作者 sw0079 (极限操作) 看板 Linux
标题 [问题] pf.conf设定
时间 Thu Mar 20 13:07:10 2014
───────────────────────────────────────
大家好,小弟是Linux/OBSD的新手
最近上课在做的project
因为router是OBSD所以有些档案名称path会不一样
要问的问题是OBSD里面的/etc/pf.conf的一些rules
老师的要求是:
1. Windows subnet to storage subnet: NO access
2. Windows subnet to web server subnet: RESTRICTED access
Only SSL HTTP ports allowed
3. Web server subnet to storage subnet: RESTRICTED access
Only iSCSI ports allowed
小弟自己用小画家画了一个图形
http://tinypic.com/view.php?pic=fwqhxz&s=8#.Uyp0NPldUwA
OBSD router有1 external interface (em0) 2 internal interfaces (em1 & em2)
Windows subnet >> em1
www server >> em2
storage server >> 从主要的router连接到OBSD router
小弟自己弄出来的pf rules是
ext_if = "em0"
int_if = "em1"
int_if2 = "em2"
www_server = "192.168.32.130"
web_ports = "{ https, iscsi }"
tcp_services = "{ ssh, domain }"
udp_services = "{ router, domain }"
set skip on lo
block in
pass in on $int_if from $int_if:network
pass in on $int_if2 from $int_if2:network
pass in inet proto icmp
block from $int_if:network to $int_if2:network
pass in on $ext_if inet proto tcp to $ext_if port $tcp_services
pass in on $ext_if inet proto udp to $ext_if port $udp_services
pass in on $ext_if inet proto tcp to $www_server port $web_ports
pass in on $int_if inet proto tcp from $int_if:network to $www_server port
https
block from $int_if:network to 10.12.0.0/16
pass out
今天老师检查后说这个configuration很奇怪
因为
pass in on $int_if from $int_if:network
pass in on $int_if2 from $int_if2:network
这两个其实很多余
还有pass in on $int_if inet proto tcp from $int_if:network to $www_server
port https
这个也是很怪异
但是老师测试了一下后说 因为有达到要求所以过了(测试方式用ping还有看我们的网页是
否只能显示https)
重点: 如果是各位大大 会怎么写呢?
不好意思写很多 感谢您的指点