openbsd+pf配置
初学openbsd+pf，见笑了，不对的请指正
qq:35907960
mail:yanypunix@yahoo.com.cn
openbsd服务器3块网卡
rl0 61.131.58.x 接公网
rl1 192.168.1.0/24 接内网段1
rl2 131.107.3.0/24 接内网段2
有些ip要24小时上网，有些ip限定8小时上网
写了两个脚本
shellpf1+pf1.conf（24小时上网）
shellpf2+pf2.conf(8小时上网)
shellpf1,shellpf2,pf1.conf,pf2.conf四个文件放在/etc/pf目录下
在crontab里定时执行,
文件/etc/pf/pf1.conf的配置如下:
ext_if="rl0" #接公网192_if="rl1" #接内网段1131_if="rl2" #接内网段2192net="{192.168.1.222/32,192.168.1.5/32,192.168.1.132/32,192.168.1.77/32,192.168.1.2/32,192.168.1.8/32,192.168.1.4/32,192.168.1.6/32,192.168.1.28/32,192.168.1.177/32,192.168.1.195/32,192.168.1.45/32,192.168.1.47/32,192.168.1.16/32,192.168.1.249/32,}"131net="{131.107.3.215/32,131.107.3.216/32,131.107.3.217/32,131.107.3.218/32,131.107.3.219/32,131.107.3.220/32,131.107.3.211/32,131.107.3.43/32,131.107.3.47/32,131.107.3.48/32,131.107.3.174/32,131.107.3.175/32,131.107.3.181/32,131.107.3.194/32,131.107.3.123/32,131.107.3.252/32,131.107.3.253/32,131.107.3.216/32,131.107.3.198/32,131.107.3.17/32}"tcp_services="{22,113}"icmp_types="echoreq"priv_nets="{127.0.0.0/8,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8}"set optimization aggressivescrub in allnat on rl0 from 192.168.1.0/24 to any -> 61.131.58.x/32nat on rl0 from 131.107.3.0/24 to any -> 61.131.58.x/32block allpass quick on lo0 allblock drop in quick on $ext_if from $priv_nets to anyblock drop out quick on $ext_if from any to $priv_nets#pass in inet proto icmp all icmp-type $icmp_types keep statesblock in quick on $192_if from 131.107.3.0/24 to anyblock out quick on $192_if from any to 131.107.3.0/24block in quick on $131_if from 192.168.1.0/24 to anyblock out quick on $131_if from any to 192.168.1.0/24pass in on $192_if from $192net to any keep statepass out on $192_if from any to $192net keep statepass in on $131_if from $131net to any keep statepass out on $131_if from any to $131net keep statepass out on $ext_if proto tcp all modulate state flags S/SApass out on $ext_if proto udp all keep state
/etc/pf/pf2.conf如下
ext_if="rl0" #接公网192_if="rl1" #接内网段1131_if="rl2" #接内网段2192net="{192.168.1.2/32,192.168.1.8/32,192.168.1.6/32,192.168.1.45/32,192.168.1.47/32,192.168.1.16/32,192.168.1.28/32,192.168.1.249/32,192.168.1.222/32}"131net="{131.107.3.48/32,131.107.3.47/32}"tcp_services="{22,113}"icmp_types="echoreq"priv_nets="{127.0.0.0/8,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8}"set optimization aggressivescrub in allnat on rl0 from 192.168.1.0/24 to any -> 61.131.58.x/32nat on rl0 from 131.107.3.0/24 to any -> 61.131.58.X/32block allpass quick on lo0 allblock drop in quick on $ext_if from $priv_nets to anyblock drop out quick on $ext_if from any to $priv_nets#pass in inet proto icmp all icmp-type $icmp_types keep statesblock in quick on $192_if from 131.107.3.0/24 to anyblock out quick on $192_if from any to 131.107.3.0/24block in quick on $131_if from 192.168.1.0/24 to anyblock out quick on $131_if from any to 192.168.1.0/24pass in on $192_if from $192net to any keep statepass out on $192_if from any to $192net keep statepass in on $131_if from $131net to any keep statepass out on $131_if from any to $131net keep statepass out on $ext_if proto tcp all modulate state flags S/SApass out on $ext_if proto udp all keep state
/etc/pf/shellpf1如下
pfctl -d
pfctl -e
pfctl -f /etc/pf/pf1.conf
/etc/pf/shellpf2如下
pfctl -d
pfctl -e
pfctl -f /etc/pf/pf2.conf
crontab如下 /var/cron/tabs/root
# $OpenBSD: crontab,v 1.9 2001/09/11 19:03:55 millert Exp $# $Id: crontab-nomail,v 1.1 2002/04/15 01:03:20 jmates Exp $## JAM 2002-04-14 Disabled mailings from root.## /var/cron/tabs/root - root's crontab#SHELL=/bin/shPATH=/bin:/sbin:/usr/bin:/usr/sbin:/etc/pfHOME=/var/log##minute hour mday month wday command#*/10 18 * * * /etc/pf/shellpf2*/50 7 * * * /etc/pf/shellpf1## sendmail clientmqueue runner## rotate log files every hour, if necessary0 * * * * /usr/bin/newsyslog# send log file notifications, if necessary#1-59 * * * * /usr/bin/newsyslog -m## do daily/weekly/monthly maintenance30 1 * * * /bin/sh /etc/daily 1>/var/log/daily.out 2>&130 3 * * 6 /bin/sh /etc/weekly 1>/var/log/weekly.out 2>&130 5 1 * * /bin/sh /etc/monthly 1>/var/log/monthly.out 2>&1
每天7:50执行脚本shellpf1,18:10执行shellpf2
对于mac与ip绑定，可写一脚本，防止有人改ip上网(会改mac地址的除外)
arp -s 192.168.1.4 00:0c:76:84:52:f0 pub
arp -s 192.168.1.5 00:0c:76:2f:dd:2c pub
