openBSD4.8 Linux系統(tǒng)做路由及防火墻.doc

openBSD4.8 Linux操作系統(tǒng)做網(wǎng)關(guān)服務(wù)及配置防火墻一、 openBSD4.8做路由及防火墻1、 openBSD4.8系統(tǒng)的安裝2、 硬件要求：舊電腦一臺、網(wǎng)卡兩張、MODEL一臺3、 安裝openBSD4.8系統(tǒng)成功后，進入/etc目錄下，配置以下文件4、 #vi /etc/hostname.rl0(連接內(nèi)網(wǎng)的網(wǎng)卡，也稱為網(wǎng)關(guān))inet NONE:wq#注意，此網(wǎng)卡本身為網(wǎng)關(guān)地址，因此不需要配置網(wǎng)關(guān)地址。將系統(tǒng)默認(rèn)的網(wǎng)關(guān)地址刪除 #rm /etc/mygate5、#vi /etc/hostname.rl1(連接外網(wǎng)的網(wǎng)卡)updescription “ADSL Port”:wq#此網(wǎng)卡設(shè)置為撥號網(wǎng)卡6、#vi /etc/hostname.pppoe0inet 55 NONE pppoedev rl1 authproto pap authname 撥號用戶名 authkey 撥號密碼 up!/sbin/route add default ifp pppoe0 :wq#新建撥號文件，并設(shè)置撥號信息7、#vi /etc/sysctl.confnet.inet.ip.forwarding=1 #1=Permit forwarding (routing) of IPv4 packetsnet.inet.ip.mforwarding=1 #1=Permit forwarding (routing) of IPv4 multicast packetsnet.inet.gre.allow=1net.inet.gre.wccp=1:wq#去掉前面的“#”，開啟路由轉(zhuǎn)發(fā)功能（NAT）8、#vi /etc/resolv.confLookup file bindnameserver 33nameserver 6:wq#配置DNS服務(wù)器9、#vi /etc/dhcpd.conf此文件為配置DHCP服務(wù)器文件，將此文件里面的IP改為內(nèi)網(wǎng)IP段 /2410、#vi /etc/rc.confpf=YESpf_rules=/etc/pf.conf#加載系統(tǒng)開機運行文件，開啟防火墻11、防火墻的配置（pf.conf文件）#vi /etc/pf.conf#marcos:STARTWAN=”pppoe0”LAN=”rl0”#marcos:END#Options: tune the behavior of pf, default values are given.set limit states 100000, frags 50000set skip on lo0set skip on gre0#Tables:STARTtable persist file “/etc/pf/ALLOW_REMOTE_DOMAIN”table persist file “/etc/pf/ALLOW_REMOTE_HOST”table persist file “/etc/pf/BADLIST_HOST”table persist file “/etc/pf/BADLIST_USER”table persist file “/etc/pf/BADLIST_DOMAIN”table persist file “/etc/pf/PROXY_USER”table persist file “/etc/pf/HK_USER”table persist file “/etc/pf/ERP_USER”table persist file “/etc/pf/MSN_USER”table persist file “/etc/pf/QQ_USER”table persist file “/etc/pf/TCP_USER”table persist file “/etc/pf/UDP_USER”table persist file “/etc/pf/MSN_SRV”table persist file “/etc/pf/tax_websiste”table persist file “/etc/pf/direct_website”#Tables:END#NAT:STARTmatch out on $WAN inet from /24 to any nat-to ($WAN)#NAT:END#RULES:START# start system default rulesblock in allpass quick on gif0,gif1,tun0 inet allpass out quick inet keep state#WAN interfacepass in quick on $WANinet proto ipencap from any to ($WAN) keep statepass in quick on $WAN inet proto esp from any to ($WAN) keep statepass in quick on $WAN inet proto tcp from any to ($WAN) port 80,822,443 flags S/SA keep statepass in quick on $WAN inet proto icmp from any to ($WAN) keep statepass in quick on $WAN inet proto udp from any to ($WAN) port 1194 keep state#LANpass in quick on $LAN inet proto tcp from any to pass in quick on $LAN inet proto tcp from any to pass in quick on $LAN inet proto tcp from any to 36# for Accountingpass in quick on $LAN inet proto tcp from 65 to keep statepass in quick on $LAN inet proto tcp from to keep statepass in quick on $LAN inet proto tcp from to any port 80 keep statepass in quick on $LAN inet from to any keep statepass in quick on $LAN inet proto tcp from to any port 82,7001,7002,5678,8001 keep state#MSNpass in quick on $LAN inet proto tcp from /24 to keep statepass in quick on $LAN inet proto tcp from /24 to any port https keep statepass in quick on $LAN inet proto tcp from /24 to any port 1863 keep state#Secure WEB-stiepass in quick on $LAN inet proto tcp from to any keep statepass in quick on $LAN inet proto udp from to any port 8000,8001 keep statepass in quick on $LAN inet proto udp from to any port 8000,8001 keep state#TO HK Print SERVERpass in quick on $LAN inet from /24 to 23 keep statepass in quick on $LAN inet proto tcp from 47 to any port 7001,5678 keep state#for accountingpass in quick on $LAN inet from 65 to any keep state#TO mail.saihe.cmpass in quick on $LAN inet proto tcp from /24 to 7 port 25,110,443,465,995 keep state#RULES:END#sh /etc/netstart #啟動網(wǎng)絡(luò)接口#ifconfig rl0 up #打開rl0網(wǎng)卡#pfctl f /etc/pf.conf #重新加載防火墻配置#pfctl e#開啟防火墻#pfctl d #關(guān)閉防火墻安裝及配置防火墻一、操作系統(tǒng)：openBSD4.8二、硬件要求：DELL電腦一臺、網(wǎng)卡兩張三、安裝系統(tǒng)及配置防火墻1、OpenBSD4.8操作系統(tǒng)的安裝（此省略）；2、配置第一張網(wǎng)卡（hostname.rl0）此網(wǎng)卡做內(nèi)網(wǎng)網(wǎng)關(guān)。 #cd /etc/ #vi hostname.rl0 inet NONE :wq3、配置第二張網(wǎng)卡（hostname.rl1）此網(wǎng)卡用于撥號。 #cd /etc #vi hostname.rl1 up description “ADSL Port” :wq4、配置撥號文件（hostname.pppoe0）。 #cd /etc #vi hostname.pppoe0 inet 55 NONE pppoedev rl1 authproto pap authname 寬帶帳號 authkey 密碼 up dest !/sbin/route add default ifp pppoe0 :wq5、配置DNS服務(wù)器 #cd /etc #vi resolv.conf nameserver 6 nameserver 33 :wq6、開啟路由轉(zhuǎn)發(fā)功能。 #cd /etc #vi sysctl.conf net.inet.ip.forwarding=1 /去掉前面的#號7、開啟防火墻功能。 #cd /etc #vi rc.conf pf=YES pf_rules=/etc/pf.conf8、配置防火墻PF #cd /etc #vi pf.conf #marcos:START WAN=”pppoe0” LAN=”rl0” #marcos:END /定義宏 #option:START set limit states 100000, frags 50000 set skip lo0 set skip gre0 #option:END /選項定義 #table:START table persist file “表格路徑” #table:END /配置表格 #queue:START #QUEUE:END /優(yōu)先級處理、帶寬設(shè)置. #NAT:START match out on $WAN inet from /24 to any nat-to ($WAN) #NAT:END /轉(zhuǎn)發(fā)內(nèi)網(wǎng)IP地址訪問互聯(lián)網(wǎng) #RULES:START /定義轉(zhuǎn)發(fā)規(guī)則 block in all pass quick on gif0,gif1,tun0 inet all pass out quick inet keep state #WAN interfaces pass in quick on $WAN inet proto ipencap from any to ($WAN) keep state pass in quick on $WAN inet proto esp from any to ($WAN) keep state pass in quick on $WAN inet proto tcp from any to ($WAN) port 80,822,443 flags S/SA keep state pass in quick on $WAN inet proto icmp from any to ($WAN) keep state pass in quick o