'K heb nu FreeBSD draaien als router/firewall (en daar ben ik heel errrug blij mee, had eerst nl. wingate 3.0 
)
Ik heb nu vgl. mij de meest standaard ipf.rules (block alles naar binnen, en laat alles naar buiten, grof gezegd).
Wat zijn nu eigenlijk nog rules die je (als je het goed wilt doen) MOET toevoegen om andere rare aanvallen (DOS enzo) af te kunnen weren?
)Ik heb nu vgl. mij de meest standaard ipf.rules (block alles naar binnen, en laat alles naar buiten, grof gezegd).
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
| ################################################################# # Outside Interface ################################################################# #---------------------------------------------------------------- # Allow out all TCP, UDP, and ICMP traffic & keep state on it # so that it's allowed back in. #---------------------------------------------------------------- pass out quick on ed0 proto tcp from any to any keep state pass out quick on ed0 proto udp from any to any keep state pass out quick on ed0 proto icmp from any to any keep state block out quick on ed0 all #---------------------------------------------------------------- # Allow bootp traffic in from your ISP's DHCP server only. #---------------------------------------------------------------- pass in quick on ed0 proto udp from X.X.X.X/32 to any port = 68 keep state #---------------------------------------------------------------- # Block and log all remaining traffic coming into the firewall # - Block TCP with a RST (to make it appear as if the service # isn't listening) # - Block UDP with an ICMP Port Unreachable (to make it appear # as if the service isn't listening) # - Block all remaining traffic the good 'ol fashioned way #---------------------------------------------------------------- block return-rst in log quick on ed0 proto tcp from any to any block return-icmp-as-dest(port-unr) in log quick on ed0 proto udp from any to any block in log quick on ed0 all ################################################################# # Inside Interface ################################################################# #---------------------------------------------------------------- # Allow out all TCP, UDP, and ICMP traffic & keep state #---------------------------------------------------------------- pass out quick on ed1 proto tcp from any to any keep state pass out quick on ed1 proto udp from any to any keep state pass out quick on ed1 proto icmp from any to any keep state block out quick on ed1 all #---------------------------------------------------------------- # Allow in all TCP, UDP, and ICMP traffic & keep state #---------------------------------------------------------------- pass in quick on ed1 proto tcp from any to any keep state pass in quick on ed1 proto udp from any to any keep state pass in quick on ed1 proto icmp from any to any keep state block in quick on ed1 all ################################################################# # Loopback Interface ################################################################# #---------------------------------------------------------------- # Allow everything to/from your loopback interface so you # can ping yourself (e.g. ping localhost) #---------------------------------------------------------------- pass in quick on lo0 all pass out quick on lo0 all |
Wat zijn nu eigenlijk nog rules die je (als je het goed wilt doen) MOET toevoegen om andere rare aanvallen (DOS enzo) af te kunnen weren?
:strip_icc():strip_exif()/u/12519/iconlamp.jpg?f=community)