【求助】openbsd+pf+squid 配置
[color=black][font=宋体]我以前没用过任何类[/font][/color][color=black]UNIX[/color][color=black][font=宋体]系统[/font][/color][color=black],[/color][color=black][font=宋体]但由于我公司防火墙烧毁[/font][/color][color=black],[/color][color=black][font=宋体]不得不花个星期研究一下[/font][/color][color=black]OPENBSD [/color][color=black][font=宋体]和[/font][/color][color=black]PF,[/color][color=black][font=宋体]参考了大量的文挡和各人的高论[/font][/color][color=black],[/color][color=black][font=宋体]搞了个防火墙来用[/font][/color][color=black],[/color][color=black][font=宋体]但一直没通[/font][/color][color=black],[/color][color=black][font=宋体]这里恳请各位前辈高人帮忙看一下是那里的问题[/font][/color][color=black][font=宋体]谢谢了[/font][/color][color=black][font=宋体]主机配置[/font][/color][color=black]: 1[/color][color=black][font=宋体]个[/font][/color][color=black]XEON 2.66, 1GB ECC,36GB SCSI,2[/color][color=black][font=宋体]个[/font][/color][color=black]INTEL 8255[/color][color=black][font=宋体]网卡[/font][/color][color=black],[/color][color=black][font=宋体]一个[/font][/color][color=black]INTEL PRO 1000M[/color][color=black][font=宋体]网卡[/font][/color][color=black],[/color][color=black][font=宋体]一个[/font][/color][color=black]BROADCOM BCM5703X[/color][color=black][font=宋体]网卡[/font][/color][color=black],[/color]
[color=black][font=宋体]软件[/font][/color][color=black]:[/color][color=black][font=宋体]只安装基本包[/font][/color][color=black], OPENBSD +PF+SQUID_transparent_snmp_STABLE9 [/color]
[color=black][font=宋体]说明：[/font][/color][color=black]em0[/color][color=black][font=宋体]接内网[/font][/color][color=black] ip=192.168.1.254 bg0[/color][color=black][font=宋体]接交换区[/font][/color][color=black]ip=10.44.44.44 fxp0[/color][color=black][font=宋体]接[/font][/color][color=black]ADSL ip=192.168.2.254 [/color]
[color=black]Fxp1[/color][color=black][font=宋体]接[/font][/color][color=black]CABLE ip=192.168.3.1 [/color][color=black][font=宋体]下列其中有[/font][/color][color=black]xx.xx.xx[/color][color=black][font=宋体]的是为了保密把真实的去掉。[/font][/color]
[color=black][font=宋体]一、[/font][/color][color=black]:#PF.CONF [/color][color=black][font=宋体]文件[/font][/color]
[color=black]#macros
ext_if="bge0"
int_if="em0"
cable_if="fxp1"
adsl_if="fxp0"[/color]
[color=black]int_gw="10.44.44.254[/color]
[color=black]ext_gw="10.44.44.1"
cable_gw="192.168.2.1"
adsl_gw="192.168.3.1"[/color]
[color=black]cn007="192.168.1.88"
cn_vpn="192.168.1.28"
lea1="192.168.1.81"
lea2="192.168.1.82"
lea3="192.168.1.83"
table <leader_net> {$lea1,$lea2,$lea3}[/color]
[color=black]int_proxy="210.xx.xx.xx"
kbgser1="10.88.88.5"
kbgser2="10.88.88.20"
table <kbgserver_net> {$kbgser1,$kbgser2}
table <cn_net> {10.0.0.0/8,!$kbgser1,!$kbgser2}[/color]
[color=black]ser1="220.xx.xx.xx"
ser2="220.xx.xx.xx"
table <server_net> {$ser1,$ser2 }[/color]
[color=black]table <any_net> {! 10.0.0.0/8,!$kbgser1,!$kbgser2,!$ser1,!$ser2 }[/color]
[color=black]table <trust_net> {$cn_007,$cn_vpn}[/color]
[color=black]table <int_net> {192.168.1.0/24}[/color]
[color=black]serv_port="{134,135,136,137,138,139,140,445,593,333,5554,9995,9996,554,1434,4444}"
icmp_types="echorep"[/color]
[color=black]
# scrub incoming packets
scrub in all [/color]
[color=black]
#nat
nat on $ext_if from $int_if:network to <cn_net> -> ($ext_if)
nat on $ext_if from $int_if:network to <server_net> -> ($ext_if)
nat on $dzw_if from $int_if:network to <kgbserver_net> -> ($cable_if)
nat on $ext_if from $int_if:network to <any_net> -> ($ext_if)
nat on $adsl_if from $int_if:network to <any_net> -> ($adsl_if)[/color]
[color=black]#rdr
rdr on $int_if inet proto tcp from <int_net> to any port 80 -> $int_if port 3128
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021[/color]
[color=black]# setup a default deny policy
block in all
block out all
# pass traffic on the loopback interface in either direction
pass quick on lo0 all
# activate spoofing protection for the internal interface.
antispoof quick for $int_if inet [/color]
[color=black]
# only allow ssh connections from the local network if it's from the
# trusted computer, 192.168.1.88 use "block return" so that a TCP RST is
# sent to close blocked connections right away. use "quick" so that this
# rule is not overridden by the "pass" rules below.
block return in quick on $int_if proto tcp from ! $cn_007 to $int_if port ssh flags S/SA [/color]
[color=black]#worm
block drop in quick on $ext_if proto { tcp, udp } from any to any port $serv_port
block drop in quick on $dzw_if proto { tcp, udp } from any to any port $serv_port
block drop in quick on $adsl_if proto { tcp, udp } from any to any port $serv_port
block drop in quick on $int_if proto { tcp, udp } from any to any port $serv_port[/color]
[color=black]
# pass all traffic to and from the local network
pass in quick on $int_if from <int_net> to $int_if
pass in quick on $int_if from <int_net> to $ext_if
pass in quick on $int_if from <int_net> to $cable_if
pass in quick on $int_if from <int_net> to $adsl_if
pass in quick on $int_if from <int_net> to <server_net> [/color]
[color=black]pass in inet proto icmp all icmp-type $icmp_types keep state[/color]
[color=black]pass in on $int_if from <int_net> to <kbgserver_net> keep state
pass in on $int_if from <int_net> to <cn_net> keep state
pass in on $int_if from <trust_net> to <any_net> keep state
pass in on $int_if from <leader_net> to <any_net> keep state
pass out on $int_if from any to <int_net> keep state[/color]
[color=black]
# load balance outgoing tcp traffic from internal network.
pass in on $int_if route-to { ($ext_if $ext_gw), ($adsl_if $adsl_gw) } round-robin proto tcp from <int_net> to <any_net> flags S/SA modulate state
# load balance outgoing udp and icmp traffic from internal network
pass in on $int_if route-to { ($ext_if $ext_gw), ($adsl_if $adsl_gw) } round-robin proto { udp, icmp } from <int_net> to <any_net> keep state[/color]
[color=black]
# general "pass out" rules for external interfaces
pass out on $ext_if proto tcp from any to any flags S/SA modulate state
pass out on $ext_if proto { udp, icmp } from any to any keep state
pass in on $ext_if proto { tcp, udp} from any to $ext_if flags S/SA keep state
pass out on $adsl_if proto tcp from any to any flags S/SA modulate state
pass out on $adsl_if proto { udp, icmp } from any to any keep state
pass in on $adsl_if proto { tcp, udp} from any to $adsl_if flags S/SA keep state[/color]
[color=black]# route packets from any IPs on $ext_if to $ext_gw and the same for
# $adsl_if and $adsl_gw
pass out on $ext_if route-to ($adsl_if $adsl_gw) from $adsl_if to <any_net>
pass out on $adsl_if route-to ($ext_if $ext_gw) from $ext_if to <any_net>
# general "pass out" rules for cable interfaces
pass out on $cable_if proto tcp from any to any flags S/SA modulate state
pass out on $cable_if proto { udp, icmp } from any to any keep state
pass in on $cable_if proto {tcp,udp} from any to $cable_if flags S/SA keep state[/color]
[color=black]# allow ssh connections in on the external interface as long as they're
# NOT destined for the firewall (i.e., they're destined for a machine on
# the local network). log the initial packet so that we can later tell
# who is trying to connect. use the tcp syn proxy to proxy the connection.
pass in log on $ext_if proto tcp from any to { !$ext_if, !$int_if ,!$adsl_if,!$cable_if} port ssh flags S/SA synproxy state[/color]
[size=3][font=宋体]二、[/font][font=Times New Roman]sysctl.conf [/font][font=宋体]文件[/font][/size]
[size=3][font=宋体]只打开其中[/font][font=Times New Roman] net.inet.ip.forwarding=1 # 1=Permit forwarding (routing) of packets [/font][/size]
[font=宋体][size=3]其他的默认[/size][/font]
[size=3][font=宋体]三、[/font][font=Times New Roman]rc.conf [/font][font=宋体]文件[/font][/size]
[size=3][font=宋体]只修改其中[/font][font=Times New Roman] pf=YES # Packet filter / NAT[/font][/size]
[font=宋体][size=3]其他默认[/size][/font]
继续上面的
[size=3][font=宋体]四、[/font][font=Times New Roman]rc.local [/font][font=宋体]文件[/font][/size][font=Times New Roman][size=3]### $OpenBSD: rc.local,v 1.36 2004/07/06 04:03:41 henning Exp $[/size][/font]
[font=Times New Roman][size=3]# site-specific startup actions, daemons, and other things which[/size][/font]
[font=Times New Roman][size=3]# can be done AFTER your system goes into securemode. For actions[/size][/font]
[font=Times New Roman][size=3]# which should be done BEFORE your system has gone into securemode[/size][/font]
[font=Times New Roman][size=3]# please see /etc/rc.securelevel[/size][/font]
[font=Times New Roman][size=3]# site-specific startup actions, daemons which can be run[/size][/font]
[font=Times New Roman][size=3]# Add your local changes additions to this file[/size][/font]
[font=Times New Roman][size=3]echo -n 'starting local daemons:'[/size][/font]
[font=Times New Roman][size=3]if [ -x /usr/local/sbin/cfsd ]; then[/size][/font]
[size=3][font=Times New Roman]if ps auxc | grep -q '^ *root .* mountd$'; then[/font][/size]
[size=3][font=Times New Roman]echo -n ' cfsd'; /usr/local/sbin/cfsd >/dev/null 2>&1[/font][/size]
[size=3][font=Times New Roman]mount -o port=3049,nfsv2,intr localhost:/null /crypt[/font][/size]
[size=3][font=Times New Roman]else[/font][/size]
[size=3][font=Times New Roman]echo -n ' cfsd (failed, no mountd running)'[/font][/size]
[size=3][font=Times New Roman]fi[/font][/size]
[font=Times New Roman][size=3]fi[/size][/font]
[font=Times New Roman][size=3]#[/size][/font]
[font=Times New Roman][size=3]if [ -x /usr/local/sbin/squid ]; then[/size][/font]
[size=3][font=Times New Roman]echo -n 'squid'; /usr/local/sbin/squid[/font][/size]
[font=Times New Roman][size=3]fi[/size][/font]
[font=Times New Roman][size=3]route add -host 10.88.88.5 -netmask 255.255.255.255 192.168.3.1[/size][/font]
[font=Times New Roman][size=3]route add -host 10.88.88.20 -netmask 255.255.255.255 192.168.3.1[/size][/font]
[font=Times New Roman][size=3]route add -host 210.xx.xx.xx -netmask 255.255.255.255 10.44.44.254 ####内网代理服###务[/size][/font]
[font=Times New Roman][size=3]route add -net 10.0.0.0 -netmask 255.0.0.0 10.44.44.254[/size][/font]
[font=Times New Roman][size=3]route add -net 220.xx.xx.0 -netmask 255.255.255.0 10.44.44.1[/size][/font]
[size=3][font=Times New Roman]route add ?net 0.0.0.0 ?netmask 0.0.0.0 10.44.44.1 [/font][/size]
[size=3][font=Times New Roman]#####([/font][font=宋体]这两行我不知道是否要不要加[/font][font=Times New Roman])####[/font][/size]
[size=3][font=Times New Roman]route add ?net 0.0.0.0 ?netmask .0.0.0.0 192.168.2.1 [/font][/size]
[size=3][font=Times New Roman]#####([/font][font=宋体]这两行我不知道是否要不要加[/font][font=Times New Roman])####[/font][/size]
[font=Times New Roman][size=3]#if [ -x /usr/local/sbin/snmpd ]; then[/size][/font]
[font=Times New Roman][size=3]# echo -n ' snmpd'; /usr/local/sbin/snmpd[/size][/font]
[font=Times New Roman][size=3]#fi[/size][/font]
[font=Times New Roman][size=3]echo '.'[/size][/font]
[font=Times New Roman][size=3]# Netatalk stuff[/size][/font]
[font=Times New Roman][size=3]#if [ -f /etc/netatalk/rc.atalk ]; then[/size][/font]
[font=Times New Roman][size=3]# . /etc/netatalk/rc.atalk[/size][/font]
[font=Times New Roman][size=3]#fi[/size][/font]
[size=3][font=宋体]五、[/font][font=Times New Roman]squid.conf [/font][font=宋体]文件[/font][/size]
[font=Times New Roman][size=3]http_port 192.168.1.254:3128[/size][/font]
[font=Times New Roman][size=3]icp_port 0[/size][/font]
[font=Times New Roman][size=3]cache_peer 210.xx.xx.xx parent 3128 3130[/size][/font]
[font=Times New Roman][size=3]udp_incoming_address 0.0.0.0[/size][/font]
[font=Times New Roman][size=3]udp_outgoing_address 255.255.255.255[/size][/font]
[font=Times New Roman][size=3]hierarchy_stoplist cgi-bin ?[/size][/font]
[font=Times New Roman][size=3]acl QUERY urlpath_regex cgi-bin \?[/size][/font]
[font=Times New Roman][size=3]no_cache deny QUERY[/size][/font]
[font=Times New Roman][size=3]cache_mem 256 MB[/size][/font]
[font=Times New Roman][size=3]cache_swap_low 90[/size][/font]
[font=Times New Roman][size=3]cache_swap_high 95[/size][/font]
[font=Times New Roman][size=3]maximum_object_size 8192 KB[/size][/font]
[font=Times New Roman][size=3]maximum_object_size_in_memory 16 KB[/size][/font]
[font=Times New Roman][size=3]cache_effective_user nobody[/size][/font]
[font=Times New Roman][size=3]cache_effective_group nobody[/size][/font]
[font=Times New Roman][size=3]cache_dir ufs /usr/local/squid/cache 1024 15 256[/size][/font]
[font=Times New Roman][size=3]cache_access_log /dev/null[/size][/font]
[font=Times New Roman][size=3]cache_log /dev/null[/size][/font]
[font=Times New Roman][size=3]cache_store_log /dev/null[/size][/font]
[font=Times New Roman][size=3]error_directory /etc/squid/errors/Simplify_Chinese[/size][/font]
[font=Times New Roman][size=3]icon_directory /etc/squid/icons[/size][/font]
[font=Times New Roman][size=3]mime_table /etc/squid/mime.conf[/size][/font]
[font=Times New Roman][size=3]coredump_dir /usr/local/squid/squid/cache[/size][/font]
[font=Times New Roman][size=3]pid_filename /usr/local/squid/logs/squid.pid[/size][/font]
[font=Times New Roman][size=3]hosts_file /etc/hosts[/size][/font]
[font=Times New Roman][size=3]unlinkd_program /usr/local/squid/libexec/unlinkd[/size][/font]
[font=Times New Roman][size=3]dns_nameservers 10.xx.xx..xx 220.xx..xx..xx 220.xx.xx.xx[/size][/font]
[font=Times New Roman][size=3]visible_hostname bsdrouter.xxxx.com.cn[/size][/font]
[font=Times New Roman][size=3]ipcache_size 1024[/size][/font]
[font=Times New Roman][size=3]ipcache_low 90[/size][/font]
[font=Times New Roman][size=3]ipcache_high 95[/size][/font]
[font=Times New Roman][size=3]fqdncache_size 1024[/size][/font]
[font=Times New Roman][size=3]cache_replacement_policy lru[/size][/font]
[font=Times New Roman][size=3]memory_replacement_policy lru[/size][/font]
[font=Times New Roman][size=3]emulate_httpd_log off[/size][/font]
[font=Times New Roman][size=3]log_ip_on_direct on[/size][/font]
[font=Times New Roman][size=3]log_mime_hdrs off[/size][/font]
[font=Times New Roman][size=3]dns_timeout 2 minutes[/size][/font]
[font=Times New Roman][size=3]request_header_max_size 10 KB[/size][/font]
[font=Times New Roman][size=3]request_body_max_size 0 KB[/size][/font]
[font=Times New Roman][size=3]refresh_pattern ^ftp: 1440 20% 10080[/size][/font]
[font=Times New Roman][size=3]refresh_pattern ^gopher: 1440 0% 1440[/size][/font]
[font=Times New Roman][size=3]refresh_pattern . 0 20% 4320[/size][/font]
[font=Times New Roman][size=3]negative_ttl 5 minutes[/size][/font]
[font=Times New Roman][size=3]positive_dns_ttl 6 hours[/size][/font]
[font=Times New Roman][size=3]negative_dns_ttl 1 minute[/size][/font]
[font=Times New Roman][size=3]connect_timeout 1 minute[/size][/font]
[font=Times New Roman][size=3]read_timeout 15 minutes[/size][/font]
[font=Times New Roman][size=3]request_timeout 5 minutes[/size][/font]
[font=Times New Roman][size=3]client_lifetime 1 day[/size][/font]
[font=Times New Roman][size=3]half_closed_clients on[/size][/font]
[font=Times New Roman][size=3]maximum_single_addr_tries 1[/size][/font]
[font=Times New Roman][size=3]uri_whitespace strip[/size][/font]
[font=Times New Roman][size=3]ie_refresh off[/size][/font]
[font=Times New Roman][size=3]acl no_lan src 192.168.1.1-192.168.1.20/255.255.255.255[/size][/font]
[font=Times New Roman][size=3]acl our_lan src 192.168.1.20-192.168.1.100/255.255.255.255[/size][/font]
[font=Times New Roman][size=3]acl all src 0.0.0.0/0.0.0.0[/size][/font]
[font=Times New Roman][size=3]acl manager proto cache_object[/size][/font]
[font=Times New Roman][size=3]acl localhost src 127.0.0.1/255.255.255.255[/size][/font]
[font=Times New Roman][size=3]acl to_localhost dst 127.0.0.0/8[/size][/font]
[font=Times New Roman][size=3]acl SSL_ports port 443 563[/size][/font]
[font=Times New Roman][size=3]acl Safe_ports port 80 # http[/size][/font]
[font=Times New Roman][size=3]acl Safe_ports port 21 # ftp[/size][/font]
[font=Times New Roman][size=3]acl Safe_ports port 443 563 # https, snews[/size][/font]
[font=Times New Roman][size=3]acl Safe_ports port 70 # gopher[/size][/font]
[font=Times New Roman][size=3]acl Safe_ports port 210 # wais[/size][/font]
[font=Times New Roman][size=3]acl Safe_ports port 1025-65535 # unregistered ports[/size][/font]
[font=Times New Roman][size=3]acl Safe_ports port 280 # http-mgmt[/size][/font]
[font=Times New Roman][size=3]acl Safe_ports port 488 # gss-http[/size][/font]
[font=Times New Roman][size=3]acl Safe_ports port 591 # filemaker[/size][/font]
[font=Times New Roman][size=3]acl Safe_ports port 777 # multiling http[/size][/font]
[font=Times New Roman][size=3]acl CONNECT method CONNECT[/size][/font]
[font=Times New Roman][size=3]# Only allow cachemgr access from localhost[/size][/font]
[font=Times New Roman][size=3]http_access allow manager localhost[/size][/font]
[font=Times New Roman][size=3]http_access deny manager[/size][/font]
[font=Times New Roman][size=3]# Deny requests to unknown ports[/size][/font]
[font=Times New Roman][size=3]http_access deny !Safe_ports[/size][/font]
[font=Times New Roman][size=3]# Deny CONNECT to other than SSL ports[/size][/font]
[font=Times New Roman][size=3]http_access deny CONNECT !SSL_ports[/size][/font]
[font=Times New Roman][size=3]#[/size][/font]
[font=Times New Roman][size=3]http_access deny to_localhost[/size][/font]
[font=Times New Roman][size=3]http_access deny no_lan[/size][/font]
[font=Times New Roman][size=3]http_access allow our_lan[/size][/font]
[font=Times New Roman][size=3]http_access deny all[/size][/font]
[font=Times New Roman][size=3]http_reply_access allow all[/size][/font]
[font=Times New Roman][size=3]icp_access allow all[/size][/font]
[font=Times New Roman][size=3]hierarchy_stoplist cgi-bin ?[/size][/font]
[font=Times New Roman][size=3]httpd_accel_host virtual[/size][/font]
[font=Times New Roman][size=3]httpd_accel_port 80[/size][/font]
[font=Times New Roman][size=3]httpd_accel_with_proxy on[/size][/font]
[font=Times New Roman][size=3]httpd_accel_uses_host_header on[/size][/font]
[font=Times New Roman][size=3]########## Misc control ###########[/size][/font]
[font=Times New Roman][size=3]ftp_user Squid@[/size][/font]
[font=Times New Roman][size=3]ftp_list_width 32[/size][/font]
[font=Times New Roman][size=3]ftp_passive on[/size][/font]
[font=Times New Roman][size=3]ftp_sanitycheck on[/size][/font] 以上的规则是否合理,各位高人能否帮忙找出错误地方,优化一下,谢谢了
感觉使用PF后.用SSH连上去速度很慢.还有这样配置是否存在安全漏洞.恳请各高人前辈指出,拜谢,如果是和我本地,请吃饭哦
顺便说一下,VI编辑器用起来真的好不方便:( 今天先看看你的PF配置, 明天再说说我的理解! 能不能画一画你的网络结构图啊?
网络拓扑图
看附件网络拓扑图请看附件，谢谢回复
网络拓扑图请看附件，谢谢回复呵呵 图中笔误，prarent squid 应为parent squid 偶觉得你的网络结构这样的话应该改为这样, 你可以在你的结构图上画一画数据包的走向图, bge0线路的数据包好混乱.
下图是我设想的结构图
thanks
谢谢，问题已解决，呵呵，BSD还真好用~感觉让我又回到大学时代 是啊, BSD比较清楚明了! 有人说BSD适合作学术研究的, 我使用了很长时间BSD觉得它条理很清楚! 大哥, 可不可以写写你的配置经过让大家学习学习, 谢谢! 正在整理一下，呵呵，因为刚用BSD，方法比较苯，大家可别笑 不会, 支持你! 不好意思 借地方问一下按楼主的拓扑图 我想请教一下 远程vpn拨号进来后 我想让vpn的出口从adsl那边走该如何做？
页:
[1]