FreeBDS之ipf防火墙

FreeBSD使用手册
https://www.freebsd.org/doc/zh_CN/books/handbook/index.html https://www.freebsd.org/doc/zh_CN/books/handbook/firewalls-ipf.html #Freebsd_IPF防火墙
root@BSD:~ # bsdconfig
root@BSD:~ # bsdinstall
root@BSD:~ # ee /etc/ssh/sshd_config #开启root用户密码登陆
PermitRootLogin yes
PasswordAuthentication yes
root@BSD:~ # service sshd restart
root@BSD:~ # pkg install vim-lite #安装vim也可使用默认的ee编辑器
安装完vim-lite后配置下，输入下面的命令，让其有语法检查及颜色显示等功能
echo “syntax on”>>/root/.vimrc
echo “alias vi vim” >>/root/.cshrc
root@BSD:/etc # pkg install lrzsz #安装完后上传命令变为lrz，下载命令变为lsz

FreeBSD上配置路由协议(支持RIP，OSPF，BGP配置方法同思科路由器的配置方法)
root@BSD:~ # pkg install quagga
root@BSD:/usr/local/share/examples/quagga # ls #要启动路由协议需要把以下相对应的路由协议配置文件放到配置文件目录，否则无法启动路由协议
bgpd.conf.sample ospfd.conf.sample vtysh.conf.sample
bgpd.conf.sample2 pimd.conf.sample zebra.conf.sample
isisd.conf.sample ripd.conf.sample
ospf6d.conf.sample ripngd.conf.sample

root@BSD:/usr/local/etc/quagga # ls #配置文件路径
ospfd.conf vtysh.conf zebra.conf

root@BSD:/usr/local/sbin # ls #启动命令路径
bgpd ospfclient pkg ripd zebra
isisd ospfd pkg-static ripngd
ospf6d pimd pkg2ng watchquagga

root@BSD:~ # cat /etc/services #服务对应的端口号(在本机telnet 127.0.0.1 2604进入OSPF)
zebrasrv 2600/tcp #zebra service
zebra 2601/tcp #zebra vty
ripd 2602/tcp #RIPd vty
ripngd 2603/tcp #RIPngd vty
ospfd 2604/tcp #OSPFd vty
bgpd 2605/tcp #BGPd vty
ospf6d 2606/tcp #OSPF6d vty

root@BSD:~ # zebra & #(后台运行)先启动，再启动其它路由进程
root@BSD:~ # netstat -an #查看启动的端口号
root@BSD:~ # netstat -nr #查看路由表
路由的属性标志和它们的含义简表：
U Up: 路由处于活动状态
H Host: 路由目标是单个主机
G Gateway: 所有发到目的地的网络传到这一远程系统上， 并由它决定最后发到哪里
S Static: 这个路由是手工配置的，不是由系统自动生成的
C Clone: 生成一个新的路由， 通过这个路由我们可以连接上这些机子。 这种类型的路由通常用于本地网络
W WasCloned: 指明一个路由——它是基于本地区域网络 (克隆) 路由自动配置的
L Link: 路由涉及到了以太网硬件

IPF防火墙配置
root@BSD:~ # vim /etc/sysctl.conf #开启IP转发
# $FreeBSD: releng/11.0/etc/sysctl.conf 112200 2003-03-13 18:43:50Z mux $
# This file is read when going to multi-user and its contents piped thru
# ``sysctl'' to adjust kernel values. ``man 5 sysctl.conf'' for details.
net.inet.ip.forwarding=1
net.inet.tcp.strict_rfc1948=1
net.inet.ip.check_interface=1
net.inet.tcp.recvspace=65535
net.inet.tcp.sendspace=65535
# Uncomment this to prevent users from seeing information about processes that
# are being run under another UID.
#security.bsd.see_other_uids=0
root@FreeBSD:/usr/src/sys/amd64/conf # vi GENERIC #内核中开启ipfilter(一般不需要)
options IPFILTER
options IPFILTER_LOG

编辑rc.conf文件
root@BSD:~ # ee /etc/rc.conf
hostname="FreeBSD"
zabbix_agentd_enable="YES"
ipfilter_enable="YES" #打开ipfilter
ipfilter_rules="/etc/ipf.rules" #ipfilter规则文件绝对路径
gateway_enable="YES" #作为网关使用，并开启路由功能
ipnat_enable="YES" #打开nat转发
ipnat_rules="/etc/ipnat.rules" #nat规则文件绝对路径
defaultrouter="192.168.224.254" #配置默认路由
static_routes="net1 net2" #配置静态路由重启不丢失
route_net1="-net 172.10.0.0/22 10.10.100.201"
route_net2="-net 172.11.0.0/22 10.10.100.202"
inetd_enable=yes
inetd_flags=-wW
ipmon_enable="YES" #记录防火墙的信息
ipmon_flags="-Dsn /var/log/ipf.log" #需要手动创建ipf.log文件
-D: ipmon作为守护者程序(daemon)加载；
-s: 将包的信息送到syslogd而不是保存成文件；
-n: 可能的情况下将IP地址和端口号映射成主机名和服务名
root@BSD:~ # sh /etc/rc #更改rc.conf文件时不重启系统立即生效的方法
root@BSD:~ # tail -3 /etc/syslog.conf #开启防火墙策略日志记录需要在这个文件下创建以下记录
*.* /var/log/ppp.log
!*
local0.* /var/log/ipf.log #策略中需加log参数

ipf策略配置示例
root@BSD:~ # cat /etc/ipf.rules 
###No restrictions on Loopback Interface(用于BSD内部通信，默认为允许访问)
pass in quick on lo0 all
pass out quick on lo0 all
###pass IPF ping，block ping IPF (当em0 out方向有block策略时使用)
pass out quick on em0 proto icmp from 10.10.10.1/32 to any icmp-type 8 keep state
###pass access ipf
pass in quick on em0 proto tcp from 192.168.106.0/24 to 10.10.10.1 port = 22 flags S/SA keep state
###pass icmp through traffic on em0
pass in quick on em0 proto icmp from 10.10.10.0/24 to 10.10.20.0/24 keep state
###em0
pass in quick on em0 proto tcp from 10.10.10.2 to 10.10.20.2 port = 23 flags S/SA keep state
pass in quick on em0 proto tcp from 10.10.10.0/24 to 10.10.20.2 port = 443 flags S/SA keep state
pass in quick on em1 proto tcp from 10.10.20.2 port = 443 to 10.10.10.0/24 flags S/SA keep state
pass in quick on em0 proto udp from 10.10.10.2 to 10.10.20.2 port = 8000 keep state
###block all in and out traffic on em0
block in quick on em0 from any to any
block out quick on em0 from any to any #可不写
block in quick all #block forward流量
###Block a bunch of different nasty things
#That I do not want to see in the log
block in log quick all with short # Block short tcp packets
block in log quick all with ipopts # Block anything with special options
block in log quick all with frags # Block frags
block in log quick all with opt lsrr # block source routed packets
block in log quick all with opt ssrr # block source routed packets
root@BSD:~ # ipf -Fa -f /etc/ipf.rules #应用策略
root@BSD:~ # ipfstat -t #实时查看通过IPF的访问
root@BSD:~ # ipfstat -ih/oh #查看入向匹配（ih）或出向匹配（oh）
注：IPF防火墙不写block规则时默认为允许访问，ipf为状态化防火墙，去方向允许后回方向不需要再允许

root@BSD:~ # ifconfig em0 10.10.20.3 netmask 255.255.255.255 alias #添加同一子网IP时掩码必需为/32
root@BSD:~ # ifconfig em0 10.10.20.3 netmask 255.255.255.255 -alias #删除添加的IP地址
root@BSD:~ # ifconfig em0 10.10.30.3 netmask 255.255.255.0 alias #添加不同子网地址
root@BSD:~ # cat /etc/rc.conf
ifconfig_em0_alias0="inet 10.10.20.3 netmask 255.255.255.255"
root@BSD:~ # cat /etc/ipnat.rules
###snat(em0为对外接口)
map em0 from 10.10.10.2 to 10.10.20.2 -> 10.10.20.3
###dnat(端口映射，应用在接口的in方向)
root@BSD:/etc # ifconfig em2
inet 10.10.20.3 netmask 0xffffffff broadcast 10.10.20.3
inet 10.10.30.3 netmask 0xffffffff broadcast 10.10.30.255
rdr em0 10.10.20.3 port 23 -> 10.10.10.2 port 23 tcp
rdr em0 10.10.30.3 port 23 -> 10.10.10.2 port 23 tcp
root@BSD:~ # ipnat -CF -f /etc/ipnat.rules #应用NAT规则
注：当转换后的IP地址和接口IP不在同一段时对端需要增加相应网段的路由（如转换后无法访问请检查路由）入向转目的，出向转源
root@BSD:/etc # ifconfig em2
inet 10.10.20.1 netmask 0xffffff00 broadcast 10.10.20.255
inet 10.10.20.3 netmask 0xffffffff broadcast 10.10.20.3
inet 10.10.30.3 netmask 0xffffffff broadcast 10.10.30.255
root@BSD:/etc # vim ipnat.rules 目的和源同时转换(流量从em2到em1)
rdr em2 10.10.20.3 port 23 -> 10.10.10.2 port 23 tcp #只转换23端口的访问
rdr em2 10.10.20.3 -> 10.10.10.2 #所有的IP包都做转换

配置同时转换源和目的
map em1 from 10.10.20.2 to 10.10.10.2 -> 10.10.10.1
rdr em2 10.10.30.3 -> 10.10.10.2 #只有这条时表示只做目的转换
rdr做端口映射时，ipf策略开映射后的地址

解决rc.conf文件出错导致无法启动
1. # mount -a #将所有系统挂在档案上,只有这样你才能进行下一步，此时文件允许 write
2. #cd /etc #访问etc目录
3. # vi rc.conf #用VI修改出错的语句
4. # reboot #重新启动系统