分享
 
 
 

解析OPENBSD上的ADSL和防火墙设置

王朝other·作者佚名  2008-05-19
窄屏简体版  字體: |||超大  

偶在翻阅了大量网上文档后,实验整理了一下OPENBSD环境中ADSL、PF的配置过程。希望对OPENBSD的初学者有些帮助。下面我用的是OPENBSD 3.6

配置ADSL:

# vi /etc/ppp/ppp.conf

========================ppp.conf=======================

default:

set log Phase Chat IPCP CCP tun command

set redial 15 0

set reconnect 15 10000

pppoe:

set device "!/usr/sbin/pppoe -i rl1"

disable acfcomp protocomp

deny acfcomp

set mtu max 1492

set crtscts off

set speed sync

enable lqr

set lqrperiod 5

set cd 5

set dial

set login

set timeout 0

set authname "sjz681a0156@adsl2"

set authkey 123456

add! default HISADDR

enable mssfixup

========================ppp.conf=======================

建立防火墙代理配置:

# vi /etc/pf.conf

=========================pf.conf=======================

ext_if = "tun0"

int_if = "{ dc0, rl0 }"

int_net = "{ 192.168.0.0/24, 192.168.10.0/24 }"

loop = "lo0"

tcp_services = "{ www, ftp }"

boss_ip = "{ 192.168.10.10, 192.168.10.11, 192.168.10.12, 192.168.10.13, 192.168.10.14, 192.168.10.15 }"

noroute = "{ 127.0.0.1/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 255.255.255.255/32 }"

web_server = "{ 192.168.10.5, 192.168.100.16 }"

set block-policy return

set loginterface $ext_if

set optimization aggressive

scrub in all

altq on $int_if cbq bandwidth 1200Kb queue { dflt, boss }

queue dflt bandwidth 300Kb cbq(default)

queue boss bandwidth 900Kb cbq(borrow)

nat on $ext_if from $int_net to any - $ext_if

block all

block return

block in quick on $ext_if os NMAP

block in quick on $ext_if from $noroute to any

block out quick on $ext_if from any to $noroute

pass in quick on $ext_if inet proto tcp from any to any port 60000 keep state

#pass in quick on $ext_if inet proto icmp all icmp-type 8 code 0 keep state

pass in quick on $ext_if inet proto tcp from any to any port $tcp_services flags S/SAFR keep state

pass quick on $loop all

pass in

on $int_if from $int_net

pass out on $int_if from any to $int_net

pass out on $int_if from any to $boss_ip queue boss

pass out on $ext_if all keep state

pass in on $ext_if inet proto tcp from any to $web_server port = 80 flags S/SAFR keep state (max 200, source-track rule, max-src-nodes 200, max-src-states 2) queue boss

=========================pf.conf=======================

禁用系统自定义的PF规则

# vi /etc/rc.conf

pf=NO

启用IP转发:

# vi /etc/sysctl.conf

net.inet.ip.forwarding=1

设置开机启动ADSL拨号:

# mkdir /etc/rc.d

# vi /etc/rc.d/adsl.sh

--------------+----------------+---------------+-------------

#!/bin/sh

# /etc/rc.d/adsl.sh

# 7-11-2004

# llzqq@126.com

pppoe_status () {

IP=$(/sbin/ifconfig tun0 | awk '/netmask/{print $2}')

if [ ! -z "$IP" ]; then

echo "pppoe link is up, ip: " $IP

else

echo "pppoe link is down"

fi

}

pppoe_start () {

echo -n "starting pppoe "; ppp -ddial pppoe /dev/null

for i in 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0; do

sleep 2; echo -n "."

IP=$(/sbin/ifconfig tun0 | awk '/netmask/{print $2}')

if [ ! -z "$IP" ]; then

break

fi

done

echo "."

pppoe_status

}

pppoe_stop () {

PID=$(ps aux | awk '/ppp -ddial/{print $2}')

kill $PID

echo "pppoe link is down"

}

case "$1" in

'start')

pppoe_start

;;

'stop')

pppoe_stop

;;

'status')

pppoe_status

;;

*)

echo "Usage: $0 {start|stop|status}"

exit 1

esac

--------------+----------------+---------------+-------------

# chmod 555 /etc/rc.d/adsl.sh

开机时自动进行ADSL拨号

# vi /etc/rc.local

if [ -f /etc/ppp/ppp.conf ]; then

. /etc/rc.d/adsl.sh start

fi

# vi /etc/rc.shutdown

/etc/rc.d/adsl.sh stop

启用NAME缓存服务器(不是必须的):

# vi /var/named/named.boot

options forward-only

forwarders 202.99.160.68 202.99.168.8

根据拨号需要加载和关闭防火墙:

# vi /etc/ppp/ppp.linkup

MYADDR:

! sh -c "/sbin/ifconfig pflog0 up"

! sh -c "/sbin/pflogd"

! sh -c "/sbin/pfctl -e -F all -f /etc/pf.conf"

# vi /etc/ppp/ppp.linkdown

MYADDR:

! sh -c "/sbin/pfctl -d -F all"

! sh -c "kill `cat /var/run/pflogd.pid`"

! sh -c "/sbin/ifconfig pflog0 down"

! sh -c "/sbin/route delete default"

配置动态域名更新:

# tar zxvf ez-ipupdate-3.0.10.tgz

# cd ez-ipupdate-3.0.10

# vi conf_file.c

增加一行:

#include <errno.h

# vi ez-ipupdate.c

注释掉下面几行(4515行):

//else

//

{

//

fprintf(stderr, "no update needed at this time\n");

//

}

# ./configure

# make

# make install

设置拨号后自动运行:

# vi /etc/ppp/ppp.linkup

MYADDR:

! sh -c "/sbin/ifconfig pflog0 up"

! sh -c "/sbin/pflogd"

! sh -c "/sbin/pfctl -e -F all -f /etc/pf.conf"

!bg /usr/local/bin/ez-ipupdate -i tun0 -h nero.3322.org -S qdns -w wildcard -u user:pwd

解决通过PF防火墙用主动模式连接外网FTP服务器的问题:

# vi /etc/pf.conf

rdr on $int_if proto tcp from any to any port 21 - 127.0.0.1 port 8021

# vi /etc/inetd.conf

127.0.0.1:8021 stream tcp nowait root /usr/libexec/ftp-proxy ftp-proxy

# reboot

设置SQUID的透明代理:

# vi /etc/squid/squid.conf

http_port 127.0.0.1:3128

# vi /etc/pf.conf

rdr on $int_if proto tcp from $int_net to any port 80 - 127.0.0.1 port 3128

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
2023年上半年GDP全球前十五强
 百态   2023-10-24
美众议院议长启动对拜登的弹劾调查
 百态   2023-09-13
上海、济南、武汉等多地出现不明坠落物
 探索   2023-09-06
印度或要将国名改为“巴拉特”
 百态   2023-09-06
男子为女友送行,买票不登机被捕
 百态   2023-08-20
手机地震预警功能怎么开?
 干货   2023-08-06
女子4年卖2套房花700多万做美容:不但没变美脸,面部还出现变形
 百态   2023-08-04
住户一楼被水淹 还冲来8头猪
 百态   2023-07-31
女子体内爬出大量瓜子状活虫
 百态   2023-07-25
地球连续35年收到神秘规律性信号,网友:不要回答!
 探索   2023-07-21
全球镓价格本周大涨27%
 探索   2023-07-09
钱都流向了那些不缺钱的人,苦都留给了能吃苦的人
 探索   2023-07-02
倩女手游刀客魅者强控制(强混乱强眩晕强睡眠)和对应控制抗性的关系
 百态   2020-08-20
美国5月9日最新疫情:美国确诊人数突破131万
 百态   2020-05-09
荷兰政府宣布将集体辞职
 干货   2020-04-30
倩女幽魂手游师徒任务情义春秋猜成语答案逍遥观:鹏程万里
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案神机营:射石饮羽
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案昆仑山:拔刀相助
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案天工阁:鬼斧神工
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案丝路古道:单枪匹马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:与虎谋皮
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:李代桃僵
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案镇郊荒野:指鹿为马
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:小鸟依人
 干货   2019-11-12
倩女幽魂手游师徒任务情义春秋猜成语答案金陵:千金买邻
 干货   2019-11-12
 
推荐阅读
 
 
 
>>返回首頁<<
 
靜靜地坐在廢墟上,四周的荒凉一望無際,忽然覺得,淒涼也很美
© 2005- 王朝網路 版權所有