Kamis, 29 Oktober 2009

Posts filed under 'FreeBSD'

Pertama-tama konfigurasi kernel anda agar support pf :


#Packet Filter Options


device pf
device pflog
device pfsync

#Enabling ALTQ


options ALTQ
options ALTQ_CBQ # Class Bases Queuing (CBQ)
options ALTQ_RED # Random Early Detection (RED)
options ALTQ_RIO # RED In/Out
options ALTQ_HFSC # Hierarchical Packet Scheduler (HFSC)
options ALTQ_PRIQ # Priority Queuing (PRIQ)
options ALTQ_NOPCC # Required for SMP build

Berikut konfigurasi yg saya implementasikan pada box FreeBsd saya, buat para admin jaringan yang menggunakan box FreeBsd silahkan anda kopas. Tapi sesuaikan dengan kondisi box sampeyan..



### macros

# internal and external interfaces (ketikan ‘ifconfig’ buat lihat interface)

int_if = “vr0″

ext_if = “rl0″


# Port Yang Boleh Diakses dari Luar Box silahkan sesuaikan



tcp_services = “{ 80, 110, 25, 53, 113, 21}”

udp_services = “{ 53, 1194 }”


# ping requests

icmp_types = “echoreq”


# Private Network, Yg Mau di Blok Traffiknya

priv_nets = “{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }”


### options


set block-policy return

set loginterface $ext_if

set skip on lo0


### Scrub

scrub in all


### nat/rdr

# NAT traffic dari Internal Ke External

nat on $ext_if from $int_if:network to any -> ($ext_if)



# Port Redirector untuk Transparent Proxy & Transparent FTP

rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021

rdr on $int_if proto tcp from any to any port 80 -> 127.0.0.1 port 3128


### filter rules

block all


# Blok Traffik Dari Luar Yang Pake IP Private


block drop in quick on $ext_if from $priv_nets to any


# Blok Trafik dari Luar ke Internal

block drop out quick on $ext_if from any to $priv_nets


# Perbolehkan Akses ke TCP port tertentu

pass in on $ext_if inet proto tcp from any to ($ext_if) \


port $tcp_services flags S/SA keep state


# Perbolehkan Akses ke UDP port tertentu

pass in on $ext_if proto udp to any port $udp_services keep state


# Perbolehkan Akses FTP


pass in on $ext_if inet proto tcp from port 20 to ($ext_if) \


user proxy flags S/SA keep state


# Ping Reply OK

pass in inet proto icmp all icmp-type $icmp_types keep state


# Perbolehkan Traffik dari Internal ke Internal Interface

pass in on $int_if from $int_if:network to any keep state

pass out on $int_if from any to $int_if:network keep state


# Perbolehkan Traffik keluar melalui External Interface

pass out on $ext_if proto tcp all modulate state flags S/SA


pass out on $ext_if proto { udp, icmp } all keep state



Untuk ngecek nat dan konfigurasi anda silahkan gunakan perintah


# pfctl -Fn -Nf /etc/pf.conf

flush rules


# pfctl -f /etc/pf.conf

Dan untuk me-restart pf anda gunakan perintah


# pfctl -NORf /etc/pf.conf

Biar auto start, masukkan script berikut di rc.conf anda :



pf_enable="YES" # Enable PF (load module if required)
pf_rules="/etc/pf.conf" # rules definition file for pf
pf_flags="" # additional flags for pfctl startup
pflog_enable="YES" # start pflogd(8)
pflog_logfile="/var/log/pflog" # where pflogd should store the logfile
pflog_flags="" # additional flags for pflogd startup
gateway_enable="YES" # Enable as LAN gateway


Tidak ada komentar:

Posting Komentar

nyuwun komentar... . .

za.IPAN's Blog © 2008. Design by :Yanku Templates Sponsored by: Tutorial87 Commentcute