/usr/share/doc/HOWTO/ja-html/IPCHAINS-HOWTO-7.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
 <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.21">
 <TITLE>Linux IPCHAINS-HOWTO: $B<BMQE*$JNc(B</TITLE>
 <LINK HREF="IPCHAINS-HOWTO-8.html" REL=next>
 <LINK HREF="IPCHAINS-HOWTO-6.html" REL=previous>
 <LINK HREF="IPCHAINS-HOWTO.html#toc7" REL=contents>
</HEAD>
<BODY>
<A HREF="IPCHAINS-HOWTO-8.html">$B<!$N%Z!<%8(B</A>
<A HREF="IPCHAINS-HOWTO-6.html">$BA0$N%Z!<%8(B</A>
<A HREF="IPCHAINS-HOWTO.html#toc7">$BL\<!$X(B</A>
<HR>
<H2><A NAME="s7">7.</A> <A HREF="IPCHAINS-HOWTO.html#toc7">$B<BMQE*$JNc(B</A></H2>

<P>$B$3$NHONc$O!"(B1999 $BG/$N(B 3 $B7n$K3+:E$5$l$?(B LinuxWorld $B$G(B Michael Neuling 
$B$H;d$,H/I=$7$?%A%e!<%H%j%"%k$+$i0zMQ$7$^$7$?!#$3$l$O!"M?$($i$l$?Ld(B
$BBj$r2r7h$9$k$?$a$NM#0l$NJ}K!$G$O$J$$$G$9$,!"B?J,:G$bC1=c$J$b$N$G$9!#(B
$B$3$NHONc$rM-1W$J$b$N$@$H;W$C$FD:$1$l$P9,$$$G$9!#(B</P>



<H2><A NAME="ss7.1">7.1</A> <A HREF="IPCHAINS-HOWTO.html#toc7.1">$B9=@.(B</A>
</H2>

<P>
<UL>
<LI>$B%^%9%+%l!<%I$5$l$?FbIt%M%C%H%o!<%/(B($BMM!9$J(B OS $B$,B8:_$7$F$$$^$9(B)
$B$,B8:_$7!"(B&quot;GOOD&quot; $B$H8F$S$^$9!#(B</LI>
<LI>$BJ,N%$5$l$?%M%C%H%o!<%/>e$K8x3+%5!<%P$,B8:_$7$F$$$^$9(B($BHsIpAu2=(B
$BCOBS(B &quot;Demilitarized Zone&quot; $B$H$$$&$3$H$G(B &quot;DMZ&quot; $B$H8F$S$^$9(B)$B!#(B</LI>
<LI>$B%$%s%?!<%M%C%H$X(B PPP $B@\B3$7$F$$$^$9(B( &quot;BAD&quot; $B$H8F$S$^$9(B)$B!#(B</LI>
</UL>
</P>


<P>
<BLOCKQUOTE><CODE>
<PRE>
   $B30It%M%C%H%o!<%/(B (BAD)
           $B("(B
           $B("(B
       ppp0$B("(B
   $B(#(!(!(!(!(!(!(!($(B
   $B("(B192.84.219.1  $B("(B             $B%5!<%P%M%C%H%o!<%/(B (DMZ)
   $B("(B              $B("(Beth0
   $B("(B              $B("(!(!(!(!(!(!(!(((!(!(!(!(!(!(((!(!(!(!(!(!(((!(B
   $B("(B              $B("(B192.84.219.250$B("(B            $B("(B            $B("(B
   $B("(B              $B("(B              $B("(B            $B("(B            $B("(B 
   $B("(B192.168.1.250 $B("(B              $B("(B            $B("(B            $B("(B   
   $B(&(!(!(!(!(!(!(!(%(B          $B(#(!(!(!($(B    $B(#(!(!(!($(B    $B(#(!(!(!($(B   
           $B("(B eth1             $B("(B SMTP $B("(B    $B("(B DNS  $B("(B    $B("(B WWW  $B("(B
           $B("(B                  $B(&(!(!(!(%(B    $B(&(!(!(!(%(B    $B(&(!(!(!(%(B
           $B("(B              192.84.219.128  192.84.219.129  192.84.218.130
           $B("(B
   $BFbIt%M%C%H%o!<%/(B (GOOD)
</PRE>
</CODE></BLOCKQUOTE>
</P>


<H2><A NAME="ss7.2">7.2</A> <A HREF="IPCHAINS-HOWTO.html#toc7.2">$BL\E*(B</A>
</H2>



<P>$B%Q%1%C%H%U%#%k%?!<%^%7%s(B: </P>

<P>
<DL>
<DT><B>$BA4$F$N%M%C%H%o!<%/$KBP$7$F(B PING $B$,2DG=(B</B><DD><P>$B%^%7%s$,%@%&%s$7$F$$$k$+$I$&$+$rCN$k$N$KBgJQLr$KN)$A$^$9!#(B</P>


<DT><B>$BA4$F$N%M%C%H%o!<%/$KBP$7$F(B TRACEROUTE $B$,2DG=(B</B><DD><P>$B$3$l$b$^$?!"860xJ,@O$KLr$KN)$A$^$9!#(B</P>


<DT><B>DNS $B$X$N%"%/%;%9$,2DG=(B</B><DD><P>ping $B$H(B DNS $B$r$h$j;H$$$d$9$/$9$k$?$a$G$9!#(B</P>
</DL>
</P>


<P>DMZ $BFb(B: </P>


<P>$B%a!<%k%5!<%P(B
<UL>
<LI> $B30It%M%C%H%o!<%/$X$N(B SMTP $B$,2DG=(B</LI>
<LI> $BFbIt$H30It%M%C%H%o!<%/$+$i$N(B SMTP $B$N%"%/%;%W%H(B($B<u$1F~$l(B)$B$,2DG=(B</LI>
<LI> $BFbIt%M%C%H%o!<%/$+$i$N(B POP-3 $B$N%"%/%;%W%H$,2DG=(B</LI>
</UL>
</P>


<P>$B%M!<%`%5!<%P(B
<UL>
<LI> $B30It%M%C%H%o!<%/$X$N(B DNS $B$NMW5a$,2DG=(B</LI>
<LI> $BFbIt$H30It%M%C%H%o!<%/!"%Q%1%C%H%U%#%k%?!<%^%7%s$+$i$N(B DNS $B$N(B
$B%"%/%;%W%H$,2DG=(B</LI>
</UL>
</P>


<P>$B%&%'%V%5!<%P(B
<UL>
<LI> $BFbIt$H30It%M%C%H%o!<%/$+$i$N(B HTTP $B$N%"%/%;%W%H$,2DG=(B</LI>
<LI> $BFbIt%M%C%H%o!<%/$+$i$N(B Rsync $B$K$h$k%"%/%;%9$,2DG=(B</LI>
</UL>
 </P>


<P> $BFbIt%M%C%H%o!<%/(B: </P>

<P>
<DL>
<DT><B>$B30It%M%C%H%o!<%/$X$N(B WWW, ftp ,traceroute, ssh $B$r5v2D$9$k(B</B><DD><P>$B$3$l$i$O!"5v2D$NBP>]$H$7$F$O$+$J$jI8=`E*$J$3$H$G$9!#FbIt%M%C(B
$B%H%o!<%/>e$N%^%7%s$KBP$7$F$[$\A4$F$r5v2D$9$k$3$H$+$i;O$a$^$9(B
$B$,!"$3$3$G$O@)8B$r$+$1$F$$$^$9!#(B</P>


<DT><B>$B%a!<%k%5!<%P$X$N(B SMTP $B$r5v2D$9$k(B </B><DD><P>$BEvA3!"%a!<%k$O30It$XAw?.$G$-$k$h$&$K$7$?$$$G$9!#(B</P>


<DT><B> $B%a!<%k%5!<%P$X$N(B POP-3 $B$r5v2D$9$k(B </B><DD><P>$B%a!<%k$rFI$`J}K!$G$9!#(B</P>


<DT><B> $B%M!<%`%5!<%P$X$N(B DNS $B$r5v2D$9$k(B </B><DD><P>WWW $B$H(B ftp, traceroute, ssh $B$rMxMQ$9$k:]$K!"30It%M!<%`$N8!:w(B
$B$r$9$k$N$KI,MW$G$9!#(B</P>


<DT><B> $B%&%'%V%5!<%P$X$N(B rsync $B$r5v2D$9$k(B </B><DD><P>$B30It8~$1%&%'%V%5!<%P$HFbIt%&%'%V%5!<%P$rF14|$5$;$kJ}K!$G$9!#(B</P>

<DT><B> $B%&%'%V%5!<%P$X$N(B WWW $B$r5v2D$9$k(B </B><DD><P>$BEvA3!"30It8~$1%&%'%V%5!<%P$X@\B3$G$-$k$Y$-$G$9!#(B</P>


<DT><B> $B%Q%1%C%H%U%#%k%?!<%^%7%s$X$N(B ping $B$r5v2D$9$k(B </B><DD><P>$B$3$l$O!"0lHLE*$K9-$/MFG'$5$l$F$$$k$3$H$G$9!#$D$^$j%U%!%$%"(B
$B%&%)!<%k%^%7%s$,%@%&%s$7$F$$$k$+$I$&$+$r!"3NG'$G$-$k$h$&$K(B
$B$9$k$?$a$G$9(B($B$=$l$G30It%5%$%H$,2u$l$F$$$?>l9g$O!"HsFq$5$l$^(B
$B$;$s$N$G(B)$B!#(B</P>
</DL>
</P>


<H2><A NAME="ss7.3">7.3</A> <A HREF="IPCHAINS-HOWTO.html#toc7.3">$B%Q%1%C%H%U%#%k%?%j%s%0$r9T$&A0$K(B</A>
</H2>

<P>
<UL>
<LI> IP $B56AuJ]8n(B (Anti-spoofing)
<P>$B$$$+$J$kHsBP>N$N%k!<%F%#%s%0$b;}$C$F$$$J$$$N$G!"A4$F$N%$%s%?!<(B
$B%U%'!<%9$KBP$7$F(B IP $B56AuJ]8n$rC1$K%*%s$G$-$^$9!#(B
<BLOCKQUOTE><CODE>
<PRE>
# for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f; done
#
</PRE>
</CODE></BLOCKQUOTE>
</P>


</LI>
<LI> $B%U%#%k%?%j%s%0$N%k!<%k$H$7$FA4$F$r5qH]$K$9$k(B
<P>$B:#$^$GDL$j%m!<%+%k$N%k!<%W%P%C%/%H%i%U%#%C%/$O5v2D$7$^$9$,!"$=$l0J30(B
$B$NA4$F$r5qH]$7$^$9!#(B</P>
<P>
<BLOCKQUOTE><CODE>
<PRE>
# ipchains -A input -i ! lo -j DENY
# ipchains -A output -i ! lo -j DENY
# ipchains -A forward -j DENY
#
</PRE>
</CODE></BLOCKQUOTE>
</P>


</LI>
<LI> $B%$%s%?!<%U%'!<%9$N%;%C%H%"%C%W(B
<P>$B%$%s%?!<%U%'!<%9$N%;%C%H%"%C%W$O!"BgDq%V!<%H;~$N%9%/%j%W%H(B
$B$G<B9T$5$l$^$9!#%U%#%k%?%j%s%0$N%k!<%k$,E,MQ$5$l$kA0$K%Q%1%C%H(B
$B$,O3$l$@$9$3$H$rKI$00Y$K!"%$%s%?!<%U%'!<%9$,@_Dj$5$l$kA0$K>e5-(B
$B$N%9%F%C%W$,<B9T$5$l$F$$$k$3$H$r3NG'$7$F2<$5$$!#(B</P>


</LI>
<LI> $B%W%m%H%3%kJL$K%^%9%+%l!<%I%b%8%e!<%k$rAH$_9~$`(B
<P>FTP $B$rMxMQ$9$k:]$K$O!"%^%9%+%l!<%I%b%8%e!<%k$rAH$_9~$`I,MW$,$"(B
$B$j$^$9!#$=$&$9$k$3$H$G!"FbIt%M%C%H%o!<%/$+$i$N%"%/%F%#%V$H%Q%C(B
$B%7%V(B FTP $B$,(B `$B$A$c$s$HF0:n$7$^$9(B'$B!#(B</P>
<P>
<BLOCKQUOTE><CODE>
<PRE>
# insmod ip_masq_ftp
#
</PRE>
</CODE></BLOCKQUOTE>
</P>
</LI>
</UL>
</P>


<H2><A NAME="ss7.4">7.4</A> <A HREF="IPCHAINS-HOWTO.html#toc7.4">$B%Q%1%C%H$rDL2a$5$;$k$?$a$N%Q%1%C%H%U%#%k%?%j%s%0(B</A>
</H2>

<P>$B%^%9%+%l!<%I$r;HMQ$7$F!"(Bforward $B%A%'%$%s$G%U%#%k%?!<$r$+$1$k$3$H$O(B
$B:GNI$NJ}K!$G$9!#(B</P>
<P>forward $B%A%'%$%s$r%=!<%9!?$"$F@h(B $B%$%s%?!<%U%'!<%9$K9g$o$;$FMM!9$J%f(B
$B!<%6Dj5A%A%'%$%s$KJ,3d$7$F2<$5$$!#$D$^$j!"LdBj$r<h07$$$d$9$$C10L(B
$B$KJ,2r$9$k$N$G$9!#(B
<BLOCKQUOTE><CODE>
<PRE>
ipchains -N good-dmz
ipchains -N bad-dmz
ipchains -N good-bad
ipchains -N dmz-good
ipchains -N dmz-bad
ipchains -N bad-good
</PRE>
</CODE></BLOCKQUOTE>
</P>

<P>ICMP $B$NI8=`%(%i!<$r%"%/%;%W%H$9$k$3$H$O!"6&DL$NFbMF$G$9!#$7$?$,$C$F!"(B
$B$=$N$?$a$N%A%'%$%s$r:n$j$^$9!#(B
<BLOCKQUOTE><CODE>
<PRE>
ipchains -N icmp-acc
</PRE>
</CODE></BLOCKQUOTE>
</P>


<H3>forward $B%A%'%$%s$+$i%8%c%s%W$5$;$k(B</H3>

<P>$B;DG0$J$3$H$K!"(B(forward $B%A%'%$%s$G$O(B)$B=PNO%$%s%?!<%U%'!<%9$7$+J,$+$j(B
$B$^$;$s!#$7$?$,$C$F!"%Q%1%C%H$,$I$N%$%s%?!<%U%'!<%9$+$iF~$C$F$/$k$+(B
$B$r8+H4$/$?$a$K!"%=!<%9%"%I%l%9$r;HMQ$7$^$9(B($B56AuJ]8n$,%"%I%l%9$N$J(B
$B$j$9$^$7$rKI$$$G$$$k$N$GBg>fIW$G$9(B)$B!#(B</P>


<P>$B$3$l$i$N$$$:$l$K$b%^%C%A$7$J$$%Q%1%C%H(B($BL@$i$+$K!"$=$N$h$&$J$3$H$O5/(B
$B$3$i$J$$$O$:$G$9$,(B)$B$OA4$F%m%0$r<h$k$3$H$KCm0U$7$F2<$5$$!#(B
<BLOCKQUOTE><CODE>
<PRE>
ipchains -A forward -s 192.168.1.0/24 -i eth0 -j good-dmz
ipchains -A forward -s 192.168.1.0/24 -i ppp0 -j good-bad
ipchains -A forward -s 192.84.219.0/24 -i ppp0 -j dmz-bad
ipchains -A forward -s 192.84.219.0/24 -i eth1 -j dmz-good
ipchains -A forward -i eth0 -j bad-dmz
ipchains -A forward -i eth1 -j bad-good
ipchains -A forward -j DENY -l
</PRE>
</CODE></BLOCKQUOTE>
</P>


<H3>icmp-acc $B%A%'%$%s$rDj5A$9$k(B</H3>

<P>$B%Q%1%C%H$,(B($B0J2<$N(B)$B%(%i!<(B ICMP $B$N$$$:$l$+$J$i%"%/%;%W%H$5$l$^$9!#(B
$B$5$b$J$1$l$P!"%^%C%A$7$J$+$C$?%Q%1%C%H$KBP$9$k@)8f$O(B icmp-acc $B%A%'%$%s(B
$B$+$iH4$1$F!"8F=P$785$N%A%'%$%s$KLa$5$l$k$3$H$K$J$j$^$9!#(B</P>
<P>
<BLOCKQUOTE><CODE>
<PRE>
ipchains -A icmp-acc -p icmp --icmp-type destination-unreachable -j ACCEPT
ipchains -A icmp-acc -p icmp --icmp-type source-quench -j ACCEPT
ipchains -A icmp-acc -p icmp --icmp-type time-exceeded -j ACCEPT
ipchains -A icmp-acc -p icmp --icmp-type parameter-problem -j ACCEPT
</PRE>
</CODE></BLOCKQUOTE>
</P>


<H3>GOOD ($BFbIt%M%C%H%o!<%/(B) $B$+$i(B DMZ ($B%5!<%P%M%C%H%o!<%/(B)</H3>

<P>$BFbIt%M%C%H%o!<%/$KBP$9$k@)8B(B : 
<UL>
<LI> $B30It%M%C%H%o!<%/$X$N(B WWW, ftp, traceroute, ssh $B$r5v2D$9$k(B</LI>
<LI> <B>$B%a!<%k%5!<%P$X$N(B SMTP $B$r5v2D$9$k(B</B></LI>
<LI> <B>$B%a!<%k%5!<%P$X$N(B POP-3 $B$r5v2D$9$k(B</B></LI>
<LI> <B>$B%M!<%`%5!<%P$X$N(B DNS $B$r5v2D$9$k(B</B></LI>
<LI> <B>$B%&%'%V%5!<%P$X$N(B rsync $B$r5v2D$9$k(B</B></LI>
<LI> <B>$B%&%'%V%5!<%P$X$N(B WWW $B$r5v2D$9$k(B</B></LI>
<LI> $B%Q%1%C%H%U%#%k%?!<%^%7%s$X$N(B ping $B$r5v2D$9$k(B</LI>
</UL>
</P>

<P>$BFbIt%M%C%H%o!<%/$+$i(B DMZ $B$N:]$K%^%9%+%l!<%I$O$G$-$^$9$,!"$3$3$G$O9T(B
$B$$$^$;$s!#FbIt%M%C%H%o!<%/>e$N$I$N%^%7%s$b0-0U$N$"$k$3$H$r$7$J$$$O(B
$B$:$J$N$G!"5qH]$5$l$kA4$F$N%Q%1%C%H$N%m%0$r<h$j$^$9!#(B</P>


<P>Debian $B$N8E$$%P!<%8%g%s$G$O!"(B/etc/services $B>e$N(B `pop3' $B$r(B`pop-3' $B$H(B
$B8F$V$N$GCm0U$7$F2<$5$$!#$3$N$3$H$O(B RFC1700 $B$H0lCW$7$F$$$^$;$s!#(B
<BLOCKQUOTE><CODE>
<PRE>
   
ipchains -A good-dmz -p tcp -d 192.84.219.128 smtp -j ACCEPT
ipchains -A good-dmz -p tcp -d 192.84.219.128 pop3 -j ACCEPT
ipchains -A good-dmz -p udp -d 192.84.219.129 domain -j ACCEPT
ipchains -A good-dmz -p tcp -d 192.84.219.129 domain -j ACCEPT
ipchains -A good-dmz -p tcp -d 192.84.218.130 www -j ACCEPT
ipchains -A good-dmz -p tcp -d 192.84.218.130 rsync -j ACCEPT
ipchains -A good-dmz -p icmp -j icmp-acc
ipchains -A good-dmz -j DENY -l
</PRE>
</CODE></BLOCKQUOTE>
</P>


<H3>BAD ($B30It%M%C%H%o!<%/(B)$B$+$i(B DMZ ($B%5!<%P%M%C%H%o!<%/(B)</H3>

<P>
<UL>
<LI> DMZ $B$KBP$9$k@)8B(B: 
<UL>
<LI> $B%a!<%k%5!<%P(B
<UL>
<LI> <B>$B30It%M%C%H%o!<%/$X$N(B SMTP $B$,2DG=(B</B></LI>
<LI> $BFbIt$H(B<B>$B30It%M%C%H%o!<%/$+$i$N(B SMTP $B$N%"%/%;%W%H$,2DG=(B</B></LI>
<LI> $BFbIt%M%C%H%o!<%/$+$i$N(B POP-3 $B$N%"%/%;%W%H$,2DG=(B</LI>
</UL>
</LI>
<LI> $B%M!<%`%5!<%P(B
<UL>
<LI> <B>$B30It%M%C%H%o!<%/$X$N(B DNS $B$NMW5a$,2DG=(B</B></LI>
<LI> $BFbIt$H(B<B>$B30It%M%C%H%o!<%/(B</B>$B!"%Q%1%C%H%U%#%k%?!<%^%7%s(B<B>$B$+$i(B
$B$N(B DNS $B$N%"%/%;%W%H$,2DG=(B</B></LI>
</UL>
</LI>
<LI> $B%&%'%V%5!<%P(B
<UL>
<LI> $BFbIt$H(B<B>$B30It%M%C%H%o!<%/$+$i$N(B HTTP $B$N%"%/%;%W%H$,2DG=(B</B></LI>
<LI> $BFbIt%M%C%H%o!<%/$+$i$N(B Rsync $B$N%"%/%;%W%H$,2DG=(B</LI>
</UL>
</LI>
</UL>
</LI>
<LI> $B30It%M%C%H%o!<%/$+$i(B DMZ $B$X5v2D$9$k$3$H(B
<UL>
<LI> $B?/329T0Y$K$D$$$F$O!"%m%0$O$H$i$:$=$N$^$^$K$9$k(B</LI>
</UL>

<BLOCKQUOTE><CODE>
<PRE>
ipchains -A bad-dmz -p tcp -d 192.84.219.128 smtp -j ACCEPT
ipchains -A bad-dmz -p udp -d 192.84.219.129 domain -j ACCEPT
ipchains -A bad-dmz -p tcp -d 192.84.219.129 domain -j ACCEPT
ipchains -A bad-dmz -p tcp -d 192.84.218.130 www -j ACCEPT
ipchains -A bad-dmz -p icmp -j icmp-acc
ipchains -A bad-dmz -j DENY
</PRE>
</CODE></BLOCKQUOTE>
</LI>
</UL>
</P>


<H3>GOOD ($BFbIt%M%C%H%o!<%/(B)$B$+$i(B BAD ($B30It%M%C%H%o!<%/(B) </H3>

<P>
<UL>
<LI> $BFbIt%M%C%H%o!<%/$KBP$9$k@)8B(B: 
<UL>
<LI> <B>$B30It%M%C%H%o!<%/$X$N(B WWW, ftp ,traceroute, ssh $B$r5v2D$9$k(B</B></LI>
<LI> $B%a!<%k%5!<%P$X$N(B SMTP $B$r5v2D$9$k(B</LI>
<LI> $B%a!<%k%5!<%P$X$N(B POP-3 $B$r5v2D$9$k(B</LI>
<LI> $B%M!<%`%5!<%P$X$N(B DNS $B$r5v2D$9$k(B</LI>
<LI> $B%&%'%V%5!<%P$X$N(B rsync $B$r5v2D$9$k(B</LI>
<LI> $B%&%'%V%5!<%P$X$N(B WWW $B$r5v2D$9$k(B</LI>
<LI> $B%Q%1%C%H%U%#%k%?!<%^%7%s$X$N(B ping $B$r5v2D$9$k(B</LI>
</UL>
</LI>
<LI> $B0lHL$K!"FbIt%M%C%H%o!<%/$+$i30It%M%C%H%o!<%/$KBP$7$F$O!"(B
$BA4$F$r5v2D$7!"$=$l$+$i@)8B$r2C$($^$9!#2f!9$O!"%U%!%7%9%H$J$N$G$9!#(B
<UL>
<LI> $B?/329T0Y$N%m%0$r<h$k(B</LI>
<LI> $B%Q%C%7%V(B FTP $B$O!"%^%9%+%l!<%I%b%8%e!<%k$G=hM}$9$k(B</LI>
<LI> UDP $B$N(B $B$"$F@h%]!<%H(B 33434 $B0J9_(B $B$O(B traceroute $B$G;HMQ$5$l$k(B</LI>
</UL>

<BLOCKQUOTE><CODE>
<PRE>
      
ipchains -A good-bad -p tcp --dport www -j MASQ
ipchains -A good-bad -p tcp --dport ssh -j MASQ
ipchains -A good-bad -p udp --dport 33434:33500 -j MASQ
ipchains -A good-bad -p tcp --dport ftp -j MASQ
ipchains -A good-bad -p icmp --icmp-type ping -j MASQ
ipchains -A good-bad -j REJECT -l
</PRE>
</CODE></BLOCKQUOTE>
</LI>
</UL>
</P>


<H3>DMZ $B$+$i(B GOOD ($BFbIt%M%C%H%o!<%/(B) </H3>

<P>
<UL>
<LI> $BFbIt%M%C%H%o!<%/$KBP$9$k@)8B(B: 
<UL>
<LI> $B30It%M%C%H%o!<%/$X$N(B WWW, ftp ,traceroute, ssh $B$r5v2D$9$k(B</LI>
<LI> <B>$B%a!<%k%5!<%P$X$N(B SMTP $B$r5v2D$9$k(B</B></LI>
<LI> <B>$B%a!<%k%5!<%P$X$N(B POP-3 $B$r5v2D$9$k(B</B></LI>
<LI> <B>$B%M!<%`%5!<%P$X$N(B DNS $B$r5v2D$9$k(B</B></LI>
<LI> <B>$B%&%'%V%5!<%P$X$N(B rsync $B$r5v2D$9$k(B</B></LI>
<LI> <B>$B%&%'%V%5!<%P$X$N(B WWW $B$r5v2D$9$k(B</B></LI>
<LI> $B%Q%1%C%H%U%#%k%?!<%^%7%s$X$N(B ping $B$r5v2D$9$k(B</LI>
</UL>
</LI>
<LI> $BFbIt%M%C%H%o!<%/$+$i(B DMZ $B$N:]$K%^%9%+%l!<%I$9$k>l9g!"C1$K$=$l0J(B
$B30$N%Q%1%C%H$r5qH]$7$F2<$5$$!#<B$N$H$3$m!"C1$K%3%M%/%7%g%s$,(B
$B3NN)$5$l$?0lIt$N%Q%1%C%H$N$_5v2D$9$k$@$1$G$9!#(B
<BLOCKQUOTE><CODE>
<PRE>
       
ipchains -A dmz-good -p tcp ! -y -s 192.84.219.128 smtp -j ACCEPT
ipchains -A dmz-good -p udp -s 192.84.219.129 domain -j ACCEPT
ipchains -A dmz-good -p tcp ! -y -s 192.84.219.129 domain -j ACCEPT
ipchains -A dmz-good -p tcp ! -y -s 192.84.218.130 www -j ACCEPT
ipchains -A dmz-good -p tcp ! -y -s 192.84.218.130 rsync -j ACCEPT
ipchains -A dmz-good -p icmp -j icmp-acc
ipchains -A dmz-good -j DENY -l
</PRE>
</CODE></BLOCKQUOTE>
</LI>
</UL>
</P>


<H3>DMZ $B$+$i(B BAD ($B30It%M%C%H%o!<%/(B) </H3>

<P>
<UL>
<LI> DMZ $B$KBP$9$k@)8B(B: 
<UL>
<LI> $B%a!<%k%5!<%P(B
<UL>
<LI> <B>$B30It%M%C%H%o!<%/$X$N(B SMTP $B$,2DG=(B</B></LI>
<LI> $BFbIt$H(B<B>$B30It%M%C%H%o!<%/$+$i$N(B SMTP $B$N%"%/%;%W%H$,2DG=(B</B></LI>
<LI> $B30It%M%C%H%o!<%/$+$i$N(B POP-3 $B$N%"%/%;%W%H$,2DG=(B</LI>
</UL>
</LI>
<LI> $B%M!<%`%5!<%P(B
<UL>
<LI> <B>$B30It%M%C%H%o!<%/$X$N(B DNS $B$NAw?.$,2DG=(B</B></LI>
<LI> $BFbIt$H(B<B>$B30It%M%C%H%o!<%/(B</B>$B!"%Q%1%C%H%U%#%k%?!<%^%7%s(B<B>$B$+$i(B
$B$N(B DNS $B$N%"%/%;%W%H$,2DG=(B</B></LI>
</UL>
</LI>
<LI> $B%&%'%V%5!<%P(B
<UL>
<LI> $BFbIt$H(B<B>$B30It%M%C%H%o!<%/$+$i$N(B HTTP $B$N%"%/%;%W%H$,2DG=(B</B></LI>
<LI> $BFbIt%M%C%H%o!<%/$+$i$N(B Rsync $B$N%"%/%;%W%H$,2DG=(B</LI>
</UL>
</LI>
</UL>
</LI>
<LI>
<BLOCKQUOTE><CODE>
<PRE>
       
ipchains -A dmz-bad -p tcp -s 192.84.219.128 smtp -j ACCEPT
ipchains -A dmz-bad -p udp -s 192.84.219.129 domain -j ACCEPT
ipchains -A dmz-bad -p tcp -s 192.84.219.129 domain -j ACCEPT
ipchains -A dmz-bad -p tcp ! -y -s 192.84.218.130 www -j ACCEPT
ipchains -A dmz-bad -p icmp -j icmp-acc
ipchains -A dmz-bad -j DENY -l
</PRE>
</CODE></BLOCKQUOTE>
</LI>
</UL>
</P>


<H3>BAD ($B30It%M%C%H%o!<%/(B)$B$+$i(B GOOD ($BFbIt%M%C%H%o!<%/(B) </H3>

<P>
<UL>
<LI> $B30It%M%C%H%o!<%/$+$iFbIt%M%C%H%o!<%/$XF~$C$FMh$k$b$NA4$F(B($B%^%9%+(B
$B%l!<%I$5$l$F$$$J$$$b$N(B)$B$r5v2D$7$^$;$s!#(B
<BLOCKQUOTE><CODE>
<PRE>
ipchains -A bad-good -j REJECT
</PRE>
</CODE></BLOCKQUOTE>
</LI>
</UL>
</P>


<H3>Linux $B%^%7%s<+?H$KBP$9$k%Q%1%C%H%U%#%k%?%j%s%0(B</H3>

<P>
<UL>
<LI> $B%Q%1%C%H%U%#%k%?!<%^%7%s<+?H$KF~$C$FMh$k%Q%1%C%C%H$K$b!"%Q%1%C(B
$B%H%U%#%k%?%j%s%0$r9T$$$?$$$J$i!"(Binput $B%A%'%$%s$G%Q%1%C%H%U%#%k(B
$B%?%j%s%0$r9T$&I,MW$,$"$j$^$9!#$"$F@h%$%s%?!<%U%'!<%9Kh$K!"0l$D(B
$B%A%'%$%s$r:n$j$^$9!#(B       
<BLOCKQUOTE><CODE>
<PRE>
       
ipchains -N bad-if
ipchains -N dmz-if
ipchains -N good-if
</PRE>
</CODE></BLOCKQUOTE>


</LI>
<LI> $B:n$C$?%A%'%$%s$K%8%c%s%W$5$;$^$9!#(B
<BLOCKQUOTE><CODE>
<PRE>
       
ipchains -A input -d 192.84.219.1 -j bad-if
ipchains -A input -d 192.84.219.250 -j dmz-if
ipchains -A input -d 192.168.1.250 -j good-if
</PRE>
</CODE></BLOCKQUOTE>
</LI>
</UL>
</P>


<H3>BAD ($B30It%M%C%H%o!<%/(B) $B%$%s%?!<%U%'!<%9(B</H3>

<P>
<UL>
<LI> $B%Q%1%C%H%U%#%k%?!<%^%7%s(B: 
<UL>
<LI> <B>$BA4$F$N%M%C%H%o!<%/$KBP$7$F(B PING $B$,2DG=(B</B></LI>
<LI> <B>$BA4$F$N%M%C%H%o!<%/$KBP$7$F(B TRACEROUTE $B$,2DG=(B</B></LI>
<LI> DNS $B$X$N%"%/%;%9$,2DG=(B</LI>
</UL>
</LI>
<LI> $B$^$?30It%M%C%H%o!<%/MQ$N%$%s%?!<%U%'!<%9$O!"%^%9%+%l!<%I$5$l$?(B
$B%Q%1%C%H(B($B%^%9%+%l!<%I$O!"%=!<%9%]!<%H$H$7$F(B 61000 $B$+$i(B 65095 $B$r(B
$B;HMQ$7$^$9(B)$B$X$N%j%W%i%$$H(B ICMP $B%(%i!<!"(BPING $B$N%j%W%i%$$b<u$1F~(B
$B$l$^$9!#(B
<BLOCKQUOTE><CODE>
<PRE>
       
ipchains -A bad-if -i ! ppp0 -j DENY -l
ipchains -A bad-if -p TCP --dport 61000:65095 -j ACCEPT
ipchains -A bad-if -p UDP --dport 61000:65095 -j ACCEPT
ipchains -A bad-if -p ICMP --icmp-type pong -j ACCEPT
ipchains -A bad-if -j icmp-acc
ipchains -A bad-if -j DENY
</PRE>
</CODE></BLOCKQUOTE>
</LI>
</UL>
</P>


<H3>DMZ $B%$%s%?%U%'!<%9(B</H3>

<P>
<UL>
<LI> $B%Q%1%C%H%U%#%k%?!<%^%7%s$KBP$9$k@)8B(B: 
<UL>
<LI> <B>$BA4$F$N%M%C%H%o!<%/$KBP$7$F(B PING $B$,2DG=(B</B></LI>
<LI> <B>$BA4$F$N%M%C%H%o!<%/$KBP$7$F(B TRACEROUTE $B$,2DG=(B</B></LI>
<LI> <B>DNS $B$X$N%"%/%;%9$,2DG=(B</B></LI>
</UL>
</LI>
<LI>DMZ $B%$%s%?!<%U%'!<%9$O!"(BDNS $B$+$i$N%j%W%i%$$H(B ping $B$N%j%W%i%$!"(B
$B%(%i!<(B ICMP $B$r<u$1F~$l$^$9!#(B
<BLOCKQUOTE><CODE>
<PRE>
ipchains -A dmz-if -i ! eth0 -j DENY
ipchains -A dmz-if -p TCP ! -y -s 192.84.219.129 53 -j ACCEPT
ipchains -A dmz-if -p UDP -s 192.84.219.129 53 -j ACCEPT
ipchains -A dmz-if -p ICMP --icmp-type pong -j ACCEPT
ipchains -A dmz-if -j icmp-acc
ipchains -A dmz-if -j DENY -l
</PRE>
</CODE></BLOCKQUOTE>
</LI>
</UL>
</P>


<H3>GOOD ($BFbIt%M%C%H%o!<%/(B)$B%$%s%?!<%U%'!<%9(B</H3>

<P>
<UL>
<LI> $B%Q%1%C%H%U%#%k%?!<%^%7%s$KBP$9$k@)8B(B: 
<UL>
<LI> <B>$BA4$F$N%M%C%H%o!<%/$KBP$7$F(B PING $B$,2DG=(B</B></LI>
<LI> <B>$BA4$F$N%M%C%H%o!<%/$KBP$7$F(B TRACEROUTE $B$,2DG=(B</B></LI>
<LI> <B>DNS $B$X$N%"%/%;%9$,2DG=(B</B></LI>
</UL>
</LI>
<LI>$BFbIt%M%C%H%o!<%/$KBP$9$k@)8B(B: 
<UL>
<LI> $B30It%M%C%H%o!<%/$X$N(B WWW, ftp ,traceroute, ssh $B$r5v2D$9$k(B</LI>
<LI> $B%a!<%k%5!<%P$X$N(B SMTP $B$r5v2D$9$k(B</LI>
<LI> $B%a!<%k%5!<%P$X$N(B POP-3 $B$r5v2D$9$k(B</LI>
<LI> $B%M!<%`%5!<%P$X$N(B DNS $B$r5v2D$9$k(B</LI>
<LI> $B%&%'%V%5!<%P$X$N(B rsync $B$r5v2D$9$k(B</LI>
<LI> $B%&%'%V%5!<%P$X$N(B WWW $B$r5v2D$9$k(B</LI>
<LI> <B>$B%Q%1%C%H%U%#%k%?!<%^%7%s$X$N(B ping $B$r5v2D$9$k(B</B></LI>
</UL>
</LI>
<LI>$BFbIt%M%C%H%o!<%/%$%s%?!<%U%'!<%9$O!"(Bping $B$H(B ping $B$N%j%W%i%$!"(B
$B%(%i!<(B ICMP $B$r<u$1F~$l$^$9!#(B
<BLOCKQUOTE><CODE>
<PRE>
ipchains -A good-if -i ! eth1 -j DENY
ipchains -A good-if -p ICMP --icmp-type ping -j ACCEPT
ipchains -A good-if -p ICMP --icmp-type pong -j ACCEPT
ipchains -A good-if -j icmp-acc
ipchains -A good-if -j DENY -l
</PRE>
</CODE></BLOCKQUOTE>
</LI>
</UL>
</P>


<H2><A NAME="ss7.5">7.5</A> <A HREF="IPCHAINS-HOWTO.html#toc7.5">$B:G8e$K(B</A>
</H2>

<P>
<UL>
<LI>$B%V%m%C%-%s%0$N%k!<%k$r:o=|$7$^$9!#(B
<BLOCKQUOTE><CODE>
<PRE>
ipchains -D input 1
ipchains -D forward 1
ipchains -D output 1
</PRE>
</CODE></BLOCKQUOTE>
</LI>
</UL>
</P>



<HR>
<A HREF="IPCHAINS-HOWTO-8.html">$B<!$N%Z!<%8(B</A>
<A HREF="IPCHAINS-HOWTO-6.html">$BA0$N%Z!<%8(B</A>
<A HREF="IPCHAINS-HOWTO.html#toc7">$BL\<!$X(B</A>
</BODY>
</HTML>
doc-linux-ja-html 2006.05.25-1.1 / usr / share / doc / HOWTO / ja-html / IPCHAINS-HOWTO-7.html
