请问:FreeBSD6.1+pf如何拒绝某IP的访问？

512song

现在用的是：
ext_if="fxp0"  # replace with actual external interface name i.e., dc0
int_if="nve0"  # replace with actual internal interface name i.e., dc1
loop = "lo0"
noroute = "{ 192.168.0.0/16 }"
ports = "{ 20, 21, 22, 25,53,80, 110,143 }"
private_nets = "{  192.168.0.0/24 }"
table <block_domains> file "/etc/block_domains"
icmp_type = "echoreq"
set block-policy drop
set loginterface $ext_if
set timeout src.track 60
scrub in all
nat on $ext_if from $int_if:network to any -> $ext_if
block in quick proto tcp all flags SF/SFRA
block in quick proto tcp all flags SFUP/SFRAU
block in quick proto tcp all flags FPU/SFRAUP
block in quick proto tcp all flags /SFRA
block in quick proto tcp all flags F/SFRA
block in quick proto tcp all flags U/SFRAU
antispoof quick for $ext_if inet
block all
pass quick on lo0 all
block out on $ext_if from any to <block_domains>
block drop in quick on $ext_if from $private_nets to any
block drop out quick on $ext_if from any to $private_nets
pass in on $ext_if inet proto tcp from any to $ext_if port $ports flags S/SA keep state
pass in inet proto icmp icmp-type $icmp_type keep state
pass in on $int_if from $int_if:network to any keep state
pass out on $int_if from any to $int_if:network keep state
pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto {udp, icmp} all keep state

在<block_domains>添加了要屏蔽的IP但是不起作用，总有一些IP在扫我web服务器的一些文件。

mkdir

在bsd下如果设置对同一IP地址一定时间连接频率限制？ http://bbs.chinaunix.net/viewthread.php?tid=359124

congli

block in quick on $ext_if from <block_domains> to any
block out quick on $ext_if from any to <block_domains>

gvim

原帖由 congli 于 2007-1-21 22:46 发表
block in quick on $ext_if from <block_domains> to any
block out quick on $ext_if from any to <block_domains>

这样的写法可以进一步简化吗？
我看pf的一个教程上将

pass in on xl1 from xl1:network to xl0:network port $ports keep state

pass out on xl0 from xl1:network to xl0:network port $ports keep state

简化为

pass from xl1:network to any port $ports keep state
      #作者的例子是个网关，里只有xl1和xl0两个端口，xl1对外，xl0对内

所以我猜想你这两句简写成 block quick from <block_domains> to any  可以吗？？ 哈哈，刚学不久，语法还很生疏，多多指教。

[ 本帖最后由 gvim 于 2007-1-22 02:57 编辑 ]

congli

原帖由 gvim 于 2007-1-22 02:50 发表


这样的写法可以进一步简化吗？
我看pf的一个教程上将

简化为


所以我猜想你这两句简写成 block quick from <block_domains> to any  可以吗？？ 哈哈，刚学不久，语法还很生疏，多多指教。

那就指教一下咯

如果是from any to any的话倒是可以简化一下,不过lz是的拒绝某IP,所以in/out是有方向的拒绝,而且在内网卡上应用此规则是没意义的.

估计兄弟没看清楚

pass in on xl1 from xl1:network to xl0:network port $ports keep state
pass out on xl0 from xl1:network to xl0:network port $ports keep state

[ 本帖最后由 congli 于 2007-1-22 08:18 编辑 ]

congli

兄弟有时间看看这图吧^_^

作者:quension

512song

多谢congli。经过一天试验，问题已经解决。非常感谢，要学习的真是很多。

菲平

咋整的?教教欧们?