Software, Support, Documentation
|
|
News,
Internal,
Projects,
Home Software, Support, Documentation |
On Fri, Feb 02, 2001 at 12:20:42AM +0000, Kwangyul SEO wrote:
> 안녕하세요.
>
> 제가 알기로 ipfilter는 ipfw와는 다르게 마지막 rule을
> 적용하는 걸로 알고 있습니다. 즉 위에서 allow를 하더라도
> 마지막 rule이 deny라면 패킷을 deny하게 되는거죠.
>
> 혹시 마지막 rule이 deny로 설정되어 있지는 않은지요?
> ipfw와 같이 rule이 나오는 순서대로 패킷에 적용하려면
> quick이라는 옵션을 주어야 합니다.
>
> 자세한 사항은 http://www.obfuscation.org/ipf/을 참고하시면
> 좋겠네요.
음.. 지금 한통 ADSL로 접속해서 사용하는데요. 하우투는 전에 봤는데.. -_-;
이상하게 잘 적용이 안되는거 같습니다.
/etc/ipf.rules
# $OpenBSD: ipf.rules,v 1.6 1997/11/04 08:39:32 deraadt Exp $
#
# IP filtering rules. See the ipf(5) man page for more
# information on the format of this file, and /usr/share/ipf
# for example configuration files.
#
# Pass all packets by default.
# edit the ipfilter= line in /etc/rc.conf to enable IP filtering
#
pass in from any to any
pass out from any to any
위에 모든 패킷은 통과라고 되어있는데..
pass in quick on tun0 from any to any port = 21
pass in quick on tun0 from any to any port = 22
pass in quick on tun0 from any to any port = 80
pass in quick on tun0 from any to any port = 443
이렇게 넣어주고 해봐도 안되는군요.
root:184# ipfstat
input packets: blocked 0 passed 522568 nomatch 3 counted 0 short 0
output packets: blocked 0 passed 203708 nomatch 1 counted 0 short 0
input packets logged: blocked 0 passed 0
output packets logged: blocked 0 passed 0
packets logged: input 0 output 0
log failures: input 0 output 0
fragment state(in): kept 0 lost 0
fragment state(out): kept 0 lost 0
packet state(in): kept 0 lost 0
packet state(out): kept 0 lost 0
ICMP replies: 0 TCP RSTs sent: 0
Result cache hits(in): 403968 (out): 195912
IN Pullups succeeded: 0 failed: 0
OUT Pullups succeeded: 76 failed: 0
Fastroute successes: 0 failures: 0
TCP cksum fails(in): 0 (out): 0
Packet log flags set: (0)
none
root:185# ipfstat -s
IP states added:
0 TCP
0 UDP
0 ICMP
0 hits
726276 misses
0 maximum
0 no memory
buckets in use 0
0 active
0 expired
0 closed
root:196# man ipfstat | head -4
IPFSTAT(8) OpenBSD System Manager's Manual IPFSTAT(8)
NAME
ipfstat - reports on packet filter statistics and filter lists
...
-s Show packet/flow state information (statistics) and held state
information (in the kernel) if any is present.
root:189# ipftest
no rule file present
root:189# man ipftest | head -4
IPFTEST(1) OpenBSD Reference Manual IPFTEST(1)
NAME
ipftest - test packet filter rules with arbitrary input
로컬에서 접속은 물론 잘됩니다. ftp, httpd, sshd,....
> On Fri, Feb 02, 2001 at 05:42:00AM +0900, KIM sungjin wrote:
> > 음... OpenBSD 사용하시는분도 계실것 같아 그냥 질문 올립니다. -_-;
> >
> > FreeBSD는 커널이나 rc.XXX 설정으로 불벽을 조절할 수 있는데 OpenBSD는
> > 잘 되질 않는군요. OpenBSD는 ipf로 ipfiltering 하는데 /etc/ipf.rules에
> > 기본으로 허용하게 해놓았는데도 다른 시스템에서 접속이 거부되는군요.
> >
> > 기본으로 접속허용하는 옵션이 있는지 아시는분 가르쳐 주십시요.
--
To Unsubscribe: send mail to majordomo@kr.FreeBSD.org
with "unsubscribe questions" in the BODY of the message
|
Copyright © 1998-2005 Korea FreeBSD Users Group. All rights reserved. webmaster at kr.FreeBSD.org $Date: 2002/03/26 13:31:20 $ |
|