|
|
| 行23: |
行23: |
| | * [[ipfw DNS問い合わせを許可する]] | | * [[ipfw DNS問い合わせを許可する]] |
| | * [[ipfw NTPを許可する]] | | * [[ipfw NTPを許可する]] |
| − |
| |
| − | == カーネルオプション ==
| |
| − |
| |
| − | <syntaxhighlight lang="bash">
| |
| − | options IPFIREWALL
| |
| − |
| |
| − | # This option enables IPFW as part of the kernel.
| |
| − | options IPFIREWALL_VERBOSE
| |
| − |
| |
| − | #This option enables logging of packets that pass through IPFW and have the log keyword specified in the ruleset.
| |
| − | options IPFIREWALL_VERBOSE_LIMIT=5
| |
| − |
| |
| − | #This option limits the number of packets logged through syslogd(8), on a per-entry basis. This option may be used in hostile environments, when firewall activity logging is desired. This will close a possible denial of service attack via syslog flooding.
| |
| − | options IPFIREWALL_DEFAULT_TO_ACCEPT
| |
| − |
| |
| − | # This option allows everything to pass through the firewall by default, which is a good idea when the firewall is being set up for the first time.
| |
| − | options IPDIVERT
| |
| − | </syntaxhighlight>
| |
| − |
| |
| − | == /etc/rc.conf のオプション ==
| |
| − |
| |
| − | <syntaxhighlight lang="bash">
| |
| − | firewall_enable="YES"
| |
| − |
| |
| − | # To select one of the default firewall types provided by FreeBSD, select one by reading /etc/rc.firewall and specify it in the following:
| |
| − | firewall_type="open"
| |
| − |
| |
| − | # Enabled logging
| |
| − | firewall_logging="YES"
| |
| − | </syntaxhighlight>
| |
| − |
| |
| − |
| |
| − | * open: すべてのトラフィックをパスします。
| |
| − | * client: protects only this machine.
| |
| − | * simple: protects the whole network.
| |
| − | * closed: entirely disables IP traffic except for the loopback interface.
| |
| − | * UNKNOWN: disables the loading of firewall rules.
| |
| − | * filename: absolute path of the file containing the firewall rules.
| |
| − |
| |
| − | == カーネルモジュール ==
| |
| − |
| |
| − | [[カーネルモジュール]] [[ipfw]] をロードします。
| |
| − | <syntaxhighlight lang="bash">
| |
| − | sudo kldload ipfw
| |
| − | </syntaxhighlight>
| |
| − |
| |
| − | [[カーネルモジュール]] [[ipfw]] をアンロードします。
| |
| − | <syntaxhighlight lang="bash">
| |
| − | sudo kldunload ipfw
| |
| − | </syntaxhighlight>
| |
| − |
| |
| − | == 設定ファイル /etc/rc.firewall ==
| |
| − |
| |
| − |
| |
| | | | |
| | == 使い方 == | | == 使い方 == |
| − | <syntaxhighlight lang="bash">
| |
| − | % ipfw -h
| |
| − | ipfw syntax summary (but please do read the ipfw(8) manpage):
| |
| − |
| |
| − | ipfw [-abcdefhnNqStTv] <command>
| |
| − |
| |
| − | where <command> is one of the following:
| |
| − |
| |
| − | add [num] [set N] [prob x] RULE-BODY
| |
| − | {pipe|queue} N config PIPE-BODY
| |
| − | [pipe|queue] {zero|delete|show} [N{,N}]
| |
| − | nat N config {ip IPADDR|if IFNAME|log|deny_in|same_ports|unreg_only|reset|
| |
| − | reverse|proxy_only|redirect_addr linkspec|
| |
| − | redirect_port linkspec|redirect_proto linkspec}
| |
| − | set [disable N... enable N...] | move [rule] X to Y | swap X Y | show
| |
| − | set N {show|list|zero|resetlog|delete} [N{,N}] | flush
| |
| − | table N {add ip[/bits] [value] | delete ip[/bits] | flush | list}
| |
| − | table all {flush | list}
| |
| − |
| |
| − | RULE-BODY: check-state [PARAMS] | ACTION [PARAMS] ADDR [OPTION_LIST]
| |
| − | ACTION: check-state | allow | count | deny | unreach{,6} CODE |
| |
| − | skipto N | {divert|tee} PORT | forward ADDR |
| |
| − | pipe N | queue N | nat N | setfib FIB | reass
| |
| − | PARAMS: [log [logamount LOGLIMIT]] [altq QUEUE_NAME]
| |
| − | ADDR: [ MAC dst src ether_type ]
| |
| − | [ ip from IPADDR [ PORT ] to IPADDR [ PORTLIST ] ]
| |
| − | [ ipv6|ip6 from IP6ADDR [ PORT ] to IP6ADDR [ PORTLIST ] ]
| |
| − | IPADDR: [not] { any | me | ip/bits{x,y,z} | table(t[,v]) | IPLIST }
| |
| − | IP6ADDR: [not] { any | me | me6 | ip6/bits | IP6LIST }
| |
| − | IP6LIST: { ip6 | ip6/bits }[,IP6LIST]
| |
| − | IPLIST: { ip | ip/bits | ip:mask }[,IPLIST]
| |
| − | OPTION_LIST: OPTION [OPTION_LIST]
| |
| − | OPTION: bridged | diverted | diverted-loopback | diverted-output |
| |
| − | {dst-ip|src-ip} IPADDR | {dst-ip6|src-ip6|dst-ipv6|src-ipv6} IP6ADDR |
| |
| − | {dst-port|src-port} LIST |
| |
| − | estab | frag | {gid|uid} N | icmptypes LIST | in | out | ipid LIST |
| |
| − | iplen LIST | ipoptions SPEC | ipprecedence | ipsec | iptos SPEC |
| |
| − | ipttl LIST | ipversion VER | keep-state | layer2 | limit ... |
| |
| − | icmp6types LIST | ext6hdr LIST | flow-id N[,N] | fib FIB |
| |
| − | mac ... | mac-type LIST | proto LIST | {recv|xmit|via} {IF|IPADDR} |
| |
| − | setup | {tcpack|tcpseq|tcpwin} NN | tcpflags SPEC | tcpoptions SPEC |
| |
| − | tcpdatalen LIST | verrevpath | versrcreach | antispoof
| |
| − | </syntaxhighlight>
| |
| | | | |
| | デフォルトの状態は、下記の通りです。 | | デフォルトの状態は、下記の通りです。 |
# kldload ipfw
ipfw2 (+ipv6) initialized, divert loadable, nat loadable, default to deny, logging disabled
# ipfw list
65535 deny ip from any to any
# ipfw list
ipfw: getsockeopt(IP_FW_GET): Protocol not available
add check-state
add deny tcp from any to any established
add pass tcp from any to any 80 setup keep-state
add allow icmp from any to any
add allow pass tcp from any to me 80 setup
add allow udp from me to any 53 keep-state
add allow udp from me to any 123 keep-state