在NETBSD上配置ADSL+IPF+IPNAT(轉)

在NETBSD上配置ADSL+IPF+IPNAT(轉)[@more@]

　　OS: 2.x

　　配置網路卡的IP地址：

　　# vi /etc/ifconfig.rtk0

　　inet 192.168.0.1 netmask 255.255.255.0

　　# vi /etc/ifconfig.tlp0

　　inet 192.168.1.2 netmask 255.255.255.0

　　配置主機名：

　　# vi /etc/myname

　　netbsd

　　# vi /etc/hosts

　　127.0.0.1　　　　localhost　　　　netbsd

　　配置DNS解析：

　　# vi /etc/resolv.conf

　　nameserver 202.99.160.68

　　nameserver 202.99.168.8

　　配置閘道器：

　　# vi /etc/mygate

　　192.168.0.10

　　配置主機本地解析：

　　# vi /etc/hosts

　　192.168.0.10　　　　win2k

　　配置SSHD服務：

　　# vi /etc/defaults/rc.conf

　　sshd=YES

　　# vi /etc/ssh/sshd_config

　　PermitRootLogin yes

　　安裝配置ADSL:

　　# pkg_add rp-pppoe-3.5.tgz

　　# mkdir /etc/ppp

　　# cp /usr/pkg/share/examples/rp-pppoe/pppoe.conf /etc/ppp/pppoe.conf

　　# adsl-start

　　配置防火牆代理上網：

　　# vi /etc/ipf.conf

　　=================================/etc/ipf.conf==============================

　　# +-----------+　 +------------------------------+　 +------------------+

　　# | ADSL-Modem|---| ppp0 tlp0　NAT+IPF　 rtk0 |---| Internal Network |

　　# +-----------+　 +------------------------------+　 +------------------+

　　#

　　# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

　　# Interface: all

　　# Block all incoming and outgoing packets unless they're allowed later.

　　# +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

　　block in all

　　block out all

　　# Possibly dangerous: packets with ip-options, short and fragmented packets

　　block in log quick on ppp0 proto icmp from any to any

　　block in log quick all with short

　　block in log quick all with ipopts

　　block in log quick all with frag

　　block in log quick all with opt lsrr

　　block in log quick all with opt ssrr

　　# Local network traffic is allowed

　　pass out quick on lo0

　　pass in quick on lo0

　　pass out quick on rtk0

　　pass in quick on rtk0

　　# Block faked or unlikely "local" addresses

　　block in log body quick on ppp0 from 192.168.0.0/16 to any

　　block in log body quick on ppp0 from 172.16.0.0/12 to any

　　block in log body quick on ppp0 from 10.0.0.0/8 to any

　　block in log body quick on ppp0 from 192.0.2.0/24 to any

　　block in log body quick on ppp0 from 0.0.0.0/8 to any

　　block in log body quick on ppp0 from 127.0.0.0/8 to any

　　block in log body quick on ppp0 from 169.254.0.0/16 to any

　　block in log body quick on ppp0 from 224.0.0.0/3 to any

　　block in log body quick on ppp0 from 204.152.64.0/23 to any

　　# Blocking of outgoing faked or unlikely "internal" addresses

　　block out log body quick on ppp0 from any to 192.168.0.0/16

　　block out log body quick on ppp0 from any to 172.16.0.0/12

　　block out log body quick on ppp0 from any to 10.0.0.0/8

　　block out log body quick on ppp0 from any to 127.0.0.0/8

　　block out log body quick on ppp0 from any to 0.0.0.0/8

　　block out log body quick on ppp0 from any to 169.254.0.0/16

　　block out log body quick on ppp0 from any to 192.0.2.0/24

　　block out log body quick on ppp0 from any to 204.152.64.0/23

　　block out log body quick on ppp0 from any to 224.0.0.0/3

　　# The pass rules to enable Services

　　pass in on ppp0 proto tcp from any to any port = 20 flags S keep state

　　pass in on ppp0 proto tcp from any to any port = 21 flags S keep state

　　pass in on ppp0 proto tcp from any to any port = 22 flags S keep state

　　pass in on ppp0 proto tcp from any to any port = 25 flags S keep state

　　pass in on ppp0 proto tcp from any to any port = 80 flags S keep state

　　pass in on ppp0 proto tcp from any to any port = 110 flags S keep state

　　pass in on ppp0 proto tcp from any to any port = 443 flags S keep state

　　pass in on ppp0 proto tcp from any to any port 55000 >;< 56000 flags S keep state

　　# The general pass rules.

　　pass out quick on ppp0 proto tcp from any to any flags S/SAFR keep state keep frags

　　pass out quick on ppp0 proto udp from any to any keep state keep frags

　　pass out quick on ppp0 proto icmp from any to any keep state keep frags

　　=================================/etc/ipf.conf==============================

　　# vi /etc/sysctl.conf

　　net.inet.ip.forwarding=1

　　net.inet.tcp.mss_ifmtu=1

　　# vi /etc/ipnat.conf

　　map ppp0 192.168.0.0/24 ->; 0/32 proxy port ftp ftp/tcp mssclamp 1440

　　map ppp0 192.168.0.0/24 ->; 0/32 portmap tcp/udp auto mssclamp 1440

　　map ppp0 192.168.0.0/24 ->; 0/32 mssclamp 1440

　　啟用防火牆設定:

　　# vi /etc/defaults/rc.conf

　　ipfilter=YES　　　　　　　　　　　　　　　　　　　　　　　　　　　　# uses /etc/ipf.conf

　　ipnat=YES　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　# uses /etc/ipnat.conf

　　ipfs=YES　　　　　　　　ipfs_flags=""　　　　　　　　# save/load ipnat and ipf states

　　ifwatchd=YES

　　配置動態域名更新：

　　# wget

　　# tar zxvf ez-ipupdate-3.0.10.tgz

　　# cd ez-ipupdate-3.0.10

　　# vi conf_file.c

　　增加一行：

　　#include ;

　　# vi ez-ipupdate.c

　　註釋掉下面幾行(4515行)：

　　//else

　　//　{

　　//　 fprintf(stderr, "no update needed at this time ";

　　//　}

　　# ./configure

　　# make

　　# make install

　　設定撥號後自動執行：

　　# vi /etc/ppp/ip-up

　　#!/bin/sh

　　/usr/local/bin/ez-ipupdate -i ppp0 -h nero.3322.org -S qdns -u llzqq:9335333

　　# chmod 700 /etc/ppp/ip-up