4.在/var/log/建立一个ipfw.log的文件，内容为空的就可以了,然后保存退出。(这是一个记录防火墙的日志文件）
5.在/etc下也建立一个natd.conf的文件，内容也为空的，保存退出。(这是一个nat的配置文件，可以作一些NAT的设置）
6.在/etc下新建ipfw.conf文件，在文件里写入以下内容：
add 00400 divert natd ip from any to any via rl0
add 00001 deny log ip from any to any ipopt rr
add 00002 deny log ip from any to any ipopt ts
add 00003 deny log ip from any to any ipopt ssrr
add 00004 deny log ip from any to any ipopt lsrr
add 00005 deny tcp from any to any in tcpflags syn,fin
#####TCP#####
add 10000 deny tcp from any to any 4000
add 10001 deny tcp from any to any 8000
add 10002 deny udp from any to any 4000
add 10003 deny udp from any to any 8000
add 10004 deny all from any to 61.144.238.145
add 10005 deny all from 61.144.238.145 to any
add 10006 deny all from any to 61.144.238.146
add 10007 deny all from 61.144.238.146 to any
add 10008 deny all from any to 202.104.129.251
add 10009 deny all from 202.104.129.251 to any
add 10010 deny all from any to 202.104.129.254
add 10011 deny all from 202.104.129.254 to any
add 10012 deny all from any to 61.141.194.203
add 10013 deny all from 61.141.194.203 to any
add 10014 deny all from any to 202.104.129.252
add 10015 deny all from 202.104.129.252 to any
add 10016 deny all from any to 202.104.129.253
add 10017 deny all from 202.104.129.253 to any
add 10018 deny all from any to 218.18.95.153
add 10019 deny all from 218.18.95.153 to any
add 10020 deny all from any to 218.17.209.23
add 10021 deny all from 218.17.209.23 to any
add 10022 deny all from any to 61.144.238.156
add 10023 deny all from 61.144.238.156 to any
add 10024 deny all from any to 218.17.209.42
add 10025 deny all from 218.17.209.42 to any
#####ICMP#####
add 30000 allow icmp from any to any icmptypes 3
add 30001 allow icmp from any to any icmptypes 4
add 30002 allow icmp from any to any icmptypes 8 out
add 30003 allow icmp from any to any icmptypes 0 in
add 30004 allow icmp from any to any icmptypes 11 in
#####LAN#####
add 40001 allow all from any to any
.分页: [1] [2]
- 上一篇:FreeBSD的物理内存管理机制
- 下一篇:FreeBSD监视终端操作的方法