【求助】openbsd+pf+squid 配置
我以前没用过任何类UNIX系统,但由于我公司防火墙烧毁,不得不花个星期研究一下OPENBSD 和PF,参考了大量的文挡和各人的高论,搞了个防火墙来用,但一直没通,这里恳请各位前辈高人帮忙看一下是那里的问题谢谢了
主机配置: 1个XEON 2.66, 1GB ECC,36GB SCSI,2个INTEL 8255网卡,一个INTEL PRO 1000M网卡,一个BROADCOM BCM5703X网卡,
软件:只安装基本包, OPENBSD +PF+SQUID_transparent_snmp_STABLE9
说明：em0接内网 ip=192.168.1.254 bg0接交换区ip=10.44.44.44 fxp0接ADSL ip=192.168.2.254
Fxp1接CABLE ip=192.168.3.1 下列其中有xx.xx.xx的是为了保密把真实的去掉。
一、:#PF.CONF 文件
#macros
ext_if="bge0"
int_if="em0"
cable_if="fxp1"
adsl_if="fxp0"
int_gw="10.44.44.254
ext_gw="10.44.44.1"
cable_gw="192.168.2.1"
adsl_gw="192.168.3.1"
cn007="192.168.1.88"
cn_vpn="192.168.1.28"
lea1="192.168.1.81"
lea2="192.168.1.82"
lea3="192.168.1.83"
table <leader_net> {$lea1,$lea2,$lea3}
int_proxy="210.xx.xx.xx"
kbgser1="10.88.88.5"
kbgser2="10.88.88.20"
table <kbgserver_net> {$kbgser1,$kbgser2}
table <cn_net> {10.0.0.0/8,!$kbgser1,!$kbgser2}
ser1="220.xx.xx.xx"
ser2="220.xx.xx.xx"
table <server_net> {$ser1,$ser2 }
table <any_net> {! 10.0.0.0/8,!$kbgser1,!$kbgser2,!$ser1,!$ser2 }
table <trust_net> {$cn_007,$cn_vpn}
table <int_net> {192.168.1.0/24}
serv_port="{134,135,136,137,138,139,140,445,593,333,5554,9995,9996,554,1434,4444}"
icmp_types="echorep"
# scrub incoming packets
scrub in all
#nat
nat on $ext_if from $int_if:network to <cn_net> -> ($ext_if)
nat on $ext_if from $int_if:network to <server_net> -> ($ext_if)
nat on $dzw_if from $int_if:network to <kgbserver_net> -> ($cable_if)
nat on $ext_if from $int_if:network to <any_net> -> ($ext_if)
nat on $adsl_if from $int_if:network to <any_net> -> ($adsl_if)
#rdr
rdr on $int_if inet proto tcp from <int_net> to any port 80 -> $int_if port 3128
rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021
# setup a default deny policy
block in all
block out all
# pass traffic on the loopback interface in either direction
pass quick on lo0 all
# activate spoofing protection for the internal interface.
antispoof quick for $int_if inet
# only allow ssh connections from the local network if it's from the
# trusted computer, 192.168.1.88 use "block return" so that a TCP RST is
# sent to close blocked connections right away. use "quick" so that this
# rule is not overridden by the "pass" rules below.
block return in quick on $int_if proto tcp from ! $cn_007 to $int_if port ssh flags S/SA
#worm
block drop in quick on $ext_if proto { tcp, udp } from any to any port $serv_port
block drop in quick on $dzw_if proto { tcp, udp } from any to any port $serv_port
block drop in quick on $adsl_if proto { tcp, udp } from any to any port $serv_port
block drop in quick on $int_if proto { tcp, udp } from any to any port $serv_port
# pass all traffic to and from the local network
pass in quick on $int_if from <int_net> to $int_if
pass in quick on $int_if from <int_net> to $ext_if
pass in quick on $int_if from <int_net> to $cable_if
pass in quick on $int_if from <int_net> to $adsl_if
pass in quick on $int_if from <int_net> to <server_net>
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in on $int_if from <int_net> to <kbgserver_net> keep state
pass in on $int_if from <int_net> to <cn_net> keep state
pass in on $int_if from <trust_net> to <any_net> keep state
pass in on $int_if from <leader_net> to <any_net> keep state
pass out on $int_if from any to <int_net> keep state
# load balance outgoing tcp traffic from internal network.
pass in on $int_if route-to { ($ext_if $ext_gw), ($adsl_if $adsl_gw) } round-robin proto tcp from <int_net> to <any_net> flags S/SA modulate state
# load balance outgoing udp and icmp traffic from internal network
pass in on $int_if route-to { ($ext_if $ext_gw), ($adsl_if $adsl_gw) } round-robin proto { udp, icmp } from <int_net> to <any_net> keep state
# general "pass out" rules for external interfaces
pass out on $ext_if proto tcp from any to any flags S/SA modulate state
pass out on $ext_if proto { udp, icmp } from any to any keep state
pass in on $ext_if proto { tcp, udp} from any to $ext_if flags S/SA keep state
pass out on $adsl_if proto tcp from any to any flags S/SA modulate state
pass out on $adsl_if proto { udp, icmp } from any to any keep state
pass in on $adsl_if proto { tcp, udp} from any to $adsl_if flags S/SA keep state
# route packets from any IPs on $ext_if to $ext_gw and the same for
# $adsl_if and $adsl_gw
pass out on $ext_if route-to ($adsl_if $adsl_gw) from $adsl_if to <any_net>
pass out on $adsl_if route-to ($ext_if $ext_gw) from $ext_if to <any_net>
# general "pass out" rules for cable interfaces
pass out on $cable_if proto tcp from any to any flags S/SA modulate state
pass out on $cable_if proto { udp, icmp } from any to any keep state
pass in on $cable_if proto {tcp,udp} from any to $cable_if flags S/SA keep state
# allow ssh connections in on the external interface as long as they're
# NOT destined for the firewall (i.e., they're destined for a machine on
# the local network). log the initial packet so that we can later tell
# who is trying to connect. use the tcp syn proxy to proxy the connection.
pass in log on $ext_if proto tcp from any to { !$ext_if, !$int_if ,!$adsl_if,!$cable_if} port ssh flags S/SA synproxy state
二、sysctl.conf 文件
只打开其中 net.inet.ip.forwarding=1 # 1=Permit forwarding (routing) of packets
其他的默认
三、rc.conf 文件
只修改其中 pf=YES # Packet filter / NAT
其他默认
