正在浏览栏目导航：首页 > 操作系统 > unix > linux

Shorewall - 一個好用的防火牆

时间:2007-01-04 10:22:24 来源: 作者:whsong 点击:次出处:技术无忧

关键字：Shor

本人會講解在 Debian 安裝 shorewall 的步驟及一些簡單的 settings, 因為在 Debian 好簡單, 你只要打
#apt-get install shorewall
shorewall 就已在你部 Debian 安裝好了, 之後要去做 configuration.
shorewall 的 configuration files 會放在 /etc/shorewall 內.

初時在 /etc/shorewall 只有一個 shorewall.conf 檔案, 你須要從其他 directories 複製一些 files 過去:

#cp /usr/share/shorewall/actions.std /etc/shorewall
#cp /usr/share/shorewall/modules /etc/shorewall
#cp /usr/share/shorewall/configpath /etc/shorewall
#cp /usr/share/shorewall/rfc1918 /etc/shorewall

#cp /usr/share/doc/shorewall/default-config/blacklist /etc/shorewall
#cp /usr/share/doc/shorewall/default-config/hosts /etc/shorewall
#cp /usr/share/doc/shorewall/default-config/interfaces /etc/shorewall
#cp /usr/share/doc/shorewall/default-config/maclist /etc/shorewall
#cp /usr/share/doc/shorewall/default-config/policy /etc/shorewall
#cp /usr/share/doc/shorewall/default-config/zones /etc/shorewall
#cp /usr/share/doc/shorewall/default-config/rules /etc/shorewall

因為只是做好簡單, 而又已可以用到個防火牆, 所以真是要 set 的得幾個 files :

1. 在 shorewall.conf 改兩句.
#vi /etc/shorewall/shorewall.conf
LOGRATE=10/minute
LOGBURST=5

2. 在 interfaces 加一句.
# vi /etc/shorewall/interfaces
net eth0 detect

3. 在 zones 加三句.
#vi /etc/shorewall/zones
net Internet Internet
loc Local Local Network
dmz DMZ Demilitarized zone

4. 在 policy 加三句.
#vi /etc/shorewall/policy
loc net ACCEPT
net all DROP info
all all REJECT info

5. 在 rules 你就可以加入什麼 service 可以通過個防火牆.
# vi /etc/shorewall/rules
#incoming traffic (由 internet 去 firewall)
AllowSSH net fw
AllowDNS net fw
AllowWeb net fw
AllowSMB net fw
AllowNNTP net fw
AllowNTP net fw
AllowRdate net fw
AllowSMTP net fw
DropPing net fw

#outgoing traffic (由 firewall 去 internet)
AllowWeb fw net
AllowDNS fw net
AllowSMTP fw net
AllowSMB fw net
AllowSMTP fw net
AllowNNTP fw net
AllowNTP fw net
AllowRdate fw net
AllowSSH fw net

#open special ports
ACCEPT net fw tcp 9980

最後還要去 set 下面個 file 來讓 shorewall 可以技术无忧.com