📄 00000013.htm
字号:
<HTML><HEAD> <TITLE>BBS水木清华站∶精华区</TITLE></HEAD><BODY><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER>发信人: zixia (Do you zixia tonight), 信区: Linux <BR>标 题: 11. Advice on Packet Filter Design he <BR>发信站: BBS 水木清华站 (Wed Oct 11 01:19:05 2000) WWW-POST <BR> <BR> Next Previous Contents
<BR>
<BR> ----------------------------------------------------------------------
<BR>
<BR>11. Advice on Packet Filter Design <BR>he
<BR>
<BR> Common wisdom in the computer security arena is to block everything, then
<BR> open up holes as neccessary. This is usually phrased `that which is not
<BR> explicitly allowed is prohibited'. I recommend this approach if security
<BR> is your maximal concern.
<BR>
<BR> Do not run any services you do not need to, even if you think you have
<BR> blocked access to them.
<BR>
<BR> If you are creating a dedicated firewall, start by running nothing, and
<BR> blocking all packets, then add services and let packets through as
<BR> required.
<BR>
<BR> I recommend security in depth: combine tcp-wrappers (for connections to
<BR> the packet filter itself), proxies (for connections passing through the
<BR> packet filter), route verification and packet filtering. Route
<BR> verification is where a packet which comes from an unexpected interface <BR>is
<BR> dropped: for example, if your internal network has addresses 10.1.1.0/24,
<BR> and a packet with that source address comes in your external interface, <BR>it
<BR> will be dropped. This can be enabled for one interface (ppp0) like so:
<BR> <BR>n
<BR> # echo 1 > /proc/sys/net/ipv4/conf/ppp0/rp_filter
<BR> #
<BR>
<BR> Or for all existing and future interfaces like this:
<BR>
<BR> # for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
<BR> # echo 1 > $f
<BR> # done
<BR> #
<BR>
<BR> Debian does this by default where possible. If you have asymmetric <BR>routing
<BR> (ie. you expect packets coming in from strange directions), you will want
<BR> to disable this filtering on those interfaces.
<BR>O
<BR> Logging is useful when setting up a firewall if something isn't working,
<BR> but on a production firewall, always combine it with the `limit' match, <BR>to
<BR> prevent someone from flooding your logs.
<BR>
<BR> I highly recommend connection tracking for secure systems: it introduces
<BR> some overhead, as all connections are tracked, but is very useful for <BR>he
<BR> controlling access to your networks. You may need to load the
<BR> `ip_conntrack.o' module if your kernel does not load modules
<BR> automatically, and it's not built into the kernel. If you want to
<BR> accurately track complex protocols, you'll need to load the appropriate
<BR> helper module (eg. `ip_conntrack_ftp.o').
<BR>
<BR> # iptables -N no-conns-from-ppp0
<BR> # iptables -A no-conns-from-ppp0 -m state --state ESTABLISHED,RELATED -j <BR>ACCEPT
<BR> # iptables -A no-conns-from-ppp0 -m state --state NEW -i ! ppp0 -j ACCEPT
<BR> # iptables -A no-conns-from-ppp0 -i ppp0 -m limit -j LOG --log-prefix "Bad <BR>pack
<BR> # iptables -A no-conns-from-ppp0 -i ! ppp0 -m limit -j LOG --log-prefix "Bad <BR>pa
<BR> # iptables -A no-conns-from-ppp0 -j DROP
<BR>
<BR> # iptables -A INPUT -j no-conns-from-ppp0
<BR> # iptables -A FORWARD -j no-conns-from-ppp0
<BR>
<BR> Building a good firewall is beyond the scope of this HOWTO, but my advice
<BR> is `always be minimalist'. See the Security HOWTO for more information on
<BR> testing and probing your box.
<BR>
<BR> ---------------------------------------------------------------------- <BR>n
<BR>
<BR> Next Previous Contents
<BR> <BR>-- <BR>))))))))))))))))))))))))))))))))))))))))))))))))))) <BR> ((((((((((((生命的欢喜可以再影印一张吗?(((((((((((( <BR> ))))))))))))老去的热情可以再拉皮整形吗?)))))))))))) <BR> ((((((((((((病中的真理可以再传真校对吗?(((((((((((( <BR> ))))))))))))死掉的爱情可以再输入键出吗?)))))))))))) <BR> ((((((((((((((((((((((((((((((((((((((((((((((((((( <BR> <BR>※ 来源:·BBS 水木清华站 smth.org·[FROM: 202.112.45.49] <BR><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER></BODY></HTML>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -