FreeBSD ÀÇ pf ¿¡ °üÇØ¼­ Áú¹® ÇØº¾´Ï´Ù.

À¯»ç¿ë   
   Á¶È¸ 6029   Ãßõ 6    


Áö±Ý FR 6.1À» ¼³Ä¡ÈÄ pf + if_bridge ¸¦ ±¸¼ºÇß½À´Ï´Ù.

/etc/rc.conf ¿¡¼­ bridge0 ¿¡ °üÇÑ ³»¿ëÀÔ´Ï´Ù.
cloned_interfaces="bridge0"
ifconfig_bridge0="addm em0 addm em1 up"

ifconfig_em0="up"                 #  Turn the bridge NICs up
ifconfig_em1="up"                 #  Thanks to Bruce A. Mah <****@*******.org>

ifconfig ¿¡¼­ pf¿Í bridge ¿¡ °ü·ÃµÈ ³»¿ë ÀÔ´Ï´Ù.

pfsync0: flags=0<> mtu 2020
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33208
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
        inet 127.0.0.1 netmask 0xff000000
bridge0: flags=8143<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
        ether ac:de:48:15:aa:4c
        priority 32768 hellotime 2 fwddelay 15 maxage 20
        member: em1 flags=3<LEARNING,DISCOVER>
        member: em0 flags=3<LEARNING,DISCOVER>

bridge0 ´Â Àß ¿Ã¶ó ¿Ô½À´Ï´Ù.

/etc/pf.conf ¸¦ ±¸¼º ÁßÀε¥ À߾ȵ˴ϴÙ..

ext_if="bridge0"    # replace with actual external interface name i.e., bridge0
mgt_if="em2"        # replace with actual internal interface name i.e., em2

serverport="{ssh, http,  smtp, pop3, ftp, domain, 3389, 6881:6999,  60000:65534}"

set block-policy drop
set require-order yes
set fingerprints "/etc/pf.os"

# Normalization: reassemble fragments and resolve or reduce traffic ambiguities.
scrub in all

# Loopback interface
pass  in  quick on lo0 all

# Filtering: the implicit first two rules are
block in all
pass out all

pass  in  quick on $mgt_if all
pass  out quick on $mgt_if all

# Block everything and log it
block log on $mgt_if all
block log on $ext_if all

pass  in  on $ext_if proto { tcp, udp } from any to $ext_if port $serverport keep state
pass  out on $ext_if proto { tcp, udp } all keep state

À§¿Í °°ÀÌ ¼³Á¤À» ÇÏ¿´Áö¸¸. µÇÁö ¾Ê½À´Ï´Ù.
block in all
pass out all
¾ÈµË´Ï´Ù.

pass in all
pass out all
Àº Àߵ˴ϴÙ.

ÇÏÁö¸¸, pf ´Â ´Ù¸·°í ³ª¼­ ÇÊ¿ä ÇѰÍÀ» Çϳª¾¿ ¿©´Â °Å·Î ¾Ë°í ÀÖ½À´Ï´Ù.
serverport ´Â ÇÊ¿ä Çϸé.. ´õ ¸¹Àº port ¸¦ Ãß°¡ ÇÒ»ý°¢ÀÔ´Ï´Ù.

ext_if="bridge0"  ´Â em (intel lan) Ä«µå 2ÀåÀ» bridge ·Î ¹­Àº °ÍÀÔ´Ï´Ù.
mgt_if="em2" ´Â °ü¸®¸¦ À§ÇÑ ·£Ä«µå ÀÔ´Ï´Ù.
bridge0 ´Â non-IP ÀÔ´Ï´Ù.
em2´Â IP°¡ ÇÒ´ç µÇ¾îÀÖ½À´Ï´Ù.

µµ¿Í ÁÖ¼¼¿ä.. Èæ..Èæ..
ªÀº±Û Àϼö·Ï ½ÅÁßÇϰÔ.


QnA
Á¦¸ñPage 4496/5748
2014-05   5356183   Á¤ÀºÁØ1
2015-12   1869925   ¹é¸Þ°¡
2008-03   6059   Àü¿µÁø
2005-06   6010   Á¶Ç×ÁÖ
2005-10   5970   ¾çâ±Ç
2003-10   9617   À̼ö¹Î
2008-12   5266   ÀÌÁÖÈñ
2005-12   5751   ±èºÎ°â
2007-02   5818   ¿ì½Â¿±
2005-05   6555   Á¤¿µ±³
2002-12   10625   ±è¼º¼ö
2008-12   5925   À±Ä¡¿­
2005-10   5857   ¹èµ¿°ü
2003-06   8347   ÀÌ»ó·æ
2003-08   9020   ÃÖâÇö
2007-06   5395   ±è¼±´ë
2003-06   11068   Á¤±¸½Â
2007-09   4982   ·ù°æ¿ì
2005-01   7245   ±èÁ¾¿±
2007-12   5900   ±è¿ë¼ö_
2008-02   5763   ¹ÚÁø±¹
2007-12   5584   Á¶ÀçÇö