这是烤来的 第 0.1 版 /etc/ipf.rules , 纯 ipfilter rules - 还没有 AltQ 或其他高手级功能. 能不能请帮我看一眼, 可行不可行, 有没有该加该减该改的 ... 谢谢 :) ### /etc/ipf.rules for ipfilter #### myip="192.168.0.100" ks="keep state" fks="flags S keep state" # 疑问: 是 "flags S keep state" 就好呢? # 因还有看到有人写 "flags S keep state keep frags" /sbin/ipf -Fa -f - << EOF #----- # ftp pass out quick on rl0 proto tcp from any to any port = 20 $fks pass out quick on rl0 proto tcp from any to any port = 21 $fks # ssh pass out quick on rl0 proto tcp from any to any port = 22 $fks # smtp pass out quick on rl0 proto tcp from any to any port = 25 $fks # DNS pass out quick on rl0 proto tcp from any to any port = 53 $fks # httpd pass out quick on rl0 proto tcp from any to any port = 80 $fks # pop3 pass out quick on rl0 proto tcp from any to any port = 110 $fks # IMAP pass out quick on rl0 proto tcp from any to any port = 143 $fks # smux pass out quick on rl0 proto tcp from any to any port = 199 $fks # https pass out quick on rl0 proto tcp from any to any port = 443 $fks # smtps pass out quick on rl0 proto tcp from any to any port = 465 $fks # submission pass out quick on rl0 proto tcp from any to any port = 587 $fks # hp-alarm-mgr pass out quick on rl0 proto tcp from any to any port = 787 $fks # rndc # 疑问: rndc 须要 pass in/out 吗? 或是只要 保留给 127.0.0.1 自用? pass out quick on rl0 proto tcp from any to any port = 953 $fks # imaps pass out quick on rl0 proto tcp from any to any port = 993 $fks # pop3s pass out quick on rl0 proto tcp from any to any port = 995 $fks # webmin pass out quick on rl0 proto tcp from any to any port = 10000 $fks pass out quick on rl0 proto icmp from any to any $ks block out quick on rl0 all #----- pass in quick on rl0 proto udp from 192.168.0.1 to any port = 68 keep state #----- # ftp pass in quick on rl0 proto tcp from any to any port = 20 $fks pass in quick on rl0 proto tcp from any to any port = 21 $fks # ssh pass in quick on rl0 proto tcp from any to any port = 22 $fks # smtp pass in quick on rl0 proto tcp from any to any port = 25 $fks # DNS pass in quick on rl0 proto tcp from any to any port = 53 $fks # httpd pass in quick on rl0 proto tcp from any to any port = 80 $fks # pop3 pass in quick on rl0 proto tcp from any to any port = 110 $fks # IMAP pass in quick on rl0 proto tcp from any to any port = 143 $fks # smux pass in quick on rl0 proto tcp from any to any port = 199 $fks # https pass in quick on rl0 proto tcp from any to any port = 443 $fks # smtps pass in quick on rl0 proto tcp from any to any port = 465 $fks # submission pass in quick on rl0 proto tcp from any to any port = 587 $fks # hp-alarm-mgr pass in quick on rl0 proto tcp from any to any port = 787 $fks # rndc pass in quick on rl0 proto tcp from any to any port = 953 $fks # imaps pass in quick on rl0 proto tcp from any to any port = 993 $fks # pop3s pass in quick on rl0 proto tcp from any to any port = 995 $fks # webmin pass in quick on rl0 proto tcp from any to any port = 10000 $fks #----- block return-rst in log quick on rl0 proto tcp from any to any block return-icmp-as-dest(port-unr) in log quick on rl0 proto udp from any to any block in log quick on rl0 all #----- pass in quick on lo0 all pass out quick on lo0 all EOF ### end of /etc/ipf.rules #### <: 老音学生 :> === "老音学生 Old Student" <[email protected]> 撰写於邮件新闻:L5RSe.85079$Hk.11007@pd7tw1no... > 请教, > 我的 server (freeBSD) 本在 router (的 firewall) 後面, 只有一张网卡 (ip 譬如:192.168.1.2) 接 router (ip 譬如 192.168.1.1) 有 NAT 至此 freeBSD server. > 我想在 fBSD 上开始用 firewall - > 以便 限制 webserver 的频宽 尤其好多 spider 一天来数次 - 不然每到时 ISP 每个月又要哇哇叫. > 及 挡掉一下 没事跑来乱试 id/password 的坏 ip > 或甚据说有些其他防护. > > 看了 freeBSD 的 firewalls > http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls.html > 想说, 是否用 ipfilter ( 或 并 ipfirewall - 听说两个不冲突可一起用) 再加 > AltQ > 据说对新手, 他们的 rule 较易上手 ? > > 请问: > 1. > 这样是否有当? > 2. > 哪边有 类似的 rule 可以抄的? > 就是说: 只有一张卡的 intranet ip (192.168.x.x) 的 server 适用的 IPF (及 > IPFW 或及 AltQ ) 的 rule > > > 新手上路 > 请 不吝多指教 > 谢谢 > > <: 老音学生 :>