🈵 🔥 🚨 Freebsd. Memfilter lalu lintas PF 👩🏽‍🔧 👨‍⚖️ 🏘️

pengantar

FreeBSD PF Firewall
Filter lalu lintas PF <- Anda di sini

Di artikel terakhir, kami menganalisis apa itu PF secara umum, fitur utamanya, dan membuat konfigurasi sederhana yang menggunakan aturan pemfilteran dan makro. Hari ini kita akan berurusan dengan tag dan mempelajari cara memfilter lalu lintas yang lebih maju dengan berbagai kondisi. Terima kasih kepada pengguna yang mengomentari artikel sebelumnya atas minat mereka.

Kali ini, mari coba opsi berbeda untuk pemfilteran yang lebih canggih:

Makro di berbagai tempat di file konfigurasi.
Daftar adalah sekumpulan parameter. PF akan mengembangkannya menjadi aturan terpisah.
Aturan membatasi jumlah koneksi dari satu IP, frekuensinya.
Tabel. Ini adalah daftar alamat IP yang dapat dibandingkan dengan aturan. Opsi pengisian dinamis yang memungkinkan. Dan memeriksa status tabel kami.

Tugasnya akan seperti ini:

Izinkan akses dari IP tepercaya ke port mana pun
Buat pemuatan daftar larangan dari file
crm api 8080 8443
80 443 CRM API
- 22 -
DDOS DOS 80 443, -

, .

. ( ) . , IP ( ), tcp, . IP , .

# macros section
If="re0" #   
IfIp="192.169.12.10" # IP  
permit_tcp_ports="22,53"
permit_udp_ports="53,123"
web_ports = "http,https"

pass in on $IfIp inet proto tcp from any to $IfIp port {$permit_tcp_ports}

pfctl -sr
...
pass in on re0 inet proto tcp from any to 192.169.12.10 port = ssh flags S/SA keep state
pass in on re0 inet proto tcp from any to 192.169.12.10 port = domain flags S/SA keep state
...

, . , . . flags tcp , . S/SA — SYN. , , .

Keep state — . , . (state table), .

quick. , . :

pass in quick on em0 from { 192.168.1.0/24 } to 192.168.1.1

— PF. , , . , , , , , , . .

const — . IP " "
counters — IP
persist — ,

persist. .

# ,   
table <admins> { 173.18.12.22, 173.18.12.45 }

pass in quick on $If from <admins> to $IfIp

, IP , , IP .

# ,     
table <block_list> file "/etc/pf.blocklist.conf"

block in quick on $If from <block_list> to any

<simple-ban> $If

# cat /etc/pf.blocklist.conf
1.1.1.1
111.12.46.0/24
!111.12.46.17

. IP 1.1.1.1, 111.12.46.0/24, IP 111.12.46.17. . :

pfctl -t block_list -T replace -f /etc/pf.blocklist.conf
3 addresses added.

IP , . . cron , . , , :

# cat  /etc/pf.blocklist.conf
ya.ru
1.2.3.4
mail.ru

, :

# pfctl -t blocklist -T show
   1.2.3.4
   87.250.250.242
   94.100.180.200
   94.100.180.201
   217.69.139.200
   217.69.139.202
   2a00:1148:db00:0:b0b0::1
   2a02:6b8::2:242

/ :

# pfctl -t blocklist -T add 123.12.34.5
# pfctl -t blocklist -T delete 123.12.34.5

, , .

IP . .

# pfctl -t blocklist -T test 1.2.3.4
1/1 addresses match.

# pfctl -t blocklist -T test 1.1.1.1
0/1 addresses match.

# pfctl -t blocklist -T test ya.ru
2/2 addresses match.

# pfctl -t blocklist -T test 1.1.1.1 1.2.3.4
1/2 addresses match.

cron :

# cat /etc/crontab
...
0 * * * * root /sbin/pfctl -t block_list -T replace -f /etc/pf.blocklist.conf
...

http(s) 8080 8443. , :

permit_corp_ports ="http,https" #     . 
permit_add_tcp_ports = "8080,8443" #  ,

, , :

table <corp_res> file "/etc/pf.corpres.conf" #  ,   http(s)

, :

# cat /etc/pf.corpres.conf
example.com

pass in quick on $If proto tcp from <corp_res> to $IfIp ports { $permit_add_tcp_ports }
pass out quick on $If proto tcp from $IfIp to <corp_res> port { $permit_corp_ports }

. ssh. PF — , , .

table <block_ssh> persist #  ssh.   , PF  .        persist

persist — , . , PF .

block in quick on $If proto tcp from <block_ssh> to any port 22
pass in on $If proto tcp to $IfIp port { 22 } \
           keep state (max-src-conn 10, max-src-conn-rate 3/10, \
           overload <block_ssh> flush)

max-src-conn 10 — 10 , max-src-conn-rate 3/10 — 3 10 , overload <block_ssh> — , flush — , .

— -.

table <block_web> persist #

#   
block in quick on $If from <block_web>
pass in on $If proto tcp to $IfIp port { $permit_tcp_ports } \
           synproxy state (max-src-conn 100, max-src-conn-rate 20/1, \
           overload <block_web> flush global)

. Synproxy — syn , synflood . flush global -, .

pfctl -t block_ssh -T expire 3600

, . :

...
0 * * * * root /sbin/pfctl -t block_ssh -T expire 3600
0 * * * * root /sbin/pfctl -t block_web -T expire 3600
...

# cat /etc/pf.conf
# macros section
If="re0" #   
IfIp="192.169.12.10" # ip  
permit_tcp_ports="22,53"
permit_udp_ports="53,123"
web_ports = "http,https"
permit_corp_ports ="http,https"
permit_add_tcp_ports = "8080,8443"

# table section
# ,   
table <admins> { 192.168.11.0/24, 173.18.12.22, 173.18.12.45 }
# ,     ,  
table <block_list>  file "/etc/pf.blocklist.conf"
#  ,   hppt(s)
table <corp_res> file "/etc/pf.corpres.conf"
#  ssh.   , PF  .
#       persist
table <block_ssh> persist
#    
table <block_web> persist 

# options section
#    ,     
set block-policy return
#     ,     
set skip on lo0 

# scrub section
scrub in all #    

# Queueing section
#    

# nat section
# ,    

# filtering section
#    , ,
#       .
block all

#      
#   quick -     .
pass in quick on $If from <admins> to $IfIp 
pass in quick on $If proto tcp from <corp_res> to $IfIp \
           port { $permit_add_tcp_ports }

#  ssh    
block in quick on $If proto tcp from <block_ssh> port 22
pass in on $If proto tcp to $IfIp port { 22 } \
           keep state (max-src-conn 10, max-src-conn-rate 3/10, \
           overload <block_ssh> flush)

#  Web      
block in quick on $If from <block_web>
pass in on $If proto tcp to $IfIp port { $web_ports } \
           keep state (max-src-conn 100, max-src-conn-rate 20/1, \
           overload <block_web> flush global)

#      
pass out quick on $If proto tcp from $IfIp to <corp_res> port { $permit_corp_ports }

#     
#    udp#    tcp
pass out proto udp to port { $permit_tcp_ports }
#    udp
pass out proto udp to port { $permit_udp_ports } 
pass out inet proto icmp #   icmp

, .

# pfctl -nf pf.conf

# pfctl -f pf.conf

PF . . , . . 35 9 .

, (NAT). , !

Freebsd. Memfilter lalu lintas PF

pengantar

More articles: