FreeBSD ÀÇ pf ¿¡ °üÇؼ­ Áú¹® Çغ¾´Ï´Ù.

À¯»ç¿ë   
   Á¶È¸ 5717   Ãßõ 6    


Áö±Ý FR 6.1À» ¼³Ä¡ÈÄ pf + if_bridge ¸¦ ±¸¼ºÇß½À´Ï´Ù.

/etc/rc.conf ¿¡¼­ bridge0 ¿¡ °üÇÑ ³»¿ëÀÔ´Ï´Ù.
cloned_interfaces="bridge0"
ifconfig_bridge0="addm em0 addm em1 up"

ifconfig_em0="up"                 #  Turn the bridge NICs up
ifconfig_em1="up"                 #  Thanks to Bruce A. Mah <****@*******.org>

ifconfig ¿¡¼­ pf¿Í bridge ¿¡ °ü·ÃµÈ ³»¿ë ÀÔ´Ï´Ù.

pfsync0: flags=0<> mtu 2020
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33208
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
        inet 127.0.0.1 netmask 0xff000000
bridge0: flags=8143<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
        ether ac:de:48:15:aa:4c
        priority 32768 hellotime 2 fwddelay 15 maxage 20
        member: em1 flags=3<LEARNING,DISCOVER>
        member: em0 flags=3<LEARNING,DISCOVER>

bridge0 ´Â Àß ¿Ã¶ó ¿Ô½À´Ï´Ù.

/etc/pf.conf ¸¦ ±¸¼º ÁßÀε¥ À߾ȵ˴ϴÙ..

ext_if="bridge0"    # replace with actual external interface name i.e., bridge0
mgt_if="em2"        # replace with actual internal interface name i.e., em2

serverport="{ssh, http,  smtp, pop3, ftp, domain, 3389, 6881:6999,  60000:65534}"

set block-policy drop
set require-order yes
set fingerprints "/etc/pf.os"

# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all

# Loopback interface
pass  in  quick on lo0 all

# Filtering: the implicit first two rules are
block in all
pass out all

pass  in  quick on $mgt_if all
pass  out quick on $mgt_if all

# Block everything and log it
block log on $mgt_if all
block log on $ext_if all

pass  in  on $ext_if proto { tcp, udp } from any to $ext_if port $serverport keep state
pass  out on $ext_if proto { tcp, udp } all keep state

À§¿Í °°ÀÌ ¼³Á¤À» ÇÏ¿´Áö¸¸. µÇÁö ¾Ê½À´Ï´Ù.
block in all
pass out all
¾ÈµË´Ï´Ù.

pass in all
pass out all
Àº Àߵ˴ϴÙ.

ÇÏÁö¸¸, pf ´Â ´Ù¸·°í ³ª¼­ ÇÊ¿ä ÇÑ°ÍÀ» Çϳª¾¿ ¿©´Â °Å·Î ¾Ë°í ÀÖ½À´Ï´Ù.
serverport ´Â ÇÊ¿ä Çϸé.. ´õ ¸¹Àº port ¸¦ Ãß°¡ ÇÒ»ý°¢ÀÔ´Ï´Ù.

ext_if="bridge0"  ´Â em (intel lan) Ä«µå 2ÀåÀ» bridge ·Î ¹­Àº °ÍÀÔ´Ï´Ù.
mgt_if="em2" ´Â °ü¸®¸¦ À§ÇÑ ·£Ä«µå ÀÔ´Ï´Ù.
bridge0 ´Â non-IP ÀÔ´Ï´Ù.
em2´Â IP°¡ ÇÒ´ç µÇ¾îÀÖ½À´Ï´Ù.

µµ¿Í ÁÖ¼¼¿ä.. Èæ..Èæ..
ªÀº±Û Àϼö·Ï ½ÅÁßÇÏ°Ô.


QnA
Á¦¸ñPage 4697/5693
2015-12   1556617   ¹é¸Þ°¡
2014-05   5021289   Á¤ÀºÁØ1
2003-08   9180   Á¶±Ù»ó
2006-06   7668   ³²¼º·æ
2006-07   5127   ÀÌ⹬
2006-04   6160   ¹Ú±âµÎ
2004-01   8167   ¼Û»óº´
2005-09   5616   À±Ä¡¿­
2007-06   4793   ¹ÎÁ¤±â
2003-05   11949   ÀÌ°æȯ
2003-11   10212   ±èÈ¿¼ö
2007-10   5415   Á¤Ã¶¼ö
2005-07   5643   ¹ÚÂùÀÏ
2003-01   11167   ¹Ú°æ¼­
2006-05   5398   ¼­°æ¿­
2004-04   8343   ¹ÚÁ¾¼®
2008-01   5804   ÀÓ½ÃÇö
2008-02   6296   ±è°Ç¿ì
2005-09   5564   Á¶¿µ¹ü
2002-07   13710   Á¶¿øºó
2003-01   14037   ÀÌ°æÀÏ
2003-06   8851   ÀÌÇÑ¿ë