科技行者

行者学院 转型私董会 科技行者专题报道 网红大战科技行者

知识库

知识库 安全导航

至顶网网络频道在NETBSD上配置ADSL+IPF+IPNAT

在NETBSD上配置ADSL+IPF+IPNAT

  • 扫一扫
    分享文章到微信

  • 扫一扫
    关注官方公众号
    至顶头条

作者:巧巧读书 来源:巧巧读书 2008年5月29日

关键字: ADSL ADSL应用

  • 评论
  • 分享微博
  • 分享邮件

  OS: 2.x

  配置网卡的IP地址:

  # vi /etc/ifconfig.rtk0

  inet 192.168.0.1 netmask 255.255.255.0

  # vi /etc/ifconfig.tlp0

  inet 192.168.1.2 netmask 255.255.255.0

  配置主机名:

  # vi /etc/myname

  netbsd

  # vi /etc/hosts

  127.0.0.1    localhost    netbsd

  配置DNS解析:

  # vi /etc/resolv.conf

  nameserver 202.99.160.68

  nameserver 202.99.168.8

  配置网关:

  # vi /etc/mygate

  192.168.0.10

  配置主机本地解析:

  # vi /etc/hosts

  192.168.0.10    win2k

  配置SSHD服务:

  # vi /etc/defaults/rc.conf

  sshd=YES

  # vi /etc/ssh/sshd_config

  PermitRootLogin yes

  安装配置ADSL:

  # pkg_add rp-pppoe-3.5.tgz

  # mkdir /etc/ppp

  # cp /usr/pkg/share/examples/rp-pppoe/pppoe.conf /etc/ppp/pppoe.conf

  # adsl-start

  配置防火墙代理上网:

  # vi /etc/ipf.conf

  =================================/etc/ipf.conf==============================

  # +-----------+  +------------------------------+  +------------------+

  # | ADSL-Modem|---| ppp0 tlp0 NAT+IPF  rtk0 |---| Internal Network |

  # +-----------+  +------------------------------+  +------------------+

  #

  # +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  # Interface: all

  # Block all incoming and outgoing packets unless they're allowed later.

  # +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  block in all

  block out all

  # Possibly dangerous: packets with ip-options, short and fragmented packets

  block in log quick on ppp0 proto icmp from any to any

  block in log quick all with short

  block in log quick all with ipopts

  block in log quick all with frag

  block in log quick all with opt lsrr

  block in log quick all with opt ssrr

  # Local network traffic is allowed

  pass out quick on lo0

  pass in quick on lo0

  pass out quick on rtk0

  # Block faked or unlikely "local" addresses

  block in log body quick on ppp0 from 192.168.0.0/16 to any

  block in log body quick on ppp0 from 172.16.0.0/12 to any

  block in log body quick on ppp0 from 10.0.0.0/8 to any

  block in log body quick on ppp0 from 192.0.2.0/24 to any

  block in log body quick on ppp0 from 0.0.0.0/8 to any

  block in log body quick on ppp0 from 127.0.0.0/8 to any

  block in log body quick on ppp0 from 169.254.0.0/16 to any

  block in log body quick on ppp0 from 224.0.0.0/3 to any

  block in log body quick on ppp0 from 204.152.64.0/23 to any

  # Blocking of outgoing faked or unlikely "internal" addresses

  block out log body quick on ppp0 from any to 192.168.0.0/16

  block out log body quick on ppp0 from any to 172.16.0.0/12

  block out log body quick on ppp0 from any to 10.0.0.0/8

  block out log body quick on ppp0 from any to 127.0.0.0/8

  block out log body quick on ppp0 from any to 0.0.0.0/8

  block out log body quick on ppp0 from any to 169.254.0.0/16

  block out log body quick on ppp0 from any to 192.0.2.0/24

  block out log body quick on ppp0 from any to 204.152.64.0/23

  block out log body quick on ppp0 from any to 224.0.0.0/3

  # The pass rules to enable Services

  pass in on ppp0 proto tcp from any to any port = 20 flags S keep state

  pass in on ppp0 proto tcp from any to any port = 21 flags S keep state

  pass in on ppp0 proto tcp from any to any port = 22 flags S keep state

  pass in on ppp0 proto tcp from any to any port = 25 flags S keep state

  pass in on ppp0 proto tcp from any to any port = 80 flags S keep state

  pass in on ppp0 proto tcp from any to any port = 110 flags S keep state

  pass in on ppp0 proto tcp from any to any port = 443 flags S keep state

  pass in on ppp0 proto tcp from any to any port 55000 >;<56000 flags S keep state

  # The general pass rules.

  # tar zxvf ez-ipupdate-3.0.10.tgz

  # cd ez-ipupdate-3.0.10

  # vi conf_file.c

  增加一行:

  #include <errno.h>;

  # vi ez-ipupdate.c

  注释掉下面几行(4515行):

  //else

  // {

  //  fprintf(stderr, "no update needed at this time\n";

  // }

  # ./configure

  # make

  # make install

  设置拨号后自动运行:

  # vi /etc/ppp/ip-up

  #!/bin/sh

  /usr/local/bin/ez-ipupdate -i ppp0 -h nero.3322.org -S qdns -u llzqq:9335333

  # chmod 700 /etc/ppp/ip-up

    • 评论
    • 分享微博
    • 分享邮件
    邮件订阅

    如果您非常迫切的想了解IT领域最新产品与技术信息,那么订阅至顶网技术邮件将是您的最佳途径之一。

    重磅专题
    往期文章
    最新文章