openBSD4.8 Linux系统做路由及防火墙.doc

openBSD4.8 Linux操作系统做网关服务及配置防火墙一、 openBSD4.8做路由及防火墙1、 openBSD4.8系统的安装2、 硬件要求：旧电脑一台、网卡两张、MODEL一台3、 安装openBSD4.8系统成功后，进入/etc目录下，配置以下文件4、 #vi /etc/hostname.rl0(连接内网的网卡，也称为网关)inet NONE:wq#注意，此网卡本身为网关地址，因此不需要配置网关地址。将系统默认的网关地址删除 #rm /etc/mygate5、#vi /etc/hostname.rl1(连接外网的网卡)updescription “ADSL Port”:wq#此网卡设置为拨号网卡6、#vi /etc/hostname.pppoe0inet 55 NONE pppoedev rl1 authproto pap authname 拨号用户名 authkey 拨号密码 up!/sbin/route add default ifp pppoe0 :wq#新建拨号文件，并设置拨号信息7、#vi /etc/sysctl.confnet.inet.ip.forwarding=1 #1=Permit forwarding (routing) of IPv4 packetsnet.inet.ip.mforwarding=1 #1=Permit forwarding (routing) of IPv4 multicast packetsnet.inet.gre.allow=1net.inet.gre.wccp=1:wq#去掉前面的“#”，开启路由转发功能（NAT）8、#vi /etc/resolv.confLookup file bindnameserver 33nameserver 6:wq#配置DNS服务器9、#vi /etc/dhcpd.conf此文件为配置DHCP服务器文件，将此文件里面的IP改为内网IP段 /2410、#vi /etc/rc.confpf=YESpf_rules=/etc/pf.conf#加载系统开机运行文件，开启防火墙11、防火墙的配置（pf.conf文件）#vi /etc/pf.conf#marcos:STARTWAN=”pppoe0”LAN=”rl0”#marcos:END#Options: tune the behavior of pf, default values are given.set limit states 100000, frags 50000set skip on lo0set skip on gre0#Tables:STARTtable persist file “/etc/pf/ALLOW_REMOTE_DOMAIN”table persist file “/etc/pf/ALLOW_REMOTE_HOST”table persist file “/etc/pf/BADLIST_HOST”table persist file “/etc/pf/BADLIST_USER”table persist file “/etc/pf/BADLIST_DOMAIN”table persist file “/etc/pf/PROXY_USER”table persist file “/etc/pf/HK_USER”table persist file “/etc/pf/ERP_USER”table persist file “/etc/pf/MSN_USER”table persist file “/etc/pf/QQ_USER”table persist file “/etc/pf/TCP_USER”table persist file “/etc/pf/UDP_USER”table persist file “/etc/pf/MSN_SRV”table persist file “/etc/pf/tax_websiste”table persist file “/etc/pf/direct_website”#Tables:END#NAT:STARTmatch out on $WAN inet from /24 to any nat-to ($WAN)#NAT:END#RULES:START# start system default rulesblock in allpass quick on gif0,gif1,tun0 inet allpass out quick inet keep state#WAN interfacepass in quick on $WANinet proto ipencap from any to ($WAN) keep statepass in quick on $WAN inet proto esp from any to ($WAN) keep statepass in quick on $WAN inet proto tcp from any to ($WAN) port 80,822,443 flags S/SA keep statepass in quick on $WAN inet proto icmp from any to ($WAN) keep statepass in quick on $WAN inet proto udp from any to ($WAN) port 1194 keep state#LANpass in quick on $LAN inet proto tcp from any to pass in quick on $LAN inet proto tcp from any to pass in quick on $LAN inet proto tcp from any to 36# for Accountingpass in quick on $LAN inet proto tcp from 65 to keep statepass in quick on $LAN inet proto tcp from to keep statepass in quick on $LAN inet proto tcp from to any port 80 keep statepass in quick on $LAN inet from to any keep statepass in quick on $LAN inet proto tcp from to any port 82,7001,7002,5678,8001 keep state#MSNpass in quick on $LAN inet proto tcp from /24 to keep statepass in quick on $LAN inet proto tcp from /24 to any port https keep statepass in quick on $LAN inet proto tcp from /24 to any port 1863 keep state#Secure WEB-stiepass in quick on $LAN inet proto tcp from to any keep statepass in quick on $LAN inet proto udp from to any port 8000,8001 keep statepass in quick on $LAN inet proto udp from to any port 8000,8001 keep state#TO HK Print SERVERpass in quick on $LAN inet from /24 to 23 keep statepass in quick on $LAN inet proto tcp from 47 to any port 7001,5678 keep state#for accountingpass in quick on $LAN inet from 65 to any keep state#TO mail.saihe.cmpass in quick on $LAN inet proto tcp from /24 to 7 port 25,110,443,465,995 keep state#RULES:END#sh /etc/netstart #启动网络接口#ifconfig rl0 up #打开rl0网卡#pfctl f /etc/pf.conf #重新加载防火墙配置#pfctl e#开启防火墙#pfctl d #关闭防火墙安装及配置防火墙一、操作系统：openBSD4.8二、硬件要求：DELL电脑一台、网卡两张三、安装系统及配置防火墙1、OpenBSD4.8操作系统的安装（此省略）；2、配置第一张网卡（hostname.rl0）此网卡做内网网关。 #cd /etc/ #vi hostname.rl0 inet NONE :wq3、配置第二张网卡（hostname.rl1）此网卡用于拨号。 #cd /etc #vi hostname.rl1 up description “ADSL Port” :wq4、配置拨号文件（hostname.pppoe0）。 #cd /etc #vi hostname.pppoe0 inet 55 NONE pppoedev rl1 authproto pap authname 宽带帐号 authkey 密码 up dest !/sbin/route add default ifp pppoe0 :wq5、配置DNS服务器 #cd /etc #vi resolv.conf nameserver 6 nameserver 33 :wq6、开启路由转发功能。 #cd /etc #vi sysctl.conf net.inet.ip.forwarding=1 /去掉前面的#号7、开启防火墙功能。 #cd /etc #vi rc.conf pf=YES pf_rules=/etc/pf.conf8、配置防火墙PF #cd /etc #vi pf.conf #marcos:START WAN=”pppoe0” LAN=”rl0” #marcos:END /定义宏 #option:START set limit states 100000, frags 50000 set skip lo0 set skip gre0 #option:END /选项定义 #table:START table persist file “表格路径” #table:END /配置表格 #queue:START #QUEUE:END /优先级处理、带宽设置. #NAT:START match out on $WAN inet from /24 to any nat-to ($WAN) #NAT:END /转发内网IP地址访问互联网 #RULES:START /定义转发规则 block in all pass quick on gif0,gif1,tun0 inet all pass out quick inet keep state #WAN interfaces pass in quick on $WAN inet proto ipencap from any to ($WAN) keep state pass in quick on $WAN inet proto esp from any to ($WAN) keep state pass in quick on $WAN inet proto tcp from any to ($WAN) port 80,822,443 flags S/SA keep state pass in quick on $WAN inet proto icmp from any to ($WAN) keep state pass in quick o