OpenBSD builds a firewall-general Linux technology-Linux technology and application information. The following is a detailed description. According to the Function Description and enterprise requirements of the project, a network plan for the project is developed. The detailed description is as follows:
1. Create an independent subnet for each department based on the number of PCs in each department in the function description:
Office (100 units ):
General Manager's office: 192.168.2.0/24
General Office: 192.168.3.0/24
Marketing Department (800 sets): 172.16.0.0/16
Finance Department (80): 192.168.4.0/24
Production Department (500 units): 172.17.0.0/16
Information Department (20): 192.168.5.0/24
Public Network Server: 192.168.6.0/24
Internal Server: 192.168.7.0/24
Public network server address: 192.168.6.2/24
Intranet server address: 192.168.7.2/24
2. Nic settings:
(1) Internal Nic
Because the subnets in the Intranet belong to different segments, to reduce enterprise costs, this project uses dual-port routers and multiple ip addresses for a single Nic. The internal Nic is defined as follows:
Inet 192. 168 .. 3.1 255.255.255.0 NONE
Inet alias 192.168.4.1 255.255.255.0 NONE
Inet alias 192.168.5.1 255.255.255.0 NONE
Inet alias 192.168.6.1 255.255.255.0 NONE
Inet alias 192.168.7.1 255.255.255.0 NONE
Inet alias 192.168.2.1 255.255.255.0 NONE
Inet alias 172.16.1.0 255.255.0.0 NONE
Inet alias 172.17.1.0 255.255.255.0.0 NONE
Inet alias 192.168.6.1 255.255.255.0 NONE
Inet alias 192.168.7.1 255.255.255.0 NONE
(2) external network card
Set the following information on the external network card based on the data provided by the ISP:
Inet 202.97.11.2 255.255.255.255.240 NONE
Inet alias 202.97.11.3 invalid employee quota 240 NONE
Inet alias 202.97.11.20.5.20.0000240 NONE
Inet alias 202.97.11.5 invalid employee quota 240 NONE
Inet alias 202.97.11.6 255.255.255.240 NONE
Inet alias 202.97.11.7 invalid timeout 240 NONE
Inet alias 202.97.11.8 255.255.255.255.240 NONE
Inet alias 202.97.11.9 255.255.255.255.240 NONE
Inet alias 202.97.11.10 255.255.255.255.240 NONE
Inet alias 202.97.11.11 255.255.255.255.240 NONE
And write DNS information in resolv. conf:
Nameserver 202.97.240.68
Write the gateway information in rc. local:
/Sbin/route add 0.0.0.0/202.97.11.1
3. To enable all machines in the marketing department and IT information department to access the Internet and access rules between departments, define subnets in pf. conf:
Table {192.168.2.0/24}
Table {192.168.2.2/32,192.168 .2.3/32,192.168 .2.4/32}
Table {172.16.0.0/16}
Table {127.17.0.0/16}
Table {172.16.0.2/32,172.16 .0.3/32,172.16 .0.4/32}
Table {192.168.4.0/24}
Table {192.168.4.2/32,192.168 .4.3/32,192.168 .4.4/32}
Table {192.168.3.0/24}
Table {192.168.3.0/24}
Table {192.168.3.2/32,192.168 .3.3/32,192.168 .3.4/32}
Table {192.168.6.0/24}
Table {192.168.7.0/24}
Table {0.0.0.0/0 ,! 10.0.0.0/8 ,! 172.16.0.0./16 ,! 172.17.0.0/16 ,! 192.168.0.0/24}
4. Use nat translation to enable company staff to access the internet as needed:
Nat on $ ext_if inet from ?> $ Ext_if
Nat on $ ext_if inet from ?> $ Ext_if
Nat on $ ext_if inet from <zjlbgs_inet >?> $ Ext_if
Nat on $ ext_if inet from ?> $ Ext_if
Nat on $ ext_if inet from ?> $ Ext_if
Nat on $ ext_if inet from ?> $ Ext_if
5. Use rdr to access the company's public network services over the Internet
Rdr pass on $ ext_if proto tcp from any to port 21?> 192.168.6.2
Rdr pass on $ ext_if proto tcp from any to port 80?> 192.168.6.2
6. nat translation is used to meet the needs of various departments to access the External Internet:
7. Define a firewall based on inter-department access rules:
Block in
Block out
Pass in quick on $ ext_if all
Pass out quick on $ ext_if all
General Manager's office: zjlbgs rule
Pass out quick on $ int_if from To any
Pass in quick on $ int_if from To any
Pass out quick on $ ext_if from <zjlbgs_inet>
General Office: zhbgs rule
Pass out quick on $ int_if from To 192.168.7.2
Pass in quick on $ int_if from To 192.168.7.2
Pass in quick on $ int_if from <zjlbgs_inet>
Pass out quick on $ ext_if from <zjlbgs_inet>
Production Department: scb rule
Pass out quick on $ int_if from To 192.168.7.2
Pass in quick on $ int_if from To 192.168.7.2
Pass in quick on $ int_if from <scb_inet>
Pass out quick on $ ext_if from <scb_inet>
Finance Department: cwb rule
Pass out quick on $ int_if from To 192.168.7.2
Pass in quick on $ int_if from To 192.168.7.2
Pass in quick on $ int_if from <cwb_inet>
Pass out quick on $ ext_if from <cwb_inet>
Marketing Department: yxb rule
Pass out quick on $ int_if from To 192.168.7.2
Pass in quick on $ int_if from To 192.168.7.2
Pass in quick on $ int_if from <private_yxb>
Pass out quick on $ ext_if from <private_yxb>
Information Department: xxb rule
Pass out quick on $ int_if from To 192.168.7.2
Pass in quick on $ int_if from <private_xxb> to 192.168.7.2
Pass in quick on $ int_if from <private_xxb>
Pass out quick on $ ext_if from <private_xxb>
