OPENBSD上的ADSL和防火墙设置配置(open bsd)

下面我用的是OPENBSD 3.6 配置ADSL： # vi /etc/ppp/ppp.conf ========================ppp.conf======================= default: set log Phase Chat IPCP CCP tun command set redial 0 set reconnect pppoe: set device "!/usr/sbin/pppoe -i rl1" disable acfcomp protocomp deny acfcomp set mtu max set crtscts off set speed sync enable lqr set lqrperiod 5 set cd 5 set dial set login set timeout 0 set authname "sjza@adsl2" set authkey add! default HISADDR enable mssfixup ========================ppp.conf======================= 建立防火墙代理配置： # vi /etc/pf.conf =========================pf.conf======================= ext_if = "tun0" int_if = "{ dc0, rl0 }" int_net = "{ ..0.0/, ...0/ }" loop = "lo0" tcp_services = "{ www, ftp }" boss_ip = "{ ..., ..., ..., ..., ..., ... }" noroute = "{ .0.0.1/8, ..0.0/, ..0.0/, .0.0.0/8, .../ }" web_server = "{ ...5, ... }" set block-policy return set loginterface $ext_if set optimization aggressive scrub in all altq on $int_if cbq bandwidth Kb queue { dflt, boss } queue dflt bandwidth Kb cbq(default) queue boss bandwidth Kb cbq(borrow) nat on $ext_if from $int_net to any -> $ext_if block all block return block in quick on $ext_if os NMAP block in quick on $ext_if from $noroute to any block out quick on $ext_if from any to $noroute pass in quick on $ext_if inet proto tcp from any to any port > keep state #pass in quick on $ext_if inet proto icmp all icmp-type 8 code 0 keep state pass in quick on $ext_if inet proto tcp from any to any port $tcp_services flags S/SAFR keep state pass quick on $loop all pass in on $int_if from $int_net pass out on $int_if from any to $int_net pass out on $int_if from any to $boss_ip queue boss pass out on $ext_if all keep state pass in on $ext_if inet proto tcp from any to $web_server port = flags S/SAFR keep state (max , source-track rule, max-src-nodes , max-src-states 2) queue boss =========================pf.conf======================= 禁用系统自定义的PF规则 # vi /etc/rc.conf pf=NO 启用IP转发： # vi /etc/sysctl.conf net.inet.ip.forwarding=1 设置开机启动ADSL拨号： # mkdir /etc/rc.d # vi /etc/rc.d/adsl.sh --------------+----------------+---------------+------------- #!/bin/sh # /etc/rc.d/adsl.sh # 7-- # llzqq@.com pppoe_status () { IP=$(/sbin/ifconfig tun0 | awk '/netmask/{print $2}') if [ ! -z "$IP" ]; then echo "pppoe link is up, ip: " $IP else echo "pppoe link is down" fi } pppoe_start () { echo -n "starting pppoe "; ppp -ddial pppoe > /dev/null for i in 9 8 7 6 5 4 3 2 1 0; do sleep 2; echo -n "." IP=$(/sbin/ifconfig tun0 | awk '/netmask/{print $2}') if [ ! -z "$IP" ]; then break fi done echo "." pppoe_status } pppoe_stop () { PID=$(ps aux | awk '/ppp -ddial/{print $2}') kill $PID echo "pppoe link is down" } case "$1" in 'start') pppoe_start ;; 'stop') pppoe_stop ;; 'status') pppoe_status ;; *) echo "Usage: $0 {start|stop|status}" exit 1 esac --------------+----------------+---------------+------------- # chmod /etc/rc.d/adsl.sh 开机时自动进行ADSL拨号 # vi /etc/rc.local if [ -f /etc/ppp/ppp.conf ]; then . /etc/rc.d/adsl.sh start fi # vi /etc/rc.shutdown /etc/rc.d/adsl.sh stop 启用NAME缓存服务器(不是必须的)： # vi /var/named/named.boot options forward-only forwarders ... ...8 根据拨号需要加载和关闭防火墙： # vi /etc/ppp/ppp.linkup MYADDR: ! sh -c "/sbin/ifconfig pflog0 up" ! sh -c "/sbin/pflogd" ! sh -c "/sbin/pfctl -e -F all -f /etc/pf.conf" # vi /etc/ppp/ppp.linkdown MYADDR: ! sh -c "/sbin/pfctl -d -F all" ! sh -c "kill `cat /var/run/pflogd.pid`" ! sh -c "/sbin/ifconfig pflog0 down" ! sh -c "/sbin/route delete default" 配置动态域名更新： # tar zxvf ez-ipupdate-3.0..tgz # cd ez-ipupdate-3.0. # vi conf_file.c 增加一行： #include <errno.h> # vi ez-ipupdate.c 注释掉下面几行(行)： //else // { // fprintf(stderr, "no update needed at this timen"); // } # ./configure # make # make install 设置拨号后自动运行： # vi /etc/ppp/ppp.linkup MYADDR: ! sh -c "/sbin/ifconfig pflog0 up" ! sh -c "/sbin/pflogd" ! sh -c "/sbin/pfctl -e -F all -f /etc/pf.conf" !bg /usr/local/bin/ez-ipupdate -i tun0 -h nero..org -S qdns -w wildcard -u user:pwd 解决通过PF防火墙用主动模式连接外网FTP服务器的问题： # vi /etc/pf.conf rdr on $int_if proto tcp from any to any port -> .0.0.1 port # vi /etc/inetd.conf .0.0.1: stream tcp nowait root /usr/libexec/ftp-proxy ftp-proxy # reboot 设置SQUID的透明代理： # vi /etc/squid/squid.conf http_port .0.0.1: # vi /etc/pf.conf rdr on $int_if proto tcp from $int_net to any port -> .0.0.1 port

推荐整理分享OPENBSD上的ADSL和防火墙设置配置(open bsd)，希望有所帮助，仅作参考，欢迎阅读内容。

文章相关热门搜索词:openbsd是什么,open bsd,openbsd pf,openbsd pf,openbsd和freebsd,openbsd netbsd,openbsd6.8,openbsd netbsd,内容如对您有帮助，希望把文章链接给更多的朋友！

Unix BSD Linux的口令机制初探 1.概述早期UNIX系统把用户口令保存在一个纯文本可读的口令文件中，这可能在系统管理员注意不到的情况下被截取并暴露。它也可能在一次偶然事件中

Unix操作系统命令和配置文件的保护知识分享 Unix操作系统有很多值得学习的地方，这里我们主要介绍Unix操作系统中的保护知识。我们要保护下面的Unix操作系统命令和Unix操作系统配置文件以防止入

unix下的常用命令详解 一、注意事项命令和参数之间必需用空格隔开，参数和参数之间也必需用空格隔开。一行不能超过个字符；大小写有区分。二、特殊字符含义文件名