openbsd+pf配置

block in quick on $192_if from 131.107.3.0/24 to any
block out quick on $192_if from any to 131.107.3.0/24
block in quick on $131_if from 192.168.1.0/24 to any
block out quick on $131_if from any to 192.168.1.0/24

pass in on $192_if from $192net to any keep state
pass out on $192_if from any to $192net keep state
pass in on $131_if from $131net to any keep state
pass out on $131_if from any to $131net keep state

pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto udp all keep state

/etc/pf/pf2.conf如下
ext_if="rl0" #接公网
192_if="rl1" #接内网段1
131_if="rl2" #接内网段2
192net="{
192.168.1.2/32,
192.168.1.8/32,
192.168.1.6/32,
192.168.1.45/32,
192.168.1.47/32,
192.168.1.16/32,
192.168.1.28/32,
192.168.1.249/32,
192.168.1.222/32
}"
131net="{
131.107.3.48/32,
131.107.3.47/32
}"
tcp_services="{22,113}"
icmp_types="echoreq"
priv_nets="{127.0.0.0/8,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8}"
set optimization aggressive
scrub in all
nat on rl0 from 192.168.1.0/24 to any -> 61.131.58.x/32
nat on rl0 from 131.107.3.0/24 to any -> 61.131.58.X/32

block all
pass quick on lo0 all
block drop in quick on $ext_if from $priv_nets to any
block drop out quick on $ext_if from any to $priv_nets
#pass in inet proto icmp all icmp-type $icmp_types keep states

block in quick on $192_if from 131.107.3.0/24 to any
block out quick on $192_if from any to 131.107.3.0/24
block in quick on $131_if from 192.168.1.0/24 to any
block out quick on $131_if from any to 192.168.1.0/24

pass in on $192_if from $192net to any keep state
pass out on $192_if from any to $192net keep state
pass in on $131_if from $131net to any keep state
pass out on $131_if from any to $131net keep state

pass out on $ext_if proto tcp all modulate state flags S/SA
pass out on $ext_if proto udp all keep state

/etc/pf/shellpf1如下
pfctl -d
pfctl -e
pfctl -f /etc/pf/pf1.conf

/etc/pf/shellpf2如下
pfctl -d
pfctl -e
pfctl -f /etc/pf/pf2.conf

crontab如下 /var/cron/tabs/root
# $OpenBSD: crontab,v 1.9 2001/09/11 19:03:55 millert Exp $
# $Id: crontab-nomail,v 1.1 2002/04/15 01:03:20 jmates Exp $
#
# JAM 2002-04-14 Disabled mailings from root.
#
# /var/cron/tabs/root - root's crontab
#
SHELL=/bin/sh
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/etc/pf
HOME=/var/log
#
#minute hour mday month wday command
#
*/10 18 * * * /etc/pf/shellpf2
*/50 7 * * * /etc/pf/shellpf1
#
# sendmail clientmqueue runner
#
# rotate log files every hour, if necessary
0 * * * * /usr/bin/newsyslog
# send log file notifications, if necessary
#1-59 * * * * /usr/bin/newsyslog -m
#
# do daily/weekly/monthly maintenance
30 1 * * * /bin/sh /etc/daily 1>/var/log/daily.out 2>&1
30 3 * * 6 /bin/sh /etc/weekly 1>/var/log/weekly.out 2>&1
30 5 1 * * /bin/sh /etc/monthly 1>/var/log/monthly.out 2>&1
每天7:50执行脚本shellpf1,18:10执行shellpf2

对于mac与ip绑定，可写一脚本，防止有人改ip上网(会改mac地址的除外)
arp -s 192.168.1.4 00:0c:76:84:52:f0 pub
arp -s 192.168.1.5 00:0c:76:2f:dd:2c pub

(http://www.fanqiang.com)

原文链接：http://openbsd.linuxsir.org/main/?q=node/23

上一个：IP欺骗
下一个：Linux下用gdb检测内核rootkit