6. IP egkatastash filtrarismatos (IPFWADM)

Gia jekinhma, 8a prepei na exete to IP Forwarding energopoihmeno sto pyrhna kai to susthma 8a prepei na einai fortwmeno kai na prow8ei o,ti toy stelnete. Oi pinakes dromologiwn (routing tables) 8a prepei na einai sth 8esh toys kai 8a prepei na exete prosbash pantou, apo mesa ejw kai apo ejw mesa.

Alla emeis xtizoyme ena firewall, etsi xreiazetai na jekinhsoyme na boylwnoyme se ti yparxei prosbash, apo oloys.

Sto susthma moy dhmiourghsa merika scripts ga na topo8etw sto firewall politikh prow8hshs kai politikh 8ewrhshs. Kalw ayta ta scripts apo ta /etc/rc.d scripts etsi to susthma moy einai ry8mismeno apo th stigmh ths ekkinhshs.

Ej orismou to IP Forwarding susthma sto pyrhna toy Linux prow8ei ta panta. Gi' ayto to script toy firewall 8a prepei na jekina apo to na arneitai prosbash sta panta kai na ka8arizei opoioys ipfw kanones einai topo8ethmenoi apo th teleytaia fora poy etreje. Thn ergasia ayth th kanei to parakatw script :

  #
  # setup IP packet Accounting and Forwarding
  #
  #   Forwarding
  #
  # By default DENY all services
  ipfwadm -F -p deny
  # Flush all commands
  ipfwadm -F -f
  ipfwadm -I -f
  ipfwadm -O -f

Twra exoyme ton teliko firewall. Tipota den mporei na perasei apo mesa. Xwris amfibolia exete kapoies yphresies poy xreiazetai na prow8hsete (energopoihsete) etsi edw yparxoyn merika paradeigmata poy 8a breite xrhsima.

• # Prow8hsh email sto diakomisth

  ipfwadm -F -a accept -b -P tcp -S 0.0.0.0/0 1024:65535 -D 192.1.2.10 25

• # Prow8hsh sundeshs email ston ejwteriko diakomisth email

  ipfwadm -F -a accept -b -P tcp -S 196.1.2.10 25 -D 0.0.0.0/0 1024:65535

• # Prow8hsh sundeshs Web ston Web diakomisth

  /sbin/ipfwadm -F -a accept -b -P tcp -S 0.0.0.0/0 1024:65535 -D 196.1.2.11 80

• # Prow8hsh sundeshs Web gia ton ejwteriko Web diakomisth

  /sbin/ipfwadm -F -a accept -b -P tcp -S 196.1.2.* 80 -D 0.0.0.0/0 1024:65535

• # Prow8hsh DNS synallaghs

  /sbin/ipfwadm -F -a accept -b -P udp -S 0.0.0.0/0 53 -D 196.1.2.0/24

Mporeite na endiafer8hte epishs gia thn katagrafh twn syndiallagwn poy pernoun to firewall. Ayto to script 8a katagrafei ka8e paketo. Mporeite na pros8esete mia grammh h duo gia na katagrafete gia paketa metabainontas se ena mono susthma.

                      
  # Ka8ariste toy yparxontes kanones katagrafhs
  ipfwadm -A -f
  # Katagrafwntas 
  /sbin/ipfwadm -A -f
  /sbin/ipfwadm -A out -i -S 196.1.2.0/24 -D 0.0.0.0/0
  /sbin/ipfwadm -A out -i -S 0.0.0.0/0 -D 196.1.2.0/24
  /sbin/ipfwadm -A in -i -S 196.1.2.0/24 -D 0.0.0.0/0
  /sbin/ipfwadm -A in -i -S 0.0.0.0/0 -D 196.1.2.0/24

Ean ta osa zhtate htan enas firewall filtrarismatos mporeite na stamathsete edw. Apolayste to :-)