IP Filter：小巧的UNIX數(shù)據(jù)包過濾器
IP Filter是一款軟件包,可以實(shí)現(xiàn)網(wǎng)絡(luò)地址轉(zhuǎn)換(network address translation)(NAT)或者防火墻服務(wù)的功能｡它可以作為UNIX的一個核心模塊,也可以不嵌入核心,強(qiáng)烈推薦將其作為UNIX的核心模塊｡安裝和為系統(tǒng)文件打補(bǔ)丁要使用腳本｡IP Filter內(nèi)置于FreeBSD､NetBSD和Solaris中｡OpenBSD可以使用Openbsd PF,Linux用戶可以使用Netfilter｡
下載鏈接:http://down.51cto.com/data/160078
>>去網(wǎng)絡(luò)安全工具百寶箱看看其它安全工具
安裝步驟:本文安裝版本:3.4.17
將下載的IP-Filter的源碼文件ip-fil3.4.17.tar.gz放到/tmp目錄下,執(zhí)行
- gzip -d ip-fil3.4.17.tar.gz
- tar –xvf ip-fil3.4.17.tar
- cd ip_fil3.4.17
- make sunos5
對下載的源碼包進(jìn)行編譯｡當(dāng)IP Filter編譯成功之后,安裝過程使用的是solaris常用的打包的方式進(jìn)行的,它會在/var/spool/pkg目錄下創(chuàng)建相應(yīng)的package文件｡
在安裝目錄下輸入make solaris來編譯所有需要的二進(jìn)制文件,注意不能使用GNU make來編譯｡
進(jìn)入到安裝目錄的SunOS5目錄下,執(zhí)行make package命令,此命令會在SunOS5/<arch>/root目錄下創(chuàng)建一個名為“ipf.pkg”的打包文件,同時自動啟動pkgadd進(jìn)程,如果通過手動啟動打包進(jìn)程則需鍵入:pkgadd -d ipf.pkg來進(jìn)行｡
安裝結(jié)束后會將IP Filter安裝到/opt/ipf目錄下,同時在/etc/opt/ipf創(chuàng)建一個名為“ipf.conf”的過濾配置文件,初始時該文件為空的｡
IP Filter的啟動方式是通過運(yùn)行/etc/init.d/ipfboot來啟動的,執(zhí)行ipfboot start啟動IP Filter｡
建立IP Filter的配置文件,/opt/ipf/bin/mkfilters可以產(chǎn)生基本的配置文件｡產(chǎn)生方法是通過執(zhí)行下面的命令:
- #/opt/ipf/bin/mkfilters > /etc/opt/ipf/ipf.conf
每次添加或修改ipf.conf文件后都需要重新啟動一遍ipfboot,來重新讀入配置文件,具體方法如下:/etc/init.d/ipfboot reload｡
IP-Filter的典型配置:
分為兩個部分進(jìn)行介紹,***部分是IP-Filter防火墻的基本規(guī)則策略配置;第二部分為IP-Filter防火墻的高級規(guī)則策略配置｡注意:以下所有的配置語句都可以添加到/etc/opt/ipf/ipf.conf文件中,但是需要重新啟動一遍ipfboot來使配置生效｡
IP-Filter對規(guī)則的處理是采用自頂向下的方式,在IP-Filter中如果關(guān)鍵字quick被添加到任何一條規(guī)則中,可以加快該規(guī)則的匹配速度｡#p#
IP-Filter防火墻的基本規(guī)則策略配置:
基于IP地址的基本過濾方式:
- block in quick from 192.168.0.0/24 to any
- pass in all
應(yīng)用此規(guī)則將阻止來自于192.168.0.0網(wǎng)段的所有包的進(jìn)入,但是允許其他網(wǎng)段的包進(jìn)入到防火墻,同時對出去的包不作任何限制｡
基于IP地址和防火墻接口的基本過濾方式:
- block in quick on hme0 from 192.168.0.0/24 to any
- block in quick on hme0 from 172.16.0.0/16 to any
- pass in all
應(yīng)用此規(guī)則將阻止通過hme0口來自于192.168.0.0和172.16.0.0網(wǎng)段的所有包的進(jìn)入,但是允許其他網(wǎng)段的包進(jìn)入到防火墻,同時對出去的包不作任何限制｡
使用“out”關(guān)鍵字對出包進(jìn)行過濾:
- pass out quick on hme0 from 192.168.0.0/24 to any
- block out quick on hme0 from any to any
應(yīng)用此規(guī)則將使所有從192.168.0.0網(wǎng)段來的包通過防火墻出去,但是所有從其他網(wǎng)段來的包將被阻斷在防火墻內(nèi),不允許出去｡
使用“log”關(guān)鍵字對包的過濾情況進(jìn)行記錄:
- block in quick on hme0 from 192.168.0.0/24 to any
- block in log quick on hme0 from 172.16.0.0/16 to any
- pass in all
應(yīng)用此規(guī)則后將阻止通過hme0口來自于192.168.0.0和172.16.0.0網(wǎng)段的所有包的進(jìn)入,同時對172.16.0.0網(wǎng)段的所有包的過濾情況進(jìn)行記錄,但是允許其他網(wǎng)段的包進(jìn)入到防火墻,同時對出去的包不作任何限制｡
基于IP地址和防火墻接口的完全雙向過濾方式:
- block out quick on hme0 from any to 192.168.0.0/24
- block out quick on hme0 from any to 172.16.0.0/16
- block in quick on hme0 from 192.168.0.0/24 to any
- block in quick on hme0 from 172.16.0.0/16 to any
- pass in all
應(yīng)用此規(guī)則后將阻止通過hme0口來自于192.168.0.0和172.16.0.0網(wǎng)段的所有包的進(jìn)入和外出,但是允許其他網(wǎng)段的包進(jìn)入到防火墻,同時對出去的包不作任何限制｡#p#
使用“proto”關(guān)鍵字來控制一些需特別指定的協(xié)議:
- block in log quick on hme0 proto icmp from any to 192.168.0.40/32
應(yīng)用此規(guī)則后阻止任何ping到192.168.0.40的icmp包｡
過濾ICMP包使用“icmp-type”關(guān)鍵字,合并規(guī)則集｡
- pass in quick on hme0 proto icmp from any to 192.168.0.0/24 icmp-type 0
- pass in quick on hme0 proto icmp from any to 192.168.0.0/24 icmp-type 11
- block in log quick on hme0 proto icmp from any to any
應(yīng)用此規(guī)則后將只允許ICMP協(xié)議的類型0和11(type0&type11)的包通過hme0口進(jìn)入到防火墻內(nèi),同時阻止任何想通過hme0口進(jìn)入的ICMP協(xié)議,并將匹配此規(guī)則的包記入日志中｡
使用“port”關(guān)鍵字對TCP和UDP的端口進(jìn)行過濾:
- block in log quick on hme0 proto tcp from any to 192.168.0.0/24 port = 513
- block in log quick on hme0 proto tcp from any to 192.168.0.0/24 port = 8080
- block in log quick on hme0 proto tcp from any to 192.168.0.0/24 port = 23
- pass in all
應(yīng)用此規(guī)則后將阻止從192.168.0.0網(wǎng)段通過8080和23端口對防火墻內(nèi)的數(shù)據(jù)通信,但是允許其他網(wǎng)段的包進(jìn)入到防火墻,同時對出去的包不作任何限制｡
IP-Filter防火墻的高級規(guī)則策略配置:
使用“keep state”關(guān)鍵字建立默許規(guī)則
- block in quick on hme0 all
- pass out quick on hme0 proto tcp from 20.20.20.1/32 to any keep state
應(yīng)用此規(guī)則將首先阻止從hme0口進(jìn)入的數(shù)據(jù)包,通過使用規(guī)則組(Rule Groups)來增強(qiáng)防火墻的性能
可以通過增加更多更復(fù)雜的規(guī)則來擴(kuò)展防火墻的性能,以下的示例將會修改接口名稱和網(wǎng)絡(luò)號,假設(shè)此防火墻有三個接口,分別為xl0､xl1､xl2｡#p#
xl0連接的外網(wǎng)20.20.20.0/26;
xl1連接的為DMZ區(qū)20.20.20.0/26;
xl2連接的為受保護(hù)網(wǎng)段20.20.20.128/25｡
應(yīng)用于此防火墻的規(guī)則如下:
- block in quick on xl0 all head 1
- block in quick on xl0 from 192.168.0.0/16 to any group 1
- block in quick on xl0 from 172.16.0.0/12 to any group 1
- block in quick on xl0 from 10.0.0.0/8 to any group 1
- block in quick on xl0 from 127.0.0.0/8 to any group 1
- block in quick on xl0 from 0.0.0.0/8 to any group 1
- block in quick on xl0 from 169.254.0.0/16 to any group 1
- block in quick on xl0 from 192.0.2.0/24 to any group 1
- block in quick on xl0 from 204.152.64.0/23 to any group 1
- block in quick on xl0 from 224.0.0.0/3 to any group 1
- block in log quick on xl0 from 20.20.20.0/24 to any group 1
- block in log quick on xl0 from any to 20.20.20.0/32 group 1
- block in log quick on xl0 from any to 20.20.20.63/32 group 1
- block in log quick on xl0 from any to 20.20.20.64/32 group 1
- block in log quick on xl0 from any to 20.20.20.127/32 group 1
- block in log quick on xl0 from any to 20.20.20.128/32 group 1
- block in log quick on xl0 from any to 20.20.20.255/32 group 1
- pass in on xl0 all group 1
- pass out on xl0 all
- block out quick on xl1 all head 10
- pass out quick on xl1 proto tcp from any to 20.20.20.64/26 port = 80 flags S keep state group 10
- pass out quick on xl1 proto tcp from any to 20.20.20.64/26 port = 21 flags S keep state group 10
- pass out quick on xl1 proto tcp from any to 20.20.20.64/26 port = 20 flags S keep state group 10
- pass out quick on xl1 proto tcp from any to 20.20.20.65/32 port = 53 flags S keep state group 10
- pass out quick on xl1 proto udp from any to 20.20.20.65/32 port = 53 keep state group 10
- pass out quick on xl1 proto tcp from any to 20.20.20.66/32 port = 53 flags S keep state
- pass out quick on xl1 proto udp from any to 20.20.20.66/32 port = 53 keep state group 10
- pass in quick on xl1 proto tcp/udp from 20.20.20.64/26 to any keep state
- block out on xl2 all
- pass in quick on xl2 proto tcp/udp from 20.20.20.128/25 to any keep state
應(yīng)用此規(guī)則之后會使防火墻完成如下的功能:
在xl0口上阻止從192.168.0.0/16､172.16.0.0/12､10.0.0.0/8､127.0.0.0/8､0.0.0.0/8､169.254.0.0/16 ､192.0.2.0/24､204.152.64.0/231､224.0.0.0/3､20.20.20.0/24､20.20.20.0/32､20.20.20.63/32 ､20.20.20.64/32 ､20.20.20.127/32､20.20.20.128/32､20.20.20.255/32､等網(wǎng)段的數(shù)據(jù)包的進(jìn)入,同時此規(guī)則的編寫是通過將這些規(guī)則綁定成為一個組的方式來進(jìn)行的｡同時對所有從Xl0口通過的外出包不作限制｡
在DMZ區(qū)的20.20.20.64/26網(wǎng)段內(nèi)的機(jī)器允許其使用www及ftp服務(wù),對于IP地址為20.20.20.65/32機(jī)器允許其對外提供DNS服務(wù)｡
對于內(nèi)網(wǎng)安全區(qū)則應(yīng)用了更為嚴(yán)格的安全規(guī)則,只允許20.20.20.128/25網(wǎng)段的機(jī)器對內(nèi)網(wǎng)進(jìn)行訪問,同時阻止所有其他網(wǎng)段的機(jī)器對內(nèi)網(wǎng)的訪問｡#p#
關(guān)于NAT在IP-Filter上的應(yīng)用
首先需要打開Solaris的ip_forwarding開關(guān),通過輸入命令:
- #ndd -get /dev/tcp ip_forwarding
可以查詢ip_forwarding是否處于打開的狀態(tài)｡如果為0,則表示ip_forwarding處于關(guān)閉狀態(tài),可以輸入:
- #ndd -set /dev/tcp ip_forwarding 1
來打開它｡
以下為NAT的規(guī)則示例:
- map hme0 192.168.100.0/24 ->0/32 proxy port ftp ftp/tcp
- map hme0 192.168.100.0/24 ->0/32 portmap tcp/udp 10000:40000
- map hme0 192.168.100.0/24 ->0/32
應(yīng)用以上規(guī)則后可以實(shí)現(xiàn)如下功能:
***條規(guī)則允許內(nèi)網(wǎng)的所有主機(jī)通過hme0口的FTP訪問Internet｡
第二條規(guī)則映射了高端端口10000到40000,允許一些網(wǎng)絡(luò)服務(wù)通過這一段端口范圍進(jìn)行訪問｡
***一條規(guī)則映射了一些通用的TCP流量可以進(jìn)出網(wǎng)絡(luò)｡
對于在IP-Filter上應(yīng)用NAT規(guī)則,可以使用ipnat命令進(jìn)行啟動,此時NAT規(guī)則可以被存儲于任何文件中,但是典型情況下規(guī)則文件還是被存儲于/etc/ipnat.rules;
/usr/local/etc/ipnat.rules;/etc/opt/ipf/ipnat.rules,中,可以使用-r參數(shù)將已經(jīng)添加到規(guī)則集中的NAT規(guī)則去除掉｡對于NAT規(guī)則集的檢測通過-l參數(shù)執(zhí)行｡最簡便的裝載NAT規(guī)則的方法是:
- #ipnat -CF -f /etc/ipnat.rules
#p#
對IP-Filter的監(jiān)視和調(diào)試:
ipfstat工具的屬性及使用:
ipfstat會顯示你防火墻所過濾的數(shù)據(jù)的列表,諸如:有多少包通過防火墻的過濾､有多少包被阻塞､是否啟用了日志功能等等｡下面是ipfstat的運(yùn)行后所輸出的信息:
- # ipfstat
- input packets: blocked 99286 passed 1255609 nomatch 14686 counted 0
- output packets: blocked 4200 passed 1284345 nomatch 14687 counted 0
- input packets logged: blocked 99286 passed 0
- output packets logged: blocked 0 passed 0
- packets logged: input 0 output 0
- log failures: input 3898 output 0
- fragment state(in): kept 0 lost 0
- fragment state(out): kept 0 lost 0
- packet state(in): kept 169364 lost 0
- packet state(out): kept 431395 lost 0
- ICMP replies: 0 TCP RSTs sent: 0
- Result cache hits(in): 1215208 (out): 1098963
- IN Pullups succeeded: 2 failed: 0
- OUT Pullups succeeded: 0 failed: 0
- Fastroute successes: 0 failures: 0
- TCP cksum fails(in): 0 (out): 0
- Packet log flags set: (0)
- none
可以使用-I和-o參數(shù)來顯示目前所裝載的輸入和輸出規(guī)則｡
Ipmon工具的屬性及應(yīng)用:
Ipmon是一個收集系統(tǒng)快照的一個工具,ipmon可以直接觀看通過規(guī)則中的“log”關(guān)鍵字所生成的包的日志｡此工具既可以運(yùn)行于前臺又可以以日志deamon的方式運(yùn)行可以使用下面的命令啟動ipmon:
- # ipmon -o S
- 01/08/1999 15:58:57.836053 STATE:NEW 100.100.100.1,53 -> 20.20.20.15,53 PR udp
- 01/08/1999 15:58:58.030815 STATE:NEW 20.20.20.15,123 -> 128.167.1.69,123 PR udp
- 01/08/1999 15:59:18.032174 STATE:NEW 20.20.20.15,123 -> 128.173.14.71,123 PR udp
- 01/08/1999 15:59:24.570107 STATE:EXPIRE 100.100.100.1,53 -> 20.20.20.15,53 PR udp Pkts 4 Bytes 356
- 01/08/1999 16:03:51.754867 STATE:NEW 20.20.20.13,1019 -> 100.100.100.10,22 PR tcp
- 01/08/1999 16:04:03.070127 STATE:EXPIRE 20.20.20.13,1019 -> 100.100.100.10,22 PR tcp Pkts 63 Bytes 4604
對Solaris內(nèi)核參數(shù)的一些調(diào)整:
Ip轉(zhuǎn)發(fā)部分:
- #ndd -set /dev/ip ip_forwarding 1
端口調(diào)整部分:
- #ndd -set /dev/tcp tcp_smallest_anon_port 25000
- #ndd -set /dev/tcp tcp_largest_anon_port 65535
其它一些有用的參數(shù):
- #ndd -set /dev/ip ip_forward_directed_broadcasts 0
- #ndd -set /dev/ip ip_forward_src_routed 0
- #ndd -set /dev/ip ip_respond_to_echo_broadcast 0
