学习ros防火墙的一点心得
时间：2006-12-12 来源：zh8612
input - 进入路由，并且需要对其处理
forward - 路由转发
output - 经过路由处理，并且从接口出去的包
action： 1 accept： 接受
add-dst-to-address-list - 把一个目标IP地址加入address-list add-src-to-address-list - 把一个源IP地址加入address-list 2 drop - 丢弃
3 jump - 跳转，可以跳转到一个规则主题里面，如input forward，也可以跳转到某一条里面
4 log - 日志记录
5 passthrough - 忽略此条规则
6 reject - 丢弃这个包，并且发送一个ICMP回应消息
7 return - 把控制返回给jump的所在
8 tarpit - 捕获和扣留 进来的TCP连接 (用SYN/ACK回应进来的TCP SYN 包)
address-list (name) - 把从action=add-dst-to-address-list or action=add-src-to-address-list actions得到的IP地址放入address-list列表. 这个列表要用来对比address-list-timeout 看是什么时候用address-list parameter从address list中移走 chain (forward | input | output | name) - 使用chain得到特定列表，不同的数据流经过不同的chain规则
要仔细的选对正确的访问控制. 如果 input 不是非常的确定和一个新的规则需要添加注释,
transfered through the particular connection
? 0的意思是无限的,例如 connection-bytes=2000000-0 意思是2MB以上
connection-limit (integer | netmask) - 地址的传输流量控制
connection-mark (name) - 传输中的标记后的数据包
connection-state (estabilished | invalid | new | related) - 连接的状态（连接中，不规则的连接，新的连接，相互联系的连接）
connection-type 连接的类型 （ftp | gre | h323 | irc | mms | pptp | quake3 | tftp) content 包的内容
dst-address (IP address | netmask | IP address | IP address) - 目标地址 dst-address-list (name) - 目标地址表
dst-address-type (unicast | local | broadcast | multicast) - 目标地址类型
? unicast -点对点
? local - 本地地址
? broadcast - 广播
? multicast - 多播 dst-limit (integer | time | integer | dst-address | dst-port | src-address | time) - 目标限制
? Count - 每秒最大的包数量
by Time option
? Time - 时间
? Burst - 突发的
? Mode -等级优先
? Expire - 终止 dst-port 目标端口
hotspot 暂时不做学习
icmp-options (integer | integer) - ICMP 选择
in-interface (name) - 进入接口
ipv4-options (any | loose-source-routing | no-record-route | no-router-alert | no-source-routing |no-timestamp | none | record-route | router-alert | strict-source-routing | timestamp)
? any - match packet with at least one of the ipv4 options
? loose-source-routing - match packets with loose source routing option. This option is used toroute the internet datagram based on information supplied by the source
? no-record-route - match packets with no record route option. This option is used to route the
internet datagram based on information supplied by the source
? no-router-alert - match packets with no router alter option
? no-source-routing - match packets with no source routing option
? no-timestamp - match packets with no timestamp option
? record-route - match packets with record route option
? router-alert - match packets with router alter option
? strict-source-routing - match packets with strict source routing option
? timestamp - match packets with timestamp
jump-target (forward | input | output | name) -跳转
limit (integer | time | integer) - 限制
? Count - 每秒最大的包数量
? Time - 突发的总时间
log-prefix (text) - 如果还有定义的字符，加入日志
out-interface (name) - 流出的接口
p2p (all-p2p | bit-torrent | blubster | direct-connect | edonkey | fasttrack | gnutella | soulseek | warez
| winmx) - P2P协议
packet-mark (text) - 给包标记
packet-size (integer: 0..65535 | integer: 0..65535) - 包大小
range in bytes
? Min - 最小
? Max - 最大
phys-in-interface (name) - 物理上的进入接口
phys-out-interface (name) -物理上的出去接口 protocol (ddp | egp | encap | ggp | gre | hmp | icmp | idrp-cmtp | igmp | ipencap | ipip | ipsec-ah |ipsec-esp | iso-tp4 | ospf | pup | rdp | rspf | st | tcp | udp | vmtp | xns-idp | xtp | integer) -协议
psd (integer | time | integer | integer) - 防止对ROS的端口扫描
random (integer: 1..99) - matches packets randomly with given propability
reject-with (icmp-admin-prohibited | icmp-echo-reply | icmp-host-prohibited |
icmp-host-unreachable | icmp-net-prohibited | icmp-network-unreachable | icmp-port-unreachable |icmp-protocol-unreachable | tcp-reset | integer) - 改变reject的回答方式
routing-mark (name) - 路由标记
src-address (IP address | netmask | IP address | IP address) -源地址
src-address-list (name) -源地址列表
src-address-type (unicast | local | broadcast | multicast) - 源地址类型
src-mac-address (MAC address) - 源MAC地址
src-port (integer: 0..65535 | integer: 0..65535) - 源端口
tcp-flags (ack | cwr | ece | fin | psh | rst | syn | urg) -TCP 标志类型
? ack - acknowledging data
? cwr - congestion window reduced
? ece - ECN-echo flag (explicit congestion notification)
? fin - close connection
? psh - push function
? rst - drop connection
? syn - new connection
? urg - urgent data
tcp-mss (integer: 0..65535) - TCP MSS
time (time | time | sat | fri | thu | wed | tue | mon | sun) - allows to create filter based on the packets'
arrival time and date or, for locally generated packets, departure time and date
tos (max-reliability | max-throughput | min-cost | min-delay | normal) - specifies a match for the
value of Type of Service (ToS) field of an IP header
? max-reliability - maximize reliability (ToS=4)
? max-throughput - maximize throughput (ToS=8)
? min-cost - minimize monetary cost (ToS=2)
? min-delay - minimize delay (ToS=16)
? normal - normal service (ToS=0)
相关阅读 更多 +
