙; firewall_script="/etc/rc.firewall" # firewall防火墙的默认; firewall_type="/etc/ipfw.conf" # firewall自定义脚本; firewall_quiet="YES" ; firewall_logging_enable="YES" # 启用firewall的log记录" are not needed if you compile the firewall into kernel (16楼 are for kernel only). you obviously used both kernel version of ipfw and module version of ipfw simultaneously. in fact, kernel version ipfw will be preferred over module version of ipfw. those in rc.conf will have no effect.
3) with "options IPFIREWALL_DEFAULT_TO_ACCEPT" in your customized kernel, 65535 automatically defined as "open for all". by default, 65535 should be "deny for all".
my suggestion:
1) recompiled that kernel with no 16楼 statements.
2) keep everything in the rc.conf file
3) if you only need port 22 and 80. here is something will work for sure:
ipfw -q add 1000 check-state
ipfw -q add 1100 allow log tcp from any to {interface} 22 setup keep-state
ipfw -q add 1200 allow log tcp from any to {interface} 80 setup keep-state
ipfw -q add 1300 allow all from me to any
the statement of 65535 will always be there with default of "deny for all"
good luck! |
|
免费注册
楼主: zjblove
发表于 2006-09-03 20:34
