FreeBSD + gateway + Ipfilter Configuration

FreeBSD + gateway + Ipfilter configuration-Linux Enterprise Application-Linux server application information. For more information, see the following. Recently, the FreeBSD6.0 Gateway (with fire prevention) is configured. The configuration file is posted below:

Dual-nic rl0 & rl1
Rl0: used for ADSL dialing; rl1 is used for Intranet networks; Address: 192.168.1.1

CODE: [linyin @ linyin ~] $ More/etc/rc. conf # -- Sysinstall generated deltas -- # Wed May 3 01:52:57 2006 # Created: Wed May 3 01:52:57 2006 # Enable network daemons for user convenience. # Please make all changes to this file, not to/etc/defaults/rc. conf. # This file now contains just the overrides from/etc/defaults/rc. conf. # -- Sysinstall generated deltas -- # Wed May 3 09:56:21 2006 # Hostname Ifconfig_rl1 = "inet 192.168.1.1 netmask 255.255.255.0" Defaultrouter = "192.168.1.1" Hostname = "linyin.8800.org" # Service Sshd_enable = "YES" Apache_enable = "YES" Gateway_enable = "YES" Inetd_enable = "YES" Sendmail_enable = "NONE" Sendmail_submit_enable = "NO" Sendmail_outbound_enable = "NO" Sendmail_msp_queue_enable = "NO" /Usr/local/bin/ez-ipupdate-c/root/dns. conf /Usr/local/nessus/sbin/nessusd-D # ADSL Ppp_enable = "YES" Ppp_mode = "ddial" Ppp_profile = "linyin" # Security Ipfilter_enable = "YES" Ipfilter_rules = "/etc/ipf. conf" Ipnat_enable = "YES" Ipnat_rules = "/etc/ipnat. conf" 　 [Linyin @ linyin ~] $ More/etc/ipf. conf Block in all Block out all Block in log quick on tun0 proto icmp from any to any Block in log quick all with short Block in log quick all with ipopts Block in log quick all with frag Block in log quick all with opt lsrr Block in log quick all with opt ssrr Pass out quick on lo0 Pass in quick on lo0 Pass out quick on rl1 Pass in quick on rl1 Block in log body quick on tun0 from 192.168.0.0/16 to any Block in log body quick on tun0 from 172.16.0.0/12 to any Block in log body quick on tun0 from 10.0.0.0/8 to any Block in log body quick on tun0 from 192.0.2.0/24 to any Block in log body quick on tun0 from 0.0.0.0/8 to any Block in log body quick on tun0 from 127.0.0.0/8 to any Block in log body quick on tun0 from 169.254.0.0/16 to any Block in log body quick on tun0 from 224.0.0.0/3 to any Block in log body quick on tun0 from 204.152.64.0/23 to any Block out log body quick on tun0 from any to 192.168.0.0/16 Block out log body quick on tun0 from any to 172.16.0.0/12 Block out log body quick on tun0 from any to 10.0.0.0/8 Block out log body quick on tun0 from any to 127.0.0.0/8 Block out log body quick on tun0 from any to 0.0.0.0/8 Block out log body quick on tun0 from any to 169.254.0.0/16 Block out log body quick on tun0 from any to 192.0.2.0/24 Block out log body quick on tun0 from any to 204.152.64.0/23 Block out log body quick on tun0 from any to 224.0.0.0/3 Pass in on tun0 proto tcp from any to any port = 20 flags S keep state Pass in on tun0 proto tcp from any to any port = 21 flags S keep state Pass in on tun0 proto tcp from any to any port = 22 flags S keep state Pass in on tun0 proto tcp from any to any port = 80 flags S keep state Pass in on tun0 proto tcp from any to any port = 1241 flags S keep state Pass in on tun0 proto tcp from any to any port = 3389 flags S keep state Pass in on tun0 proto tcp from any to any port = 8080 flags S keep state Pass out quick on tun0 proto tcp from any to any flags S/SAFR keep state keep frags Pass out quick on tun0 proto udp from any to any keep state keep frags Pass out quick on tun0 proto icmp from any to any keep state keep frags [Linyin @ linyin ~] $ More/etc/ipnat. conf Map tun0 192.168.1.0/24-& gt; 0/32 proxy port ftp/tcp Map tun0 192.168.1.0/24-> 0/32 portmap tcp/udp auto Map tun0 192.168.1.0/24-> 0/32 Rdr tun0 0/0 port 3389-> 192.168.1.5 port 3389 tcp Rdr tun0 0/0 port 8080-> 192.168.1.10 port 8080 tcp