From owner-FreeBSD-net-jp@jp.freebsd.org  Thu Jul 19 01:19:03 2001
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id BAA70720;
	Thu, 19 Jul 2001 01:19:03 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from mail.netwave.or.jp (mail.netwave.or.jp [202.214.48.114])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id BAA70715
	for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 19 Jul 2001 01:19:02 +0900 (JST)
	(envelope-from kana@mail.netwave.or.jp)
Received: from fukp400.mail.netwave.or.jp (ppp229151.netwave.or.jp [210.142.229.151])
	by mail.netwave.or.jp (8.9.3+3.2W/3.7W) with ESMTP id BAA18032
	for <FreeBSD-net-jp@jp.freebsd.org>; Thu, 19 Jul 2001 01:18:55 +0900 (JST)
Message-Id: <4.3.2-J.20010719010158.00c55b40@mail.netwave.or.jp>
X-Sender: kana/mail.netwave.or.jp@pop3.norton.antivirus (Unverified)
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2-J
Date: Thu, 19 Jul 2001 01:18:23 +0900
To: FreeBSD-net-jp@jp.freebsd.org
From: Kana Akira <kana@mail.netwave.or.jp>
Mime-Version: 1.0
Content-Type: text/plain; charset="ISO-2022-JP"
Content-Transfer-Encoding: 7bit
Reply-To: FreeBSD-net-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+010328
X-Sequence: FreeBSD-net-jp 3233
Subject: [FreeBSD-net-jp 3233]  IPFW+NATD =?ISO-2022-JP?B?GyRCJEcbKEI=?=
 =?ISO-2022-JP?B?GyRCRmJJdCRLGyhC?= Firewall
 =?ISO-2022-JP?B?GyRCJHI5PUNbGyhC?= 
Errors-To: owner-FreeBSD-net-jp@jp.freebsd.org
Sender: owner-FreeBSD-net-jp@jp.freebsd.org
X-Originator: kana@mail.netwave.or.jp

$B$O$8$a$^$7$F!#!!2CL>(B $B$H?=$7$^$9!#(B
IPFW$B!\(BNATD$B$G%"%I%P%$%9D:$-$?$$$N$G$9$,!&!&!&(B

$B2q<R$N(BLAN$B$r(BCATV$B$N%M%C%H%o!<%/$K@\B3$9$k$3$H$K$J$j!"(B
MAIL$B%5!<%P!J7s(BDNS+WWW+POP3$B!K$r(BFreeBSD$B$G9=C[$9$k$3$H$K$J$j$^$7$?!#(B
$B@\B3?^$O0J2<$G$9$,!"%m!<%+%k%k!<%?$N(BIP$B%^%9%+%l!<%I5!G=$r;H$C$F(B
Win9x$B7O$N%Q%=%3%s$O%$%s%?!<%M%C%H$K=P$F9T$1$k$h$&$K$9$kM=Dj$G$9!#(B

              CATV$B%M%C%H%o!<%/(B
                |
                |  211.XXX.YYY.ZZZ$B!J%0%m!<%P%k%"%I%l%9!K(B
            +---+---+
            |       |  $B%V%m!<%I%P%s%I%k!<%?!J"(%m!<%+%k%k!<%?!K(B
            +---+---+
                |  192.168.1.1
                |
        +-------+------------------------+-------- $B!A(B -------+
        |192.168.1.20                    |192.168.1.100      |
    +---+---+                        +---+---+           +---+---+
    |FreeBSD| IPFW+NATD              |Win9x  |     $B!A(B    |Win2000|
    +---+---+                        +-------+           +-------+
        |192.168.5.1              $B"((B Win9x $B$d(B Win2000 $B$O(B DHCP$B$G(B
        |$B!!!!!!!!!!!!!!!!!!!!!!!!!!!!(B192.168.1.100->192.168.1.150
        |192.168.5.10$B!!!!!!!!!!!!!!!!$NHO0O$G%"%I%l%9$,3d$jEv$F$i$l$k(B
    +---+---+
    |FreeBSD| MAIL$B%5!<%P!J7s(BDNS+WWW+POP3$B!K(B
    +-------+ 

$B$G!":G=i$K9=@.$r9M$($?$H$-$O!"(BIPFW+NATD$B$N%5!<%P$OL5$/!"(BMAIL$B%5!<%P$r(B
192.168.1.20$B$G9=C[$7!"%"%I%l%9(B:211.XXX.YYY.ZZZ$B$N%]!<%H(B:80,25,110,53$B$X(B
$B$N%"%/%;%9$r%m!<%+%k%k!<%?$N(BForwarding$B5!G=$r;H$C$F(B 192.168.1.20 $B$K(B
$B?6$C$F$d$m$&$H9M$($^$7$?!#(B
$B$7$+$7$3$l$@$H!"(BMAIL$B%5!<%P$,%O%C%-%s%0$5$l$?>l9g$K!"(BWin9x$B7O$N%Q%=%3%s(B
$B$d$=$l0J30$N%5!<%P$J$I$K$b%"%/%;%9$G$-$=$&$K;W$$$^$9!#!!(B
$B$G!"(BMAIL$B%5!<%P$,%O%C%-%s%0$5$l$F$b(B 192.168.1.xxx$B7O$K$O%"%/%;%9$G$-$J$$(B
$B$h$&$K$9$k$?$a$K!">e?^$N$h$&$J(BIPFW+NATD$B$N%5!<%P$rFbIt$KCV$/$3$H$r9M$((B
$B$^$7$?!#(B

$B%$%s%?!<%M%C%HB&$+$i(B 211.XXX.YYY.ZZZ $B$N%]!<%H(B:80,25,110,53 $B$X%"%/%;%9(B
$B$,$-$?$i!"$^$:%m!<%+%k%k!<%?$N(BForwarding$B5!G=$G(B 192.168.1.20 $B$N%5!<%P(B
$B$K?6$j$^$9!#<!$K(B192.168.1.20$B$N%5!<%P$O!"(BNATD $B$N(BREDIRECT_PORT$B5!G=$r;H$$(B
192.168.5.10 $B$N%5!<%P$K?6$C$F$d$k$H$$$&N.$l$G$9!#(B

IPFW+NATD$B$N%5!<%P$G$O0J2<$N$h$&$J@_Dj$r9M$($?$N$G$9$,!"%;%-%e%j%F%#>e(B
$BLdBj$N$"$j$=$&$JItJ,$O$"$j$^$;$s$G$7$g$&$+!)!!(B
CATV$B$G@\B3$5$l$F$$$kJ}$bB?$$$H;W$$$^$9$,!">e5-$N$h$&$J9=@.$O0lHLE*$G(B
$B$7$g$&$+!)!!30B&$O%0%m!<%P%k%"%I%l%9!"FbB&$O%W%i%$%Y!<%H%"%I%l%9$H$$$&(B
$B9=@.$O$h$/8+$+$1$k$N$G$9$,!"30B&FbB&6&%W%i%$%Y!<%H%"%I%l%9$J$N$G!"2?$+(B
$B8+Mn$H$7$,$"$j$=$&$J5$$b$7$^$9$7!"<~$j$KJ9$1$k?M$b$*$i$:!"<+J,0l?M$G(B
$B9M$($?9=@.$J$N$G>/$7IT0B$,$"$j$^$9!#(B
$B$I$J$?$+%5!<%P9=@.$b4^$a%"%I%P%$%9$r$$$?$@$1$k$H$"$j$,$?$$$N$G$9$,!&!&(B
$B$h$m$7$/$*4j$$$7$^$9!#(B

$B$J$*30It$+$i(BPOP$B$G@\B3$G$-$k$h$&$K$7$F$$$k$N$O%;%-%e%j%F%#>eLdBj$"$j$G(B
$B$9$,$I$&$7$F$bI,MW$J$N$G5v$7$F$$$^$9!#(B

$B"((B $B0J2<$O(BIPFW+NATD$B$r9=C[$7$?%5!<%P!J(BFreeBSD 4.3-RELEASE$B!K$N@_Dj$G$9!#(B

<< /etc/rc.conf $B$NDj5A(B >>

defaultrouter="192.168.1.1"
hostname="mail.XXXXXXXXXX.co.jp"
ifconfig_vr0="inet 192.168.1.20  netmask 255.255.255.0"
ifconfig_ed1="inet 192.168.5.1  netmask 255.255.255.0"
inetd_enable="NO"
kern_securelevel="1"
kern_securelevel_enable="YES"
named_enable="NO"
nfs_server_enable="NO"
portmap_enable="NO"
sendmail_enable="NO"
sshd_enable="NO"
natd_enable="YES"
natd_interface="vr0"
natd_flags="-log -f /etc/natd.conf"
firewall_enable="YES"
firewall_type="/etc/firewall.natd"
firewall_quiet="YES"
firewall_logging="YES"
gateway_enable="YES"


<< /etc/natd.conf $B$NDj5A(B >>

log yes
verbose no
deny_incoming yes
log_denied yes
log_facility security
same_ports yes
redirect_port tcp 192.168.5.10:80  80
redirect_port tcp 192.168.5.10:110 110
redirect_port tcp 192.168.5.10:25 25
redirect_port tcp 192.168.5.10:23 23
redirect_port tcp 192.168.5.10:21 21
redirect_port tcp 192.168.5.10:20 20
redirect_port tcp 192.168.5.10:53 53
redirect_port udp 192.168.5.10:53 53


<< /etc/firewall.natd $B$NDj5A(B >>

# MAIL$B%5!<%P$H(BWin9x$B%Q%=%3%s4V$N(BNetbios$B7ODL?.$rGK4~(B
add deny      udp from any              to any 137-139,445
add deny      tcp from any              to any 137-139,445
add deny      udp from any  137-139,445 to any
add deny      tcp from any  137-139,445 to any

# IP$B%"%I%l%9$r56$C$?$b$N$rGK4~(B
add deny  log all from 192.168.5.0/24   to any         in via vr0
add deny  log all from 192.168.1.0/24   to any         in via ed1

# $B%U%i%0%a%s%H$5$l$?%Q%1%C%H$r<WCG(B
add deny  log all from any              to any              frag

# $B%W%i%$%Y!<%H%"%I%l%9$d%^%k%A%-%c%9%HEy$rGK4~(B
# $B$?$@$7(B192.168.0.0/16$B8~$1$OGK4~$7$J$$(B
add deny      all from any              to 10.0.0.0/8     via vr0
add deny      all from any              to 172.16.0.0/12  via vr0
add deny      all from any              to 0.0.0.0/8      via vr0
add deny      all from any              to 169.254.0.0/16 via vr0
add deny      all from any              to 192.0.2.0/24   via vr0
add deny      all from any              to 224.0.0.0/4    via vr0
add deny      all from any              to 240.0.0.0/4    via vr0

# $BFbIt$N(BWin9x$B7O!J(B192.168.1.0/24$B!K$+$i$O!"%5!<%PJ]<iMQ$K(Bftp$B!"(BTelnet$B$r(B
# $B5v2D$9$k!#!J$h$C$F(B 192.168.1.0/24 $B$G$J$$$N$OGK4~!K(B 
add deny log tcp from not 192.168.1.0/24 to 192.168.1.20 21 via vr0 setup
add deny log tcp from not 192.168.1.0/24 to 192.168.1.20 23 via vr0 setup

# $B!z!z(B NAT$B!!(BDIVERT$B!J30B&(Bvr0$B%$%s%?%U%'!<%9!K!z!z(B
add divert 8668 log all from any  to any via vr0

# $B%W%i%$%Y!<%H%"%I%l%9$d%^%k%A%-%c%9%HEy$rGK4~(B
# $B$?$@$7(B192.168.0.0/16 $B$OGK4~$7$J$$(B
add deny  log all from 10.0.0.0/8       to any            via vr0
add deny  log all from 172.16.0.0/12    to any            via vr0
add deny  log all from 0.0.0.0/8        to any            via vr0
add deny  log all from 169.254.0.0/16   to any            via vr0
add deny  log all from 192.0.2.0/24     to any            via vr0
add deny  log all from 224.0.0.0/4      to any            via vr0
add deny  log all from 240.0.0.0/4      to any            via vr0

# TCP$B%;%C%7%g%s$,3NN)$5$l$?$b$N$O5v2D(B
add allow log tcp from any              to any             established

# MAIL$B%5!<%P$X$N(BSMTP$B@\B33+;O$r5v2D(B
add allow log tcp from any              to 192.168.5.10  25 setup

# MAIL$B%5!<%P$+$i$N(BSMTP$B@\B33+;O$r5v2D(B
# $B$5$i$K!"$=$l$,(BDIVERT$B$5$l$?7k2L$b5v2D(B
add allow log tcp from 192.168.5.10     to any           25 setup
add allow log tcp from 192.168.1.20     to any           25 setup

# IDENT $B$K$OEz$($J$$(B
add reset     tcp from any              to any          113

# WWW$B%5!<%P$X$N(BHTTP$B@\B33+;O$r5v2D(B
add allow log tcp from any              to 192.168.5.10  80 setup

# POP$B%5!<%P$X$N(BPOP$B@\B33+;O$r5v2D(B
add allow log tcp from any              to 192.168.5.10 110 setup

# DNS$B%5!<%P$X$N(BTCP$B@\B33+;O$r5v2D(B
add allow log tcp from any              to 192.168.5.10  53 setup

# DNS$B%5!<%P$X$NLd$$9g$o$;$r5v2D(B
add allow log udp from any              to 192.168.5.10  53

# DNS$B%5!<%P$+$i$N1~Ez$r5v2D(B
# $B$5$i$K!"$=$N1~Ez$,(BDIVERT$B$5$l$?7k2L$b5v2D(B
add allow log udp from 192.168.5.10  53 to any
add allow log udp from 192.168.1.20  53 to any

# DNS$B%5!<%P$+$i30It$X$NLd$$9g$o$;$r5v2D(B
# $B$5$i$K!"$=$l$,(BDIVERT$B$5$l$?7k2L$b5v2D(B
add allow log udp from 192.168.5.10     to any           53
add allow log udp from 192.168.1.20     to any           53

# $B30It(BDNS$B%5!<%P$+$i$N1~Ez$r5v2D(B
add allow log udp from any           53 to 192.168.5.10

# $B!z7k6I(BDNS$B4X78$O(B
# $B!z(Badd allow udp from any    to any 53
# $B!z(Badd allow udp from any 53 to any
# $B!z$G:Q$_$=$&$J5$$,$7$^$9$,!"$3$l$@$H2?$G$bDL$7$F$7$^$$$=$&$G(B
# $B!zIT0B$J$N$G$9$,!"$I$&$9$k$N$,$$$$$N$G$7$g$&!)(B

# $BFbIt$N(BWin9x$B7O!J(B192.168.1.0/24$B!K$+$i$O!"%5!<%PJ]<iMQ$K(Bftp$B!"(BTelnet$B$r(B
# $B5v2D(B 
add allow log tcp from 192.168.1.0/24   to 192.168.5.10  23 setup
add allow log tcp from 192.168.1.0/24   to 192.168.5.10  21 setup

# $B>e5-0J30$N(BTCP$B@\B33+;O$rGK4~(B
add deny  log tcp from any              to any   in via vr0 setup

# $BFbIt$+$i30It$X$N(B ping $B$H$=$N1~Ez$N$_$r5v2D(B
add allow log icmp from any             to any      via ed1
add allow log icmp from any             to any  out via vr0 icmptypes 8
add allow log icmp from any             to any   in via vr0 icmptypes 0
add allow log icmp from any             to any   in via vr0 icmptypes 3

# $B>e5-0J30$N(B ICMP $B$OGK4~(B
add deny  log icmp from any             to any

# $B>e5-0J30$OGK4~(B
add deny  log all from any              to any

###### $B$3$3$^$G$G$9(B ######

