Linux中國
如何在 FreeBSD 上設置 PF 防火牆來保護 Web 伺服器
我是從 Linux 遷移過來的 FreeBSD 新用戶，Linux 中使用的是 netfilter 防火牆框架（LCTT 譯註：netfilter 是由 Rusty Russell 提出的 Linux 2.4 內核防火牆框架）。那麼在 FreeBSD 上，我該如何設置 PF 防火牆，來保護只有一個公共 IP 地址和埠的 web 伺服器呢？
PF 是 包過濾器 的簡稱。它是為 OpenBSD 開發的，但是已經被移植到了 FreeBSD 以及其它操作系統上。PF 是一個包狀態過濾引擎。在這篇教程中，我將向你展示如何在 FreeBSD 10.x 以及 11.x 中設置 PF 防火牆，從而來保護 web 伺服器。
第一步：開啟 PF 防火牆
你需要把下面這幾行內容添加到文件 /etc/rc.conf 文件中：
# echo 'pf_enable="YES"' >> /etc/rc.conf
# echo 'pf_rules="/usr/local/etc/pf.conf"' >> /etc/rc.conf
# echo 'pflog_enable="YES"' >> /etc/rc.conf
# echo 'pflog_logfile="/var/log/pflog"' >> /etc/rc.conf在這裡：
pf_enable="YES"- 開啟 PF 服務pf_rules="/usr/local/etc/pf.conf"- 從文件/usr/local/etc/pf.conf中讀取 PF 規則pflog_enable="YES"- 為 PF 服務打開日誌支持pflog_logfile="/var/log/pflog"- 存儲日誌的文件，即日誌存於文件/var/log/pflog中
第二步：在 /usr/local/etc/pf.conf 文件中創建防火牆規則
輸入下面這個命令打開文件（超級用戶模式下）：
# vi /usr/local/etc/pf.conf在文件中添加下面這些 PF 規則集：
# vim: set ft=pf
# /usr/local/etc/pf.conf
## 設置公共埠 ##
ext_if="vtnet0"
## 設置伺服器公共 IP 地址 ##
ext_if_ip="172.xxx.yyy.zzz"
## 設置並刪除下面這些公共埠上的 IP 範圍 ##
martians = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12,
10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24,
0.0.0.0/8, 240.0.0.0/4 }"
## 設置 http(80)/https (443) 埠 ##
webports = "{http, https}"
## 啟用下面這些服務 ##
int_tcp_services = "{domain, ntp, smtp, www, https, ftp, ssh}"
int_udp_services = "{domain, ntp}"
## 跳過迴環埠 - 跳過埠上的所有 PF 處理 ##
set skip on lo
## 設置 PF 應該統計的埠信息，如發送/接收位元組數，通過/禁止的包的數目 ##
set loginterface $ext_if
## 設置默認策略 ##
block return in log all
block out all
# 基於 IP 分片的錯誤處理來防禦攻擊
scrub in all
# 刪除所有不可達路由地址
block drop in quick on $ext_if from $martians to any
block drop out quick on $ext_if from any to $martians
## 禁止欺騙包
antispoof quick for $ext_if
# 打開 SSH 埠，SSH 服務僅從 VPN IP 139.xx.yy.zz 監聽 22 號埠
# 出於安全原因，我不允許/接收 SSH 流量
pass in quick on $ext_if inet proto tcp from 139.xxx.yyy.zzz to $ext_if_ip port = ssh flags S/SA keep state label "USER_RULE: Allow SSH from 139.xxx.yyy.zzz"
## 使用下面這些規則來為所有來自任何 IP 地址的用戶開啟 SSH 服務 #
## pass in inet proto tcp to $ext_if port ssh
### [ OR ] ###
## pass in inet proto tcp to $ext_if port 22
# Allow Ping-Pong stuff. Be a good sysadmin
pass inet proto icmp icmp-type echoreq
# All access to our Nginx/Apache/Lighttpd Webserver ports
pass proto tcp from any to $ext_if port $webports
# 允許重要的發送流量
pass out quick on $ext_if proto tcp to any port $int_tcp_services
pass out quick on $ext_if proto udp to any port $int_udp_services
# 在下面添加自定義規則保存並關閉文件。歡迎來參考我的規則集。如果要檢查語法錯誤，可以運行：
# service pf check或
/etc/rc.d/pf check或
# pfctl -n -f /usr/local/etc/pf.conf第三步：開始運行 PF 防火牆
命令如下。請小心，如果是基於 SSH 的會話，你可能會和伺服器斷開連接。
開啟 PF 防火牆：
# service pf start停用 PF 防火牆：
# service pf stop檢查語法錯誤：
# service pf check重啟服務：
# service pf restart查看 PF 狀態：
# service pf status示例輸出：
Status: Enabled for 0 days 00:02:18 Debug: Urgent
Interface Stats for vtnet0 IPv4 IPv6
Bytes In 19463 0
Bytes Out 18541 0
Packets In
Passed 244 0
Blocked 3 0
Packets Out
Passed 136 0
Blocked 12 0
State Table Total Rate
current entries 1
searches 395 2.9/s
inserts 4 0.0/s
removals 3 0.0/s
Counters
match 19 0.1/s
bad-offset 0 0.0/s
fragment 0 0.0/s
short 0 0.0/s
normalize 0 0.0/s
memory 0 0.0/s
bad-timestamp 0 0.0/s
congestion 0 0.0/s
ip-option 0 0.0/s
proto-cksum 0 0.0/s
state-mismatch 0 0.0/s
state-insert 0 0.0/s
state-limit 0 0.0/s
src-limit 0 0.0/s
synproxy 0 0.0/s
map-failed 0 0.0/s開啟/關閉/重啟 pflog 服務的命令
輸入下面這些命令：
# service pflog start
# service pflog stop
# service pflog restart第四步：pfctl 命令的簡單介紹
你需要使用 pfctl 命令來查看 PF 規則集和參數配置，包括來自 包過濾器 的狀態信息。讓我們來看一下所有常見命令：
顯示 PF 規則信息
# pfctl -s rules示例輸出：
block return in log all
block drop out all
block drop in quick on ! vtnet0 inet from 172.xxx.yyy.zzz/24 to any
block drop in quick inet from 172.xxx.yyy.zzz/24 to any
pass in quick on vtnet0 inet proto tcp from 139.aaa.ccc.ddd to 172.xxx.yyy.zzz/24 port = ssh flags S/SA keep state label "USER_RULE: Allow SSH from 139.aaa.ccc.ddd"
pass inet proto icmp all icmp-type echoreq keep state
pass out quick on vtnet0 proto tcp from any to any port = domain flags S/SA keep state
pass out quick on vtnet0 proto tcp from any to any port = ntp flags S/SA keep state
pass out quick on vtnet0 proto tcp from any to any port = smtp flags S/SA keep state
pass out quick on vtnet0 proto tcp from any to any port = http flags S/SA keep state
pass out quick on vtnet0 proto tcp from any to any port = https flags S/SA keep state
pass out quick on vtnet0 proto tcp from any to any port = ftp flags S/SA keep state
pass out quick on vtnet0 proto tcp from any to any port = ssh flags S/SA keep state
pass out quick on vtnet0 proto udp from any to any port = domain keep state
pass out quick on vtnet0 proto udp from any to any port = ntp keep state顯示每條規則的詳細內容
# pfctl -v -s rules在每條規則的詳細輸出中添加規則編號：
# pfctl -vvsr show顯示狀態信息
# pfctl -s state
# pfctl -s state | more
# pfctl -s state | grep 'something'如何在命令行中禁止 PF 服務
# pfctl -d如何在命令行中啟用 PF 服務
# pfctl -e如何在命令行中刷新 PF 規則/NAT/路由表
# pfctl -F all示例輸出：
rules cleared
nat cleared
0 tables deleted.
2 states cleared
source tracking entries cleared
pf: statistics cleared
pf: interface flags reset如何在命令行中僅刷新 PF 規則
# pfctl -F rules如何在命令行中僅刷新隊列
# pfctl -F queue如何在命令行中刷新統計信息（它不是任何規則的一部分）
# pfctl -F info如何在命令行中清除所有計數器
# pfctl -z clear第五步：查看 PF 日誌
PF 日誌是二進位格式的。使用下面這一命令來查看：
# tcpdump -n -e -ttt -r /var/log/pflog示例輸出：
Aug 29 15:41:11.757829 rule 0/(match) block in on vio0: 86.47.225.151.55806 > 45.FOO.BAR.IP.23: S 757158343:757158343(0) win 52206 [tos 0x28]
Aug 29 15:41:44.193309 rule 0/(match) block in on vio0: 5.196.83.88.25461 > 45.FOO.BAR.IP.26941: S 2224505792:2224505792(0) ack 4252565505 win 17520 (DF) [tos 0x24]
Aug 29 15:41:54.628027 rule 0/(match) block in on vio0: 45.55.13.94.50217 > 45.FOO.BAR.IP.465: S 3941123632:3941123632(0) win 65535
Aug 29 15:42:11.126427 rule 0/(match) block in on vio0: 87.250.224.127.59862 > 45.FOO.BAR.IP.80: S 248176545:248176545(0) win 28200 <mss 1410,sackOK,timestamp 1044055305 0,nop,wscale 8> (DF)
Aug 29 15:43:04.953537 rule 0/(match) block in on vio0: 77.72.82.22.47218 > 45.FOO.BAR.IP.7475: S 1164335542:1164335542(0) win 1024
Aug 29 15:43:05.122156 rule 0/(match) block in on vio0: 77.72.82.22.47218 > 45.FOO.BAR.IP.7475: R 1164335543:1164335543(0) win 1200
Aug 29 15:43:37.302410 rule 0/(match) block in on vio0: 94.130.12.27.18080 > 45.FOO.BAR.IP.64857: S 683904905:683904905(0) ack 4000841729 win 16384 <mss 1460>
Aug 29 15:44:46.574863 rule 0/(match) block in on vio0: 77.72.82.22.47218 > 45.FOO.BAR.IP.7677: S 3451987887:3451987887(0) win 1024
Aug 29 15:44:46.819754 rule 0/(match) block in on vio0: 77.72.82.22.47218 > 45.FOO.BAR.IP.7677: R 3451987888:3451987888(0) win 1200
Aug 29 15:45:21.194752 rule 0/(match) block in on vio0: 185.40.4.130.55910 > 45.FOO.BAR.IP.80: S 3106068642:3106068642(0) win 1024
Aug 29 15:45:32.999219 rule 0/(match) block in on vio0: 185.40.4.130.55910 > 45.FOO.BAR.IP.808: S 322591763:322591763(0) win 1024
Aug 29 15:46:30.157884 rule 0/(match) block in on vio0: 77.72.82.22.47218 > 45.FOO.BAR.IP.6511: S 2412580953:2412580953(0) win 1024 [tos 0x28]
Aug 29 15:46:30.252023 rule 0/(match) block in on vio0: 77.72.82.22.47218 > 45.FOO.BAR.IP.6511: R 2412580954:2412580954(0) win 1200 [tos 0x28]
Aug 29 15:49:44.337015 rule 0/(match) block in on vio0: 189.219.226.213.22640 > 45.FOO.BAR.IP.23: S 14807:14807(0) win 14600 [tos 0x28]
Aug 29 15:49:55.161572 rule 0/(match) block in on vio0: 5.196.83.88.25461 > 45.FOO.BAR.IP.40321: S 1297217585:1297217585(0) ack 1051525121 win 17520 (DF) [tos 0x24]
Aug 29 15:49:59.735391 rule 0/(match) block in on vio0: 36.7.147.209.2545 > 45.FOO.BAR.IP.3389: SWE 3577047469:3577047469(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK> (DF) [tos 0x2 (E)]
Aug 29 15:50:00.703229 rule 0/(match) block in on vio0: 36.7.147.209.2546 > 45.FOO.BAR.IP.3389: SWE 1539382950:1539382950(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK> (DF) [tos 0x2 (E)]
Aug 29 15:51:33.880334 rule 0/(match) block in on vio0: 45.55.22.21.53510 > 45.FOO.BAR.IP.2362: udp 14
Aug 29 15:51:34.006656 rule 0/(match) block in on vio0: 77.72.82.22.47218 > 45.FOO.BAR.IP.6491: S 151489102:151489102(0) win 1024 [tos 0x28]
Aug 29 15:51:34.274654 rule 0/(match) block in on vio0: 77.72.82.22.47218 > 45.FOO.BAR.IP.6491: R 151489103:151489103(0) win 1200 [tos 0x28]
Aug 29 15:51:36.393019 rule 0/(match) block in on vio0: 60.191.38.78.4249 > 45.FOO.BAR.IP.8000: S 3746478095:3746478095(0) win 29200 (DF)
Aug 29 15:51:57.213051 rule 0/(match) block in on vio0: 24.137.245.138.7343 > 45.FOO.BAR.IP.5358: S 14134:14134(0) win 14600
Aug 29 15:52:37.852219 rule 0/(match) block in on vio0: 122.226.185.125.51128 > 45.FOO.BAR.IP.23: S 1715745381:1715745381(0) win 5840 <mss 1420,sackOK,timestamp 13511417 0,nop,wscale 2> (DF)
Aug 29 15:53:31.309325 rule 0/(match) block in on vio0: 189.218.148.69.377 > 45.FOO.BAR.IP5358: S 65340:65340(0) win 14600 [tos 0x28]
Aug 29 15:53:31.809570 rule 0/(match) block in on vio0: 13.93.104.140.53184 > 45.FOO.BAR.IP.1433: S 39854048:39854048(0) win 1024
Aug 29 15:53:32.138231 rule 0/(match) block in on vio0: 13.93.104.140.53184 > 45.FOO.BAR.IP.1433: R 39854049:39854049(0) win 1200
Aug 29 15:53:41.459088 rule 0/(match) block in on vio0: 77.72.82.22.47218 > 45.FOO.BAR.IP.6028: S 168338703:168338703(0) win 1024
Aug 29 15:53:41.789732 rule 0/(match) block in on vio0: 77.72.82.22.47218 > 45.FOO.BAR.IP.6028: R 168338704:168338704(0) win 1200
Aug 29 15:54:34.993594 rule 0/(match) block in on vio0: 212.47.234.50.5102 > 45.FOO.BAR.IP.5060: udp 408 (DF) [tos 0x28]
Aug 29 15:54:57.987449 rule 0/(match) block in on vio0: 51.15.69.145.5100 > 45.FOO.BAR.IP.5060: udp 406 (DF) [tos 0x28]
Aug 29 15:55:07.001743 rule 0/(match) block in on vio0: 190.83.174.214.58863 > 45.FOO.BAR.IP.23: S 757158343:757158343(0) win 27420
Aug 29 15:55:51.269549 rule 0/(match) block in on vio0: 142.217.201.69.26112 > 45.FOO.BAR.IP.22: S 757158343:757158343(0) win 22840 <mss 1460>
Aug 29 15:58:41.346028 rule 0/(match) block in on vio0: 169.1.29.111.29765 > 45.FOO.BAR.IP.23: S 757158343:757158343(0) win 28509
Aug 29 15:59:11.575927 rule 0/(match) block in on vio0: 187.160.235.162.32427 > 45.FOO.BAR.IP.5358: S 22445:22445(0) win 14600 [tos 0x28]
Aug 29 15:59:37.826598 rule 0/(match) block in on vio0: 94.74.81.97.54656 > 45.FOO.BAR.IP.3128: S 2720157526:2720157526(0) win 1024 [tos 0x28]stateful
Aug 29 15:59:37.991171 rule 0/(match) block in on vio0: 94.74.81.97.54656 > 45.FOO.BAR.IP.3128: R 2720157527:2720157527(0) win 1200 [tos 0x28]
Aug 29 16:01:36.990050 rule 0/(match) block in on vio0: 182.18.8.28.23299 > 45.FOO.BAR.IP.445: S 1510146048:1510146048(0) win 16384如果要查看實時日誌，可以運行：
# tcpdump -n -e -ttt -i pflog0如果你想了解更多信息，可以訪問 PF FAQ 和 FreeBSD HANDBOOK 以及下面這些 man 頁面：
# man tcpdump
# man pfctl
# man pf關於作者
我是 nixCraft 的創立者，一個經驗豐富的系統管理員，同時也是一位 Linux 操作系統/Unix shell 腳本培訓師。我在不同的行業與全球客戶工作過，包括 IT、教育、國防和空間研究、以及非營利組織。你可以在 Twitter、Facebook 或 Google+ 上面關注我。
via: https://www.cyberciti.biz/faq/how-to-set-up-a-firewall-with-pf-on-freebsd-to-protect-a-web-server/
作者：Vivek Gite 譯者：ucasFL 校對：wxy
本文轉載來自 Linux 中國: https://github.com/Linux-CN/archive
對這篇文章感覺如何？
太棒了
0
不錯
0
愛死了
0
不太好
0
感覺很糟
0
You may also like
More in:Linux中國
如何通過 VLC 使用字幕
使用 VLC 媒體播放器播放和管理字幕的新手指南。
Unix 桌面：在 Linux 問世之前
僅僅開源還不足以實現開放，還需開放標準和建立共識。
Valve 對於 Ubuntu 的 Snap 版本的 Steam 並不滿意：原因何在
你可能會發現，Snap 版本的 Steam 並不如你期待的那樣好，你怎麼看？
Wine 9.0 發布，實驗性地加入了 Wayland 驅動
Wine 的這個新版本正在為未來做好準備！
關注 LinuxStory 微信公眾號，獲取最新的 Linux 和操作系統資訊，每天為您帶來熱騰騰的開源新聞與新鮮溫暖的科技故事。
