关于IPFW明示允许规则集的一些疑问
本帖最后由 migoumigou 于 2011-04-22 17:22 编辑
初学ipfw,是小菜,所以有些疑问请教
内核编译的时候,已经放入了options IPFIREWALL_DEFAULT_TO_ACCEPT
现在想要做一个明示允许的规则集,除了规则集中列出的MAC列表allow,其他都deny,这样写的:
ipfw -q -f flush
ipfw -q add 00050 divert 8668 ip4 from any to any via bge0
ipfw -q add 00100 allow ip from any to any via lo0
ipfw -q add 00200 deny ip from any to 127.0.0.0/8
ipfw -q add 00300 deny ip from 127.0.0.0/8 to any
ipfw -q add 00400 allow ip from any to any MAC x0:0x:0x:0x:0x:0x any
ipfw -q add 00500 allow ip from any to any MAC x0:0x:0x:0x:0x:0x any
ipfw -q add 00600 allow ip from any to any MAC x0:0x:0x:0x:0x:0x any
ipfw -q add 65535 deny ip from any to any
重启加载规则后ipfw list,前面的几项规则都显示正常,唯独65535还是
65535 allow ip from any to any
然后规则中MAC列表以外的机器仍可以正常通过防火墙连接外网
请问是规则集写的有问题吗?烦请指出哪里有问题?
如果规则集没有问题,那是不是明示允许的规则,前提是必须把内核中的options IPFIREWALL_DEFAULT_TO_ACCEPT拿掉,重新编译内核,才能让上面的规则集正常运作?
初学ipfw,是小菜,所以有些疑问请教
内核编译的时候,已经放入了options IPFIREWALL_DEFAULT_TO_ACCEPT
现在想要做一个明示允许的规则集,除了规则集中列出的MAC列表allow,其他都deny,这样写的:
ipfw -q -f flush
ipfw -q add 00050 divert 8668 ip4 from any to any via bge0
ipfw -q add 00100 allow ip from any to any via lo0
ipfw -q add 00200 deny ip from any to 127.0.0.0/8
ipfw -q add 00300 deny ip from 127.0.0.0/8 to any
ipfw -q add 00400 allow ip from any to any MAC x0:0x:0x:0x:0x:0x any
ipfw -q add 00500 allow ip from any to any MAC x0:0x:0x:0x:0x:0x any
ipfw -q add 00600 allow ip from any to any MAC x0:0x:0x:0x:0x:0x any
ipfw -q add 65535 deny ip from any to any
重启加载规则后ipfw list,前面的几项规则都显示正常,唯独65535还是
65535 allow ip from any to any
然后规则中MAC列表以外的机器仍可以正常通过防火墙连接外网
请问是规则集写的有问题吗?烦请指出哪里有问题?
如果规则集没有问题,那是不是明示允许的规则,前提是必须把内核中的options IPFIREWALL_DEFAULT_TO_ACCEPT拿掉,重新编译内核,才能让上面的规则集正常运作?
作者: migoumigou 发布时间: 2011-04-22
kernel里面的那个是最后的默认设置吧。
作者: fender0107401 发布时间: 2011-04-22
那你就用下面一句,65535那句你不可能把它重新定义,而是会有两个65535,加上65534后,65535永远不起作用:
ipfw -q add 65534 deny ip from any to any
ipfw -q add 65534 deny ip from any to any
作者: lsstarboy 发布时间: 2011-04-22
Check this!
复制代码
- ################################################################################
-
- # delete all rules
-
- ipfw -q -f flush
-
- # variable declaration
-
- nic="re0"
-
- dns1="+++"
-
- dns2="+++"
-
- dhcp="192.168.1.1"
-
- cmd="ipfw -q add "
-
- ks="keep-state"
-
- ################################################################################
-
- # loopback
-
- $cmd 00100 allow all from any to any via lo0
-
- $cmd 00200 check-state
-
- ################################################################################
-
- # dns
-
- $cmd 00300 allow tcp from me to $dns1 53 out via $nic setup $ks
-
- $cmd 00400 allow udp from me to $dns2 53 out via $nic $ks
-
- $cmd 00500 allow tcp from me to $dns1 53 out via $nic setup $ks
-
- $cmd 00600 allow udp from me to $dns2 53 out via $nic $ks
-
- # dhcp
-
- $cmd 00700 allow udp from me to $dhcp 67 out via $nic $ks
-
- ################################################################################
-
- # www
-
- $cmd 00800 allow tcp from me to any 80 out via $nic setup $ks
-
- # secure www
-
- $cmd 00920 allow tcp from me to any 443 out via $nic setup $ks
-
- # email
-
- $cmd 01000 allow tcp from me to any 587 out via $nic setup $ks
-
- $cmd 01100 allow tcp from me to any 995 out via $nic setup $ks
-
- # irc
-
- $cmd 01200 allow tcp from me to any 7000 out via $nic setup $ks
-
- # ftp
-
- $cmd 01300 allow tcp from me to any 21 out via $nic setup $ks
-
- $cmd 01400 allow tcp from me to any 1024-65535 out via $nic setup $ks
-
- # ntp
-
- $cmd 01500 allow udp from me to any 123 out via $nic $ks
-
- # csup
-
- $cmd 01600 allow tcp from me to any out via $nic setup $ks uid root
-
- ################################################################################
作者: fender0107401 发布时间: 2011-04-22