Firewall Handbuch für LINUX 2.0 und 2.2 - zurück

# Unlimited traffic within the local network
/sbin/ipfwadm -I -a accept -V "$INTERNALIP" -S "$NETWORKIP" -D
"$ANYWHERE"
# =====Deny spoofed packets and log denied requests
/sbin/ipfwadm -I -a deny -V "$EXTERNALIP" -S "$NETWORKIP" -D
"$ANYWHERE" -o
# Target
for SERVICES in `echo $TCP_ALLOWIN` ; do
/sbin/ipfwadm -I -a accept -P tcp -V "$EXTERNALIP" -S "$ANYWHERE" \
"$PORTS" -D "$EXTERNALIP" "$SERVICES" -o
done
# Return
for SERVICES in `echo $TCP_ALLOWOUT` ; do
/sbin/ipfwadm -I -a accept -P tcp -S -V "$EXTERNALIP" "$ANYWHERE"
"$SERVICES" \
-D "$EXTERNALIP" "$PORTS" -o
done
# Allow ping requests
/sbin/ipfwadm -I -a accept -P icmp -V "$EXTERNALIP" -S "$ANYWHERE" \
-D "$EXTERNALIP" -o
# DNS
/sbin/ipfwadm -I -a accept -P udp -V "$EXTERNALIP" -S "$ANYWHERE" \
-D "$EXTERNALIP"
/sbin/ipfwadm -I -a accept -V "$LOOPBACK" -S "$ANYWHERE" -D
"$ANYWHERE"
# Log the rest
/sbin/ipfwadm -I -a deny -S "$ANYWHERE" -D "$ANYWHERE" -o
# =====================================
# ========== Outgoing Rules ===========
# =====================================
# Flush previous rules
/sbin/ipfwadm -O -f
# Set default policy to deny
/sbin/ipfwadm -O -p deny
# Unlimited traffic within the local network
/sbin/ipfwadm -O -a accept -V "$INTERNALIP" -S "$ANYWHERE" -D
"$NETWORKIP"
# Logging
/sbin/ipfwadm -O -a deny -V "$EXTERNALIP" -S "$ANYWHERE" -D
"$NETWORKIP" -o
/sbin/ipfwadm -O -a deny -V "$EXTERNALIP" -S "$NETWORKIP" -D
"$ANYWHERE" -o
# Target
for SERVICES in `echo $TCP_ALLOWOUT`; do
/sbin/ipfwadm -O -a accept -P tcp -S "$EXTERNALIP" "$PORTS" \
-D "$ANYWHERE" "$SERVICES" -o
done
Erstellt von Doc Gonzo - http://kickme.to/plugins