Ejemplo 4

Page last edited hace 2059 días 13 horas
De Solaris-ES
Saltar a: navegación, buscar

Configuración completa de IPFilter sobre solaris 10

  • Habilitar el IPFILTER
 # vi /etc/ipf/pfil.ap 
 # IP Filter pfil autopush setup 
 # 
 # See autopush(1M) manpage for more information. 
 # 
 # Format of the entries in this file is: 
 # 
 #major minor lastminor modules 
 #le -1 0 pfil 
 #qe -1 0 pfil 
 hme -1 0 pfil (Device has been uncommented for filtering) 
 #qfe -1 0 pfil 
 #eri -1 0 pfil 
 #ce -1 0 pfil 
 #bge -1 0 pfil 
  • Activamos los cambios realizados reiniciando el servicio network/pfil.
 # svcadm restart network/pfil 
 o 
 # svcadm enable network/pfil # Si no está activado! (verificar con "svcs") 
  • Activamos el IPFILTER
 # svcadm enable network/ipfilter 
 # reboot 
Nota: Es importante reiniciar el equipo, las operaciones de unplumb y plumb sobre la IF no son seguras. 
Si se desactiva temporalmente el IPFILTER se puede reactivar utilizando el comando: 
 # ipf -E # Activa el IPFILTER 
 # ipf -f <FILE> # Activa el filtrado de paquetes 
 # ipnat -f <FILE> # Activa el NAT 
Nota: Para un detalle mayor sobre IPFILTER ver estas URLs: 
http://docs.sun.com/app/docs/doc/816-4554/6maoq023u?a=view 
http://docs.sun.com/app/docs/doc/816-4554/6maoq024c?a=view 
  • Habilitamos el IP Forwarding en Solaris para IPV4
 # routeadm -u -e ipv4-forwarding 
  • Preparamos las reglas del FIREWALL (IPFILTER)
 # vi /etc/ipf/ipf.conf 
 # 
 # ipf.conf 
 # 
 # IP Filter rules to be loaded during startup 
 # 
 # See ipf(4) manpage for more information on 
 # IP Filter rules syntax. 
 # 
 # This is a simple ruleset that blocks all inbound TCP traffic 
 # except for SSH, and allows all outbound traffic, 
 # 
 # And of course, make sure the loopback allows packets to traverse 
 # it. 
 pass in all 
 pass out all 
 pass in log quick on lo0 all 
 pass out log quick on lo0 all 
 pass in quick on hme0 proto tcp from any to any port = 22 keep state 
 pass in quick on hme0 proto tcp/udp from any to any port = 53 keep state 
 pass in quick on hme0 proto tcp/udp from any to any port = 80 keep state 
 pass in quick on hme0 proto tcp/udp from any to any port = 3128 keep state 
 pass in quick on hme1 proto tcp from any to any port = 22 keep state 
 pass in quick on hme1 proto tcp/udp from any to any port = 53 keep state 
 pass in quick on hme1 proto tcp/udp from any to any port = 80 keep state 
 pass in quick on hme1 proto tcp/udp from any to any port = 3128 keep state 
 block return-rst in log on hme0 proto tcp from any to any 
 block return-rst in log on hme1 proto tcp from any to any 
 pass out on hme0 proto tcp from any to any keep state 
 pass out on hme1 proto tcp from any to any keep state 


  • Preparamos las reglas del NAT (IPFILTER)
 # vi /etc/ipf/ipnat.conf 
 rdr hme1 0/0 port 80 -> 10.6.75.10 port 3128 
 rdr hme1 0/0 port 443 -> 10.6.75.10 port 3128 
 rdr hme1 0/0 -> 10.6.75.10