From owner-FreeBSD-net-jp@jp.FreeBSD.org Thu Oct  3 18:55:10 2002
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) id g939tAt19851;
	Thu, 3 Oct 2002 18:55:10 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from via.excalibur.jp (eAc1Abt184.osk.mesh.ad.jp [218.227.119.184])
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) with SMTP/inet id g939t9319837
	for <FreeBSD-net-jp@jp.FreeBSD.org>; Thu, 3 Oct 2002 18:55:09 +0900 (JST)
	(envelope-from m_yamaji@excalibur.jp)
Received: (qmail 91579 invoked from network); 3 Oct 2002 09:55:02 -0000
Received: from mercury.excalibur.jp (HELO excalibur.jp) (192.168.1.21)
  by via.excalibur.jp with SMTP; 3 Oct 2002 09:55:02 -0000
Content-Type: text/plain; charset=ISO-2022-JP; format=flowed
Mime-Version: 1.0 (Apple Message framework v546)
From: "M.Yamaji" <m_yamaji@excalibur.jp>
To: FreeBSD-net-jp@jp.FreeBSD.org
Content-Transfer-Encoding: 7bit
In-Reply-To: <20021002.215847.112622761.you@auxo.dearest.net>
Message-Id: <2F9BB3DE-D6B6-11D6-BDE4-000393B282E6@excalibur.jp>
X-Mailer: Apple Mail (2.546)
Reply-To: FreeBSD-net-jp@jp.FreeBSD.org
Precedence: list
Date: Thu, 3 Oct 2002 18:55:02 +0900
X-Sequence: FreeBSD-net-jp 3814
Subject: [FreeBSD-net-jp 3814] Re: ppp + IP Filter
 =?ISO-2022-JP?B?GyRCJE4layE8JWskSztIJCYlJCVzGyhC?= 
Errors-To: owner-FreeBSD-net-jp@jp.FreeBSD.org
Sender: owner-FreeBSD-net-jp@jp.FreeBSD.org
X-Originator: m_yamaji@excalibur.jp
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+020902

$B;3CO$G$9!#(B

On 2002.10.2, at 21:58 Japan, Yu Ooasa wrote:

> $B$H$$$C$?>uBV$K$J$C$F$7$^$&$N$G$O!#(BDoS$B$K$J$k$/$i$$KDBg$JNL$N(B block $B$9$Y$-(B
> $B%Q%1%C%H$,2!$74s$;$F$$$k$N$J$i$H$b$+$/!"NL$NB?$$(B($B$?$$$F$$$O(B pass $B$9$Y$-(B)
> $B%Q%1%C%H$O%k!<%k$N@hF,$NJ}$G0z$C$+$1$k$H$$$&$N$,$?$V$s0lHLE*$@$H;W$$$^$9!#(B

$B$$$o$l$F$_$l$P!"3N$+$K$*$C$7$c$kDL$j$G$9!#(B
$B$=$3$G!"(Bkeep state$B$r;H$C$F(Bblock$B$r$"$^$j;H$o$J$$$h$&$K(B
$B=q$-49$($F$_$^$7$?!#(B

$B:G=*E*$K$O$3$s$J46$8$K$J$j$^$7$?!#0l1~:\$;$F$*$-$^$9!#(B
$B!JE::o$7$F$/$l$H$$$&$o$1$G$O$"$j$^$;$s$,!K(B
$BD9$/$J$k$N$G56Au%"%I%l%9$J$I$N%U%#%k%?%k!<%k$O>JN,$7$F$$$^$9!#(B

<--$B$3$3$+$i(B-->
# IP$B%*%W%7%g%sIU$-!"CGJR2=!"C;$$%Q%1%C%H$rGK4~(B
block in log quick from any to any with ipopts flag
block in log quick proto tcp from any to any with short

####################
# $B30It(B (Internet) $B$+$i$NF~NO(B (group 100)
# $B86B'5qH](B
block in quick on tun0 all head 100

# $B%"%I%l%956AuKI;_(B
$B!J>JN,!K(B
# $B%W%i%$%Y!<%H%"%I%l%9$NGK4~(B
$B!J>JN,!K(B
# $B%^%k%A%-%c%9%H$NGK4~(B
$B!J>JN,!K(B
# NetBIOS (port 137-139) $B$O$9$Y$FGK4~(B
$B!J>JN,!K(B
# $B@\B3$5$l$?(BTCP$B%Q%1%C%H$rDL$9!JITMW!)!K(B
#pass in quick proto tcp all flags A group 100

# $B30It$+$i$N(BWWW$B@\B3MW5a$rDL$9!J$D$$$G$K%;%C%7%g%s$OA4ItDL$9!K(B
pass in quick proto tcp from any to any port 80 flags S keep state 
group 100

# $B30It$+$i$N(BSMTP$B@\B3MW5a$rDL$9!JF1>e!K(B
pass in quick proto tcp from any to any port 25 flags S keep state 
group 100
# IDENT$B$K$OEz$($J$$(B
block return-rst in quick proto tcp from any to any port = 113 group 100

# $B30It$+$i$N(BPOP3$B@\B3MW5a$rDL$9!JF1>e!K(B
pass in quick proto tcp from any to any port 110 flags S keep state 
group 100

# $B30It$+$i$N(BFTP$B@\B3MW5a$rDL$9!JF1>e!K(B
pass in quick proto tcp from any to any port 21 flags S keep state 
group 100

# $B30It$+$i$N(BSSH$B@\B3MW5a$rDL$9!JF1>e!K(B
pass in quick proto tcp from any to any port 23 flags S keep state 
group 100

# $B$=$l0J30$N(BTCP$B@\B3$O$9$Y$F5qH](B
block in log quick proto tcp all group 100

# UDP$B%Q%1%C%H$O4pK\E*$K5qH](B
block in proto udp all group 100

# ICMP$B$O$9$Y$FDL$9(B
pass in quick proto icmp all keep state group 100

####################
# $B30It$X$N=PNO(B (group 200)
# $B86B'5qH](B
block out quick on tun0 all head 200

# $B%"%I%l%956B$KI;_(B
$B!J>JN,!K(B
# $B%W%i%$%Y!<%H%"%I%l%9$NGK4~(B
$B!J>JN,!K(B
# $B%^%k%A%-%c%9%H$NGK4~(B
$B!J>JN,!K(B
# NetBIOS (port 137-139)$B$O$9$Y$FGK4~(B
$B!J>JN,!K(B
# $B@\B3$5$l$?(BTCP$B%Q%1%C%H$rDL$9!JITMW!)!K(B
#pass out quick proto tcp all flags A group 200

# $B30It$N(BDNS$B%5!<%P$X$NLd$$9g$o$;$rDL$9!J$D$$$G$K%;%C%7%g%s$OA4ItDL$9!K(B
pass out quick from any to any port = 53 keep state group 200

# $B30It$X$N@\B3MW5a$rDL$9!JF1>e!K(B
pass out quick proto tcp all flags S keep state group 200

# $B30It$N(BNTP$B%5!<%P$X$NLd$$9g$o$;$rDL$9!JF1>e!K(B
pass out quick proto udp from any to any port = 123 keep state group 200

# ICMP$B$O$9$Y$FDL$9(B
pass out quick proto icmp all keep state group 200

####################
# $BFbIt$+$iMh$k%Q%1%C%H(B (group 300)
# $BFbIt%M%C%H%o!<%/$O?.MQ$G$-$k$H2>Dj(B
pass in quick on sis1 all head 300

# $B%"%I%l%956B$KI;_$@$1(B
$B!J>JN,!K(B
####################
# $BFbIt$X=P$F$f$/%Q%1%C%H(B (group 400)
# $B86B'DL2a(B
pass out quick on sis1 all head 400

# $B%"%I%l%956B$KI;_$@$1(B
$B!J>JN,!K(B
####################
# $B%k!<%W%P%C%/%$%s%?!<%U%'%$%9(B (group 0)
# $BA4ItDL$9(B
pass in quick on lo0 all
pass out quick on lo0 all
<--$B$3$3$^$G(B-->
---
$B;3CO(B $B>-O/(B <alucard@excalibur.jp>

