歡迎來到Linux教程網
Linux教程網
Linux教程網
Linux教程網
Linux教程網 >> Linux基礎 >> Linux教程 >> Linux教程:利用PF來實現多路由表

Linux教程:利用PF來實現多路由表

日期:2017/2/28 16:47:44   编辑:Linux教程

在FreeBSD7.1之前,要實現跟linux下的iproute2那樣的功能:從哪來的數據還從哪返回,可以用PF來實現,具體方法如下:
1:rc.conf裡面
設置兩個ip,一個默認路由(注意此處的默認路由僅僅相對於該機器對外訪問時的路由選擇)
2:pf.conf
tel_if = "em0" #
cnc_if = "em1" #
loop_if = "lo0"

gw_tel = "121.33.xx.xx"
gw_cnc = "210.21.yy.yy"

set optimization aggressive
#set timeout { interval 10, frag 30 }
set timeout { tcp.first 30, tcp.opening 5, tcp.established 1800 }
#set timeout { tcp.closing 60, tcp.finwait 30, tcp.closed 30 }
#set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
#set timeout { icmp.first 20, icmp.error 10 }
#set timeout { other.first 60, other.single 30, other.multiple 60 }
#set timeout { adaptive.start 0, adaptive.end 0 }


scrub in all


# Block IP on the $ext_if
block in quick on {$tel_if, $cnc_if} from <block_ip_always> to any
block all

pass quick on $loop_if all

#############################
# $tel_if
#############################
block in quick on $tel_if proto tcp all flags SF/SFRA
block in quick on $tel_if proto tcp all flags SFUP/SFRAU
block in quick on $tel_if proto tcp all flags FPU/SFRAUP
block in quick on $tel_if proto tcp all flags /SFRA
block in quick on $tel_if proto tcp all flags F/SFRA
block in quick on $tel_if proto tcp all flags U/SFRAU

# SSH,HTTP,SMTP,POP3,FTP
pass in quick on $tel_if proto tcp from $tel_if:network to any port {22,80,443,25,110,143} keep state
pass in quick on $tel_if proto tcp from $tel_if:network to any port {21,49152:65535} keep state

# Other
pass in quick on $tel_if reply-to ($tel_if $gw_tel) proto tcp from any to any port {22,25,110,143,80,443} keep state
pass in quick on $tel_if reply-to ($tel_if $gw_tel) proto tcp from any to any port {21,49152:65535} keep state
pass in quick on $tel_if reply-to ($tel_if $gw_tel) proto {tcp,udp} from any to any port 53 keep state
pass in quick on $tel_if reply-to ($tel_if $gw_tel) proto icmp from any to any icmp-type 8 code 0 keep state


pass out quick on $tel_if all keep state


############################
# $cnc_if
############################
block in quick on $cnc_if proto tcp all flags SF/SFRA
block in quick on $cnc_if proto tcp all flags SFUP/SFRAU
block in quick on $cnc_if proto tcp all flags FPU/SFRAUP
block in quick on $cnc_if proto tcp all flags /SFRA
block in quick on $cnc_if proto tcp all flags F/SFRA
block in quick on $cnc_if proto tcp all flags U/SFRAU

# Other
pass in quick on $cnc_if reply-to ($cnc_if $gw_cnc) proto tcp from any to any port {22,25,110,143,80,443} keep state
pass in quick on $cnc_if reply-to ($cnc_if $gw_cnc) proto tcp from any to any port {21,49152:65535} keep state
pass in quick on $cnc_if reply-to ($cnc_if $gw_cnc) proto {tcp,udp} from any to any port 53 keep state
pass in quick on $cnc_if reply-to ($cnc_if $gw_cnc) proto icmp from any to any icmp-type 8 code 0 keep state

pass out quick on $cnc_if all keep state

Copyright © Linux教程網 All Rights Reserved