\documentclass[letterpaper,english]{article}
\nonstopmode
\akai
\usepackage{linuxdoc-sgml}
\usepackage{qwertz}
\usepackage{url}
\usepackage[latin1]{inputenc}
\usepackage{t1enc}
\usepackage[english]{babel}
\usepackage{epsfig}
\usepackage{null}
\def\addbibtoc{
\addcontentsline{toc}{section}{\numberline{\mbox{}}\relax\bibname}
}%end-preamble
\setcounter{page}{1}
\title{Linux 2.4 Packet Filtering HOWTO}
\author{§@ªÌ¡RRusty Russell, mailing list {\ttfamily netfilter@lists.samba.org}\\ 
Ä¶ªÌ¡Rºô¤¤¤H {\ttfamily netmanforever@yahoo.com}}
\date{v1.0.1 Mon May  1 18:09:31 CST 2000}
\abstract{¦¹¤å¥ó´y­z¦p¦ó¦b 2.4 Linux kernel ¤W¨Ï¥Î iptables ¹ï¤£¨}«Ê¥]¶i¦æ¹LÂo¡C}


\begin{document}
\maketitle
\tableofcontents

\section{Introduction\label{intro}}

¦U¦ì¬Ý©x¡MÅwªï¨ì¦¹¤@Åª¡T



³o¸Ì¡M§Ú°²³]±z¤w¸gª¾¹D¤°»ò¬O IP ¦a§}¡Nºô¸ô¦a§}¡Nºô¸ô¾B¸n (netmask)¡N¸ô¥Ñ¡N¥H¤Î DNS¡C§_«h¡M§Ú«ØÄ³±z¥ýÅª¤@Åª Network Concepts HOWTO¡C



¦¹ HOWTO ¤å¥ó¤£¤î©ó¬O¤@­ÓÂI¨ì§Y¤îªº¤¶²Ð(Åý±z¦³ÂIµo¼ö©Mµo¤ò¡M¦ý¤S¦×¦b¯z¤Wªº·PÄ±)¡M¤]¤£¦Ü©ó¬O¤@­Ó©âµ·­éÃµ¦¡ªº­ì©l¤j©ÜÅS(Åý±z¥²¦³©ÒÀò¡M¦ý¤£·|¯«¸g¿ù¶Ã¡N¨«¤õ¤JÅ])¡C



±zªººô¸ô¨ä¹ê¤@ÂI¤]¤£{\bfseries ¦w¥þ}¡C°ÝÃDÃøÂI¬O¦b¤¹³\§Ö³t¦Ó«K§Q³q°T¤§¦P®É¡M¤S·Q½T«O¥¦¥u¥Î©ó¨}¦n¥B«D¨¸´cªº·N¹Ï¡C¨ä±¡§Îµ¥¦P©ó¦b¤@­Ó¾ÖÀ½ªºÀ¸°|¸Ì­±¡M¤¹³\±z°ª½ÍÁï½×¡M¦ý«o¤£¯à¶Ã³Û¡§µÛ¤õ°Õ¡T¡¨¤@¼Ë¡C³o½g HOWTO ¤£¬O¥Î¨Ó¸Ñ¨M³o°ÝÃDªº¡C



©Ò¥H¡M¥u¦³±z¤~¯à¨M©w¦ó³B¤~¬O§é°J©Ò¦b¡C§Ú·|¹Á¸Õ«ü¤Þ±z¥h¨Ï¥Î¤@¨Ç¥i¥Î¤u¨ã¡M¤]·|ÂI¥X­n¯d·Nªº¦º¥Þ¡M·íµM¡M¦P®É§Æ±æ±z¥Î©ó¥¿³~¤§¤W¡C¤S¬O(»P¤W¥y)¦Pµ¥ªº°ÝÃD¡C




\section{©x¤èªººô¯¸¦b­þ¸Ì¡S¦³¶l¥ó½×¾Â¶Ü¡S}

¦³¤T­Ó©x¤èºô¯¸«D¥h¤£¥i:
\begin{itemize}
\item ·PÁÂ\nameurl{http://netfilter.filewatcher.org}{Filewatcher (http://netfilter.filewatcher.org)}.
\item ·PÁÂ \nameurl{http://www.samba.org/netfilter}{The Samba Team and SGI (http://www.samba.org/netfilter)}.
\item ·PÁÂ\nameurl{http://netfilter.kernelnotes.org}{Jim Pick (http://netfilter.kernelnotes.org)}.
\end{itemize}




¦Ü©ó©x¤èªº netfilter ¶l¥ó½×¾Â¡M½Ð°Ñ¾\¡R
\nameurl{http://lists.samba.org}{Samba's Listserver (http://lists.samba.org)}.




\section{¦n¤F¡M¤°»ò¬O«Ê¥]¹LÂo(Packer Filter)©O¡S}

«Ê¥]¹LÂo´N¬O¥Î¤@­Ó³nÅé¬d¬Ý©Ò¬y¸g«Ê¥]¤§{\itshape ªíÀY(header)\/} ¡M¥Ñ¦¹¨M©w¾ã­Ó«Ê¥]ªº©R¹B¡C¥¦©Î³\·|¨M©w {\bfseries ¥á±ó(DROP)} ³o­Ó«Ê¥](¨Ò¦p¡M©¿²¤¥¦´N¦p®Ú¥»¨S¦¬¨ì¥¦¤@¼Ë)¡M©Î¬O{\bfseries ±µ¦¬(ACCEPT)}³o­Ó«Ê¥](¨Ò¦p¡MÅý³o­Ó«Ê¥]³q¹L)¡M©Î¬O¨ä¥¦§ó½ÆÂøªº°Ê§@¡C



¦b Linux ¤§¤U¡M«Ê¥]¹LÂo¥\¯à¬O¤º«Ø©ó®Ö¤ß¤§¤º(°µ¬°¤@­Ó®Ö¤ß¼Ò²Õ¡M©ÎªÌª½±µ¤º«Ø)¡M¦P®ÉÁÙ¦³¤@¨Ç§Þ¥©§Ú­Ì¥i¥H¹B¥Î©ó«Ê¥]¤§¤Wªº¡M¤£¹L³ÌºD¥Îªº¨ÌµM¬O¬d¬ÝªíÀY¥H¨M©w«Ê¥]ªº©R¹B¡C




\subsection{§Ú¬°¤°»ò­n«Ê¥]¹LÂo¡S}

Â²¦Ó¨¥¤§¡R±±¨î¡N«O¦w¡NÄµ§Ù¡C



\begin{description}
\item[Control:] \mbox{}

·í±z¥Î±zªº Linux ¥D¾÷±N±zªº¤º³¡ºô¸ô³s±µ¦Ü¨ä¥¦ºô¸ô(¤ñ¤è»¡¡Mineternet)ªº®É­Ô¡M±z¦³¾÷·|¤¹³\¯S©wÃþ«¬ªº¥æ³q¡M¦Ó¸T¤î¨ä¥¦ªº¡C ¨Ò¦p¡M¤@­Ó«Ê¥]ªºªíÀY·|¥]§t«Ê¥]ªº¥Øªº¦a¦a§}¡M©Ò¥H±z¥i¥H¨¾¤î«Ê¥]¬y¦V¥~³¡ºô¸ôªº¬Y¤@³¡¥÷¡C¦A¦p¡M§Ú¥Î Netscape ³s½u¦Ü Dilbert archives¡M¨ººô­¶¤W¦³¤@­Ó¨Ó¦Û doubleclick.net ªº¼s§i¡M³o¼Ë Netscape ·|®ö¶O§Úªº®É¶¡¥h¤U¸ü¥¦­Ì¡C¥u­nÅý«Ê¥]¹LÂo¾÷¨î¤£¤¹³\¥ô¦ó¨Ó¦Ûdoubleclick.net ªº«Ê¥]¡M§Ú­Ì´N¥i¥H¸Ñ¨M³o­Ó°ÝÃD(·íµM¡M¦³§ó¦nªº¤èªk¨Ó°µ³o¥ó¨Æ±¡°Õ¡M½Ð°Ñ¦Ò Junkbuster)¡C



\item[Security:] \mbox{}

·í±zªº Linux ¥D¾÷¬O±z¤«µM¦³§Çªº¤º³¡ºô¸ô©M¥~­±¨º­Ó²V¨PµL¤ñªº internet ¤§¶¡ªº°ß¤@³q¹D¡M¦Ó±zª¾¹D¥i¥H­­¨î­þ¨ÇªF¦è¤~¯à¶i¤J±zªºªù¤á¡M¸Û¬O¤£¿ù¤§Á|§a¡C¨Ò¦p¡M±z©Î³\·|©ñ¦æ¥ô¦ó±q¤º³¡ºô¸ô¥X¥hªºªF¦è¡M¦ý¤S¾á¤ß¨Ó¦Û¥~­±ªº´c¦W¬L³¹ªº¡¥Ping of Death¡¦¡C¤S¦p¡M±z©Î³\¨Ã¤£§Æ±æ§O¤H±q¥~­± telnet ¤W±zªº Linux ¥D¾÷¡MºÉºÞ¥þ³¡ªº±b¸¹³£¦³±K½X«OÅ@¡C©Î³\¡M±zÁÙ·Q(¥¿¦p¤j³¡¥÷¤H¤@¼Ë)¦b internet ¤W·í¬Ý«È¦Ó¤£Ä@·í¦øªA¾¹(¤]¥i¯à±z¬OÄ@·Nªº) ¡M³ÌÂ²³æ²ö¦p¥Î«Ê¥]¹LÂo¨Ó©Úµ´¥ô¦ó·N±ý³s½uªº«Ê¥]¡M¤£Åý¥ô¦ó¤H³s¶i¨Ó¡C



\item[Watchfulness:] \mbox{}

¦³®É­Ô¡M¤@¥x³]©w®t¦Hªº¾÷¾¹·|±q¥»¦aºô¸ô¦V¥~­±¹Ã°e«Ê¥]¡C¦Ó¦n®ø®§¬O±z¥i¥HÅý«Ê¥]¹LÂo¨Ó§i¶D±z¬O§_¦³ÅÜºAªº¨Æ±¡µo¥Í¡C±z©Î³\·|¹ï¤§±Ä¨ú¦æ°Ê¡M¤S©Î³\¦­¤w¨£ºD¤£©Ç¤F¡C

\end{description}





\subsection{¦p¦ó¦b Linux ¤U¹LÂo«Ê¥]¡S\label{filter-linux}}

Linux ªº®Ö¤ß¦Û±q 1.1 ª©´N¤w¸g¦³«Ê¥]¹LÂo¥\¯à¡C²Ä¤@¥N¬O 1994 ¦~¥Ñ Alan Cox °ò©ó BSD ªº ipfw ²¾´Ó¹L¨Óªº¡M«á¨Ó¦b Linux 2.0 ª©¥»¦A¥Ñ Jos Vos ¥[±j¡M§Q¥Î ' ipfwadm ' ³o°¦¨Ï¥ÎªÌªÅ¶¡(userspace *)¤u¨ã¨Ó±±¨î®Ö¤ßªº¹LÂo³W«h¡C¦b 1998 ¦~¦~¤¤¡M§Ú¦b Micahel Neuling ªº¤j¤OÀ°§U¤U¡M§ëª`¤F¬Û·íªººë¤O¦b Linux ®Ö¤ß 2.2 ¤W­±¡M±À¥X¤F ' ipchains ' ³o°¦¤u¨ã¡C²×©ó¡MLinux ®Ö¤ß 2.4 ªº²Ä¥|¥N¤u¨ã ' iptables ' ³s¦P¨ä¥¦®Ö¤ß§ï¼g¤]¦b 1999 ¦~¦~¤¤¶i¦æ¶}µo¤F¡C³o´N¬O¥Ø«e³o­Ó iptables ªº HOWTO ¤å¥ó©Ò­P¤O¤§©Ò¦b¡C



 (* Ä¶ªÌµù¡R¡§¨Ï¥ÎªÌªÅ¶¡¡¨³q±`¬O¥Î¨Ó°Ï§O¨t²Î°O¾ÐÅéªº¨Ï¥Î½d³ò¡M¥D­nÃþ«¬¤À¬°®Ö¤ßªÅ¶¡©M¨Ï¥ÎªÌªÅ¶¡¡C­ì§@ªÌ¥i¯à¥H¬°¤j®a³£¬Oµ{¦¡°ª¤â¡M¬G·|¥Î¦p¦¹±Mªù³N»y¡CµM¹ï¤@¯ëÅªªÌ¨Ó»¡¡M²z¸Ñ¤W©Î³\¦³§xÃø¡M¬G¦¹¦h»¡¨â¥y¡C¦b©¹«áªº¾\Åª¤¤¤]½Ð¯d·N¡C)





±z»Ý­n¤@­Ó®Ö¤ß¦³ netfilter «Øºc©ó¨ä¤¤¡Rnetfilter ¬O Linux ®Ö¤ß¤¤¤@­Ó³q¥Î¬[ºc¡M¥i¥HÅý¨ä¥¦ªF¦è(¨Ò¦p iptables ¼Ò²Õ) ´¡¤J(plug into)¡C´«¥y¸Ü»¡¡M±z»Ý­n®Ö¤ß 2.3.15 ©Î§ó·sªºª©¥»¡M¦P®É¦b®Ö¤ß½sÄ¶®É¥H ' Y ' ¦^µª CONFIG\_NETFILTER ³o­Ó¿ï¶µ¡C



{\ttfamily iptables} ³o°¦¤u¨ã·|©M®Ö¤ß¹ïÁ¿¨Ã§i¶D¥¦¤°»ò«Ê¥]­n¹LÂo¡C°£«D±z¬O¤@­Óµ{¦¡¤H­û¡M©Î²§·Q¤Ñ¶}¡M¨º±z´N¬O¥Î¥¦¨Ó±±¨î«Ê¥]«ç¼Ë¹LÂoªº¤F¡C




\subsubsection{iptables}

³o°¦ {\ttfamily iptables} ¤u¨ã¥i¥H´¡¤J©Î²¾°£®Ö¤ß«Ê¥]¹LÂoªí®æ(packet filtering table) ¤¤ªº¤@¨Ç³W«h(rules)¡C¤]´N¬O»¡¡MµL½×±z³]©w¤F¤°»ò¡M­n¬O­«·s±Ò°Ê(reboot)¨t²Îªº¸Ü¡M´N·|¥þ³¡¥á¥¢¡Q½Ð°Ñ¾\ \ref{permanent} {(¨î©w¥Ã¤[©Ê³W«h(Making Rules Permanent))}¡M ¬Ý¬Ý¦p¦ó½T«O³]©w¦b¤U¦¸ Linux ±Ò°Ê«á¥i¥H¦^¦s¡C



{\ttfamily iptables}  ¬O¥Î¨Ó¨ú¥N {\ttfamily ipfwadm} ©M {\ttfamily ipchains} ªº¡R½Ð°Ñ¾\ \ref{oldstyle} {(¨Ï¥Î ipchains ©M ipfwadm (Using ipchains and ipfwadm))}¡M ¬Ý¬Ý¦p¦óµLµhªºÁ×§K¨Ï¥Î iptables¡M°²¦p±z¥Ø«e¥¿¨Ï¥Î¥¦­Ì¨ä¤¤¤§¤@¡C




\subsubsection{¨î©w¥Ã¤[©Ê³W«h\label{permanent}}

±z¥Ø«eªº¨¾¤õÀð³]©w¬OÀx¦s©ó®Ö¤ß¸Ì­±ªº¡M¤]¥¿¦]¦p¦¹¡M³]©w·|¦b¨t²Î­«±Ò«á¥á¥¢¡Ciptables-save ©M iptables-restore  * ªº¼¶¼g¥Ø«e¤w¸g³Q¦C¤J TODO ¦Cªí¤¤¤F¡C§Ú«OÃÒ·í¥¦­Ì°Ý¥@ªº®É­Ô¡MªÖ©w«D±`´Î¡C



(* Ä¶ªÌµù¡R¦b ipchains ¤u¨ã¤¤¡M¥i¥H¨Ï¥Î ipchains-save »P ipchains-restore ¨Ó§â·í«eªº¨¾¤õÀð³]©wÀx¦s°_¨Ó¡M¥H¤Î±N¤§ÁÙ­ì¡C¦pªGÅªªÌ¨S¨Ï¥Î¹L ipchains ¨º¨â­Ó¥\¯àªº¸Ü¡M©Î³\¤£ª¾¹D§@ªÌ¦b»¡¤°»ò¡C)



¥Ø«e¨Ó»¡¡M´N§â³]©w³W«h©Ò»Ýªº¨º¨Ç©R¥O¼g¶i¤@­Óªì©l©R¥O½Z(script)¤¤§a¡C­n½T©wªº¬O¡M°²¦p¦³¨ä¤¤¤@­Ó©R¥O¥¢±Ñªº®É­Ô¡M±z¯à´£¨Ñ¤@¨Ç´¼¯àªº°Ê§@¤ÏÀ³ (³q±`¦p ' exec /sbin/sulogin' )¡C




\section{§Aºâ­þ®Ú½µ°Ú¡S¬°¦óª±§Úªº®Ö¤ß¡S}

§Ú¬O Rusty¡M¬O Linux IP ¨¾¤õÀðªººûÅ@ªÌ¡M¦P®É¤]¶i¦æ¨ä¥¦ªº¤@¨Ç½sµ{¤u§@¡M¥i¥Hºâ¬O¤Ñ®É¦a§Q¤H©Mªº¨ÏµM§a¡C§Ú¼g¹L ipchains (½Ð°Ñ¾\«e­±ªº \ref{filter-linux} {(¦p¦ó¦b Linux ¤U¹LÂo«Ê¥]¡S(How Do I Packet Filter Under Linux?))}¡M ¬Ý¬Ý¹ê»Úªº¤u§@©|±o¯q©ó­þ¨Ç¦P¤¯)¡M±q¨ä¤¤¾Ç¨ì¨¬°÷ªºªF¦è¥H¦J¥¿¤µ¦¸ªº«Ê¥]¹LÂo¡C§Ú§Æ±æ¦p¦¹¡C



\nameurl{http://www.watchguard.com}{WatchGuard} ¬O¤@­Ó«D±`¥X¦â¨¾¤õÀð¤½¥q¡M¥X°â¯u¥¿¦n¥ÎªºÀH´¡¦¡¨¾¤õÀð³]³Æ(plug-in Firebox)¡M¥B¦V§Ú§K¶O´£¨Ñ¡MÅý§Ú¥i¥H¥þ¤O¼¶¼g³o¨ÇªF¦è¡M¥H¤ÎºûÅ@¹L©¹ªº¤@¨ÇªF¦è¡C§Ú­ì¥»¹w¦ô 6 ­Ó¤ë´N¥i¥H¤F¡M¦ý¹ê»Ú¤W«oªá¤F 12 ­Ó¤ë¡M¤£¹L§Ú¦b³Ì«á¶¥¬qÄ±±o°µ±oÁÙ¤£¿ù´N¬O¤F¡C¦hÂ½­«¼g¡NµwºÐ·´Ãa¡N¤â´£¹q¸£¾DÅÑ¡N¼Æ­ÓÀÉ®×¨t²Îªº·l·´¡N¥H¤Î«á¨Óªºº·¹õÃa±¼¡M³Ì²×¡MÁÙ¬O°µ¥X¨Ó¤F¡C



¦b³o¸Ì¡M§Ú·Q¼á²M¤@¨ÇªB¤Íªº¿ù»~Æ[©À¡R§Ú¨Ã«D®Ö¤ß(kenrl)¸Ì­±ªº±M®a¡C§Ú¤§©Ò¥Hª¾¹D³o¨Ç¡M¬O¥Ñ©ó¬Y¨Ç®Ö¤ß¤u§@Åý§Ú±µÄ²¨ì¥L­Ì¨ä¤¤ªº¤@¨Ç¦¨­û¡R David S. Miller¡NAlexey Kuznetsov¡NAndi Kleen¡NAlan Cox¡C¤£¹L¡M½ÞÀY°©(³ÌÃøªº)³£¥Ñ¥L­Ì°Ù¤F¡M³Ñ¤Uªº¨§»G(¦w¥þ©M®e©öªº)¤~½ü¨ì§Ú¨Ó¦¬¬B°Õ¡C




\section{¯u¥¿ªº Rusty «Ê¥]¹LÂo§Ö³t«ü«n}

¤j³¡¤À¤H³£¶È¥Î³æ¤@ªº PPP ¼·±µ¤Wºô¡M¦P®É¨Ã¤£·Q¥ô¦ó¤H¶i¤J¥L­Ìªººô¸ô¡N©Î¨¾¤õÀð¡R

\begin{tscreen}
\begin{verbatim}
## Insert connection-tracking modules (not needed if built into kernel).
# insmod ip_conntrack
# insmod ip_conntrack_ftp

## Create chain which blocks new connections, except if coming from inside.
# iptables -N block
# iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT
# iptables -A block -j DROP

## Jump to that chain from INPUT and FORWARD chains.
# iptables -A INPUT -j block
# iptables -A FORWARD -j block
\end{verbatim}
\end{tscreen}





\section{«Ê¥]¦p¦ó¬ï¶V(traverse)¹LÂo}

®Ö¤ß±q 'filter' ªí®æªº¤T­Ó¦Cªí(lists) ¶}©l¡Q³o¤T­Ó¦Cªí¥s°µ {\bfseries firewall chains(¨¾¤õÀðÃì)} ©Î´N¥s
{\bfseries chains(Ãì)}¡C ³o¤T­ÓÃì¤À§O¬°{\bfseries INPUT}¡N{\bfseries OUTPUT} ¡N©M {\bfseries FORWARD} ¡C



{\bfseries ³o¸ò 2.0 ©M 2.2 ®Ö¤ß¦³«Ü¤j®t§O®@¡T}



¹ï©ó ASCII ÃÀ³N°g¨Ó»¡¡M¦UÃì(chains)ªº§G¸m¦p¤U¡R
\begin{verbatim}
                          _____
Incoming                 /     \         Outgoing
       -->[Routing ]--->|FORWARD|------->
          [Decision]     \_____/        ^
               |                        |
               v                      ____
              ___                    /    \
             /   \                  |OUTPUT|
            |INPUT|                  \____/
             \___/                      ^
               |                        |
                ----> Local Process ----
\end{verbatim}




¨ä¤¤¤T­Ó°é¥NªíµÛ«e­zªº¤T­ÓÃì¡M·í¤@­Ó«Ê¥]©è¹F¤W¹Ï¤¤ªº¨ä¤¤¤@­Ó°é¡M¬ÛÀ³ªºÃì´N·|±µ¨üÀËÅç(examined)¡M¥H¨M©w¨º­Ó«Ê¥]ªº©R¹B¡C¦pªGÃì»¡ DROP ±¼³o­Ó«Ê¥]¡M¨º»ò¥¦´N·|´N¦a¥¿ªk¡M¦ý¦pªGÃì»¡ ACCEPT ³o­Ó«Ê¥]¡M¨º»ò¥¦´NÄ~Äò¦b¹Ï¥Ü¤¤¬ï¶V¡C



¤@­ÓÃì(chain)¨ä¹ê´N¬O²³¦h³W«h(rules)¤¤ªº¤@­ÓÀË¬d²M³æ(checklist)¡C¨C¤@±ø³W«h³£·|»¡¡§¦pªG«Ê¥]ªíÀY¬Ý°_¨Ó¹³³o¼Ë¡M´N¦p¦¹³o¯ë³B¸m³o­Ó«Ê¥]¡¨¡C¦pªG³W«hªº³]©w©M«Ê¥]¨Ã¤£²Å¦X(match)¡M¨º»ò´N¥æ¥ÑÃì¤¤ªº¤U¤@­Ó³W«hÄ~Äò³B²z¡C¦Ó³Ì²×¡M¦pªG¦A¨S¦³³W«h¥i¥H°Ñ¦Ò¡M¨º»ò®Ö¤ß´N·|¬ÝÃìªº{\bfseries policy(­ì«h)} ¥H¨M©w«ç»ò°µ¡C¦b¤@­Ó¦w¥þ¦Ü¤Wªº¨t²Î¸Ì¡M­ì«h(policy)³q±`³£·|§i¶D®Ö¤ß DROP ±¼¸Ó«Ê¥]¡C



\begin{enumerate}
\item ·í¤@­Ó«Ê¥]¶i¤Jªº®É­Ô(°²³]¡M³q¹L Ethernet ºô¸ô¥d)¡M®Ö¤ß­º¥ý¬Ý¬Ý«Ê¥]ªº¥Øªº¦a(destination)¡R³oºÙ¤§¬° ' rouging (¸ô¥Ñ)'¡C
\item ¦pªG¥Øªº¦a§}¬°¥»¾÷¡M³o­Ó«Ê¥]´N«ö¹Ï¥Ü¤U¦æ¦Ü INPUT Ãì¡C¦pªG¥¦¯à°÷³q¹L¡M¨º»òµ¥«Ý³o­Ó«Ê¥]ªº¦æµ{(processes)´N±N¤§±µºÞ¤U¨Ó¡C
\item §_«h¡M¦pªG®Ö¤ß¨Ã¨S±Ò°ÊÂà»¼¥\¯à(forwarding)¡M©Î¬O¥¦¤£ª¾¹D¦p¦óÂà»¼³o­Ó«Ê¥]¡M¨º»ò³o­Ó«Ê¥]´N·|³Q¥á±ó(dropped)¡C¦pªGÂà»¼¥\¯à¤w¸g±Ò°Ê¡M¦P®É«Ê¥]«ü¦V¥t¤@­Óºô¸ô¬É­±(¦pªG±zÁÙ¦³¥t¥~¤@±i)¡MµM«á³o­Ó«Ê¥]´N«ö¹Ï¥Ü¥k¦æ¦Ü FORWARD Ãì¡C¦pªG¥¦³Q±µ¨ü(ACCEPT)¡M¨º»ò¥¦´N·|³Q°e¥X¥h¡C
\item ³Ì«á¤@ºØ±¡§Î¡M¤@­Ó¦b¥»¾÷¹B¦æªºµ{¦¡·|°e¥Xºô¸ô«Ê¥]¡C«Ê¥]´Nª½±µ¥æµ¹ OUTPUT Ãì¡R¦pªG¬O ACCEPT¡MµM«á³o­Ó«Ê¥]·|Ä~Äò°e¥X¦Ü¥¦©Ò«ü¦Vªº¬É­±¡C
\end{enumerate}





\section{¨Ï¥Î iptables}

¦pªG±z»Ý­n¯S©wªº¸Ô²Ó¤F¸Ñ¡Miptables ¦³¤@­Ó«D±`¸ÔºÉªº manual page ({\ttfamily man iptables})¡C°²¦p±z¼ô±x ipchains ªº¸Ü¡M©Î³\¥i¥Hª½±µ¸õ¨ì \ref{Appendix-A} {(iptables »P ipchains ªº®t²§ (Differences Between iptables and ipchains))} ¥h¬Ý¡Q¥¦­Ì¬O«D±`ªñ¦üªº¡C



±zÁÙ¥i¥H§Q¥Î {\ttfamily iptables} °µ³\¦h¤£¦Pªº¨Æ±¡®@¡C±z©Ò¶}©lªº¨º¤T­Ó¤º«Ø(buit-in) Ãì¡R {\ttfamily INPUT}¡N{\ttfamily OUTPUT}¡N©M{\ttfamily FORWARD} ¡M±z¬O¤£¯à§R°£ªº¡CÅý§Ú­Ì¬Ý¬Ý¾ã­ÓÃìªººÞ²z¹B§@§a¡R

\begin{enumerate}
\item  «Ø¥ß¤@­Ó·sÃì (-N)¡C
\item  §R°£¤@­ÓªÅÃì (-X)¡C
\item  §ïÅÜ¤@­Ó¤º«ØÃìªº­ì«h (-P)¡C
\item  ¦C¥X¤@­ÓÃì¤¤ªº³W«h (-L)¡C
\item  ²M°£¤@­ÓÃì¤¤ªº©Ò¦³³W«h (-F)¡C
\item  Âk¹s(zero) ¤@­ÓÃì¤¤©Ò¦³³W«hªº«Ê¥]¦r¸`(byte) °O¼Æ¾¹ (-Z)¡C
\end{enumerate}


¦³¦n¨Ç¤èªk¥i¥H²ÎÄw¤@­ÓÃì¤¤ªº³W«h¡R

\begin{enumerate}
\item  ©µ¼W(append) ¤@­Ó·s³W«h¨ì¤@­ÓÃì (-A)¡C
\item  ¦bÃì¤º¬Y­Ó¦ì¸m´¡¤J(insert) ¤@­Ó·s³W«h(-I)¡C
\item  ¦bÃì¤º¬Y­Ó¦ì¸m´À´«(replace) ¤@±ø³W«h (-R)¡C
\item  ¦bÃì¤º¬Y­Ó¦ì¸m§R°£(delete) ¤@±ø³W«h (-D)¡C
\item  §R°£(delete) Ãì¤º²Ä¤@±ø³W«h (-D)¡C
\end{enumerate}





\subsection{·í±zªº¾÷¾¹±Ò°Ê®É¡M±z©Ò¬Ý¨ìªº}

iptables ¥i¥H°µ¦¨¼Ò²Õ(module)¡M¥s°µ `iptable\_filter.o' ¡M·í±z²Ä¤@¦¸¶] {\ttfamily iptables} ´N·|³Q¦Û°Ê¸ü¤J¡C¥¦¤]¥i¥H¥Ã¤[©Êªº«Ø¸m©ó®Ö¤ß¸Ì­±¡C



¦b¶]¥ô¦ó iptables ©R¥O¤§«e (¤p¤ß¡R¦³¨Ç®M¥ó(distributions) ©Î³\·|¥Î¥¦­Ìªº°_©l©R¥O½Z¨Ó¶] iptables)¡M¤º«ØÃì( `INPUT'¡N`FORWARD'¡N©M `OUTPUT' )±N¤£±a¥ô¦ó³W«h¡M©Ò¦³Ãì³£±N­ì«h³]¬° ACCEPT¡C±z¥i¥H±N iptable\_filter ¼Ò²Õ¿ï¶µ³]¬° `forward=0' ¡M¨Ó§ïÅÜ¹w³]ªº FORWARD Ãì­ì«h¡C




\subsection{¤@­Ó³æ¤@³W«hªº¹B§@}

¤U­±Åý§Ú­Ì¨Ó¼ô½m¤@¤U­ì«hªº¹B¥Î§a¡M©Ò¿×¼ô¯à¥Í¥©¬O¤]¡C±z³Ì±`¥Îªº©Î³\·|¬O append (-A) ©M delete (-D) ©R¥O¡C¦Ü©ó¨ä¥¦¦p insert (-I) ©M replace (-R)¡M ¥u¬O³o¨Ç·§©Àªº©µ¦ù¦Ó¤w¡C



¨C¤@±ø³W«h³£­­©w¤F¤@²Õ±ø¥ó(conditions)»P¯S©w«Ê¥]¤ñ¹ï¡M¥H¤Î·í¥¦­Ì²Å¦X®É­n¦p¦ó³B¸m(«ü¤@­Ó`target' )¡C¤ñ¤è»¡¡M±z©Î³\­n¥á±ó©Ò¦³¨Ó¦Û127.0.0.1 ³o­Ó IP ¦a§}ªº ICMP «Ê¥]¡M¦]¦Ó§Ú­Ì³o¸Ìªº±ø¥ó´N¦¨¬°³o¼Ë¡R¨ó©w¥²¶·¬O ICMP¡M¦Ó¨Ó·½¦a§}¥²¶·¬O 127.0.0.1 ¡M¦Ó§Ú­Ìªº target(¥Ø¼Ð)±N·|¬O`DROP' ¡C



§Ú­ÌºÙ 127.0.0.1 ¬° `loopback' ¬É­±¡M´Nºâ±z¨S¦³¯u¹êªººô¸ô³s±µ¡M±z¤]·|¦³³o­Ó¬É­±ªº¡C±z¥i¥H¥Î `ping' ³o°¦µ{¦¡²£¥Í³o¼Ëªº«Ê¥] (¥¦¥u¬O°e¥X¤@­Ó type 8(echo request)ªº ICMP «Ê¥]¡M¦Ó©Ò¦³¼Ö©ó¦^À³ªº¦X§@ºÝ(cooperative hosts) «h°e¦^¤@­Ó type 0(echo reply)ªº ICMP «Ê¥])¡C¥Î¨Ó´ú¸Õ¬O«Ü¦n¥Îªº¡C

\begin{tscreen}
\begin{verbatim}
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.2 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.2 ms
# iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
#
\end{verbatim}
\end{tscreen}


³o¸Ì±z¥i¥H¬Ý¨ì²Ä¤@­Ó ping ¦¨¥\¤F(³o¸Ìªº `-c 1' °Ñ¼Æ¬O§i¶D ping ¥u°e¥X¤@­Ó«Ê¥])¡C



µM«á¡M§Ú­Ì¬°`INPUT' ©µ¼W(-A)¤@±ø³W«h¡M±N¨Ó¦Û 127.0.0.1(`-s 127.0.0.1') ªº ICMP ¨ó©w (`-p icmp') «Ê¥]°e¦Ü DROP ³o­Ó¥Ø¼Ð (-j DROP)¡C 



µM«á§Ú­Ì¥i¥H¥Î²Ä¤G­Ó ping ¨Ó´ú¸Õ§Ú­Ìªº³W«h¡C¦bµ{¦¡©ñ±óÄ~Äòµ¥«Ý¨º¨Ç¥Ã¤£¨ì¨Óªº¦^À³¤§«e¡M±N¦³¤@¬q¼È°±¡C



§Ú­Ì¦³¨â­Ó¤èªk¥i¥H²¾°£³W«h¡C­º¥ý¡M¦]¬°§Ú­Ì¥Ø«e¨î©w¦b input Ãì¤¤¥u¦³°ß¤@¤@±ø³W«h¡M©Ò¥H§Ú­Ì¥i¥H«ü©w¼Æ¦r¨Ó²¾°£¡M¨Ò¦p¡R
\begin{tscreen}
\begin{verbatim}
        # iptables -D INPUT 1
        #
\end{verbatim}
\end{tscreen}

³o¼Ë´N§â²Ä¤@±ø³W«h±q INPUT Ãì¤¤²¾°£±¼¡C



²Ä¤G­Ó¤èªk¬O¬M®g(mirro)¤W­±ªº -A ©R¥O¡M¦ý¥Î -D ¨Ó¥N´À -A ¦Ó¤w¡C·í±z¦³¤@­ÓÃì¡M¸Ì­±¼g¦³«D±`½ÆÂøªº³W«h¡M¦Ó¤S¤£·Q³v¦æ¼Æ¥X²Ä 37 ¦æ´N¬O±z­nªº¨º±ø³W«h¡M³o®É­Ô¡M³o¤èªk´N«D±`¦³¥Î¤F¡C
\begin{tscreen}
\begin{verbatim}
        # iptables -D INPUT -s 127.0.0.1 -p icmp -j DROP
        #
\end{verbatim}
\end{tscreen}

¦b©R¥O¦æ¤¤¡M¨ä»yªk¬O -D ¥²¶·©M -A (©Î -I¡N©Î -R) ©R¥Oªº¦ì¸m¤@­P¡C¦pªG¦b¦P¤@­ÓÃì¤¤¦³¼Æ±ø¬Û¦Pªº³W«h¡M¨º»ò¥u¦³²Ä¤@±ø·|³Q²¾°£±¼¡C




\subsection{¹LÂo³W®æ}

§Ú­Ì¤w¸g¬Ý¹L¥Î `-p' ¨Ó«ü©w¨ó©w¡M¥H¤Î¥Î `-s' ¨Ó«ü©w¨Ó·½¦a§}¡M¦ýÁÙ¦³¨ä¥¦¿ï¶µ§Ú­Ì¬O¥i¥H¥Î¨Ó«ü©w¥X¤@­Ó«Ê¥]ªº¯S©º¡C©³¤U¬O¤@­Ó§¹¾ãªº·§­z¡C




\subsubsection{«ü©w¨Ó·½©M¥Øªº¦a¤§ IP ¦a§}}

§Ú­Ì¥i¥H¥Î¥|ºØ¤èªk¨Ó«ü©w¨Ó·½(`-s'¡N©Î`--source'¡N©Î `--src') ©M¥Øªº¦a(`-d'¡N©Î`--destination'¡N©Î`--dst') IP ¦a§}¡C³Ì±`¥Îªº¤èªk¬O¨Ï¥Î§¹¾ã¦WºÙ¡M¨Ò¦p `localhost' ©Î  `www.linuxhq.com' ¡C²Ä¤GºØ¤èªk¬O«ü©w¨ä IP ¦a§}¡M¨Ò¦p `127.0.0.1' ¡C



²Ä¤T©M²Ä¥|ºØ¤èªk¤¹³\«ü©w¤@²Õ(group) IP¦a§}¡M¨Ò¦p `199.95.207.0/24' ©Î `199.95.207.0/255.255.255.0' ¡M³o¨â­Ó³]©w³£«ü©w¤F©Ò¦³±q 199.95.207.0 ¨ì 199.95.207.255 ¤§¶¡ªº IP ¦a§}¡Q¦Ó¦b¼Æ¦r«á­±ªº `/' ²Å¸¹¬O§i¶D¨t²Î­þ³¡¥÷ IP ¤~¦³®Ä¡C `/32' ©Î `/255.255.255.255' ¬°¹w³]­È(©Ò¦³ IP ­È³£¥²¶·§k¦X)¡C¥þ³¡¥Î `/0' ¨Ó«ü©w IP ¦a§}¤]¬O¥i¦æªº¡M¨Ò¦p¡R
\begin{tscreen}
\begin{verbatim}
        [ NOTE: `-s 0/0' is redundant here. ]
        # iptables -A INPUT -s 0/0 -j DROP
        #
\end{verbatim}
\end{tscreen}


¤£¹L³o«D±`¤Ö¥Î¡M¦]¬°¥H¤Wªº®ÄªG©M¤£«ü©w `-s' ²@µL¨â¼Ë¡C




\subsubsection{¬Û¤Ï«ü©w}

³\¦hºX¼Ð(flags)¡M¥]¬A `-s' (©Î `--source')¡N©M `-d' (©Î `--destination')¡M¥i¥H¦b¥¦­Ì«e­±©ñ¸m¤@­Ó `!' ²Å¸¹(µo­µ¬°`not')  ¡M¨Ó²Å¦X©Ò¦³«D(NOT)¨ä½á¤©­Èªº¦a§}¡C¤ñ¤è»¡¡M`-s ! localhost' ²Å¦X©Ò¦³{\bfseries «D(not)} ¨Ó¦Û¥»¾÷ªº«Ê¥]¡C




\subsubsection{«ü©w¨ó©w}

¨ó©w¥i¥H¥Î `-p' (©Î `--protocol') ºX¼Ð¨Ó«ü©w¡C¨ó©w¥i¥H¬°¤@­Ó¸¹½X(°²¦p±zª¾¹D IP ¨ó©w¼Æ­Èªº¸Ü)¡M©Î¬O¤@­Ó½Ñ¦p `TCP'¡N©Î`UDP'¡N©Î`ICMP' ³o¼Ëªº¦WºÙ¡C¤j¤p¼g¨SÃö«Y¡M©Ò¥H `tcp' ©M `TCP' ³£¥i¥H¤u§@¡C



¨ó©w¤]¥i¥H¥[¤W¤@­Ó `!' «e¸m²Å¸¹¡M¨Ï¤§¬Û¤Ï¡C¨Ò¦p `-p ! TCP' «h«ü©w¤F©Ò¦³{\bfseries «D} TCP ªº«Ê¥]¡C




\subsubsection{«ü©w¬É­±}

§Ú­Ì¥Î `-i' (©Î `--in-interface') ©M `-o' (©Î `--out-interface') ¿ï¶µ¨Ó«ü©w¤@­Ó²Å¦Xªº{\bfseries ¬É­±(interface)}¡C¤@­Ó¬É­±´N¬O«Ê¥]¶i¤J(`-i') ¡M©Î¶Ç¥X(`-o')¤§ª«²z³]³Æ¡C±z¥i¥H¥Î {\ttfamily ifconfig} ©R¥O¦C¥X­þ¨Ç¬É­±¬O¶]°_¨Ó(`up' )ªº¡C



¬ï¶V {\ttfamily INPUT} Ãìªº«Ê¥]¤£·|¦³¶Ç¥X(output)¬É­±ªº¡M©Ò¥H¡M¥ô¦ó¦bÃì¤¤¨Ï¥Î `-o' ¿ï¶µªº³W«h³£¤£»P¤§²Å¦X¡C¦P¼Ëªº¡M¬ï¶V {\ttfamily OUTPUT} Ãìªº«Ê¥]¤]¤£·|¦³¶Ç¤J(input)¬É­±¡M©Ò¥H¦bÃì¤¤¥ô¦ó±a `-i' ¿ï¶µªº³W«h¤]¬O¤£²Å¦Xªº´N¬O¤F¡C



¶È¶È¬O¬ï¶V {\ttfamily FORWARD} Ãìªº«Ê¥]¤~·|¦P®É¦³¶Ç¤J©M¶Ç¥X¬É­±¡C



«ü©w¤@­Ó¤£¦s¦bªº¬É­±¬O§¹¥þ¦Xªk(legal)ªº¡Q¤Ï¥¿¦b¬É­±ÁÙ¨S°_¨Ó¤§«e¡M³o±ø³W«h¬O¤£·|²Å¦Xªº¡C³o¹ï©ó PPP ¼·±µ(³q±`·|¬O{\ttfamily ppp0}) ©Î¬ÛÃþ³s½u¡M´N·¥¤§¦³¥Î¤F¡C



¨Ò¦p¦b¤@­Ó¯S®í¨Ò¤l¤¤¡M¬É­±¬O¥Î¤@­Ó `+' µ²§Àªº¸Ü¡M´Nªx«ü©Ò¦³¥H¦¹¦r¦ê¶}ÀYªº¬É­±(¤£ºÞ¥¦­Ì¥Ø«e¬O§_°_¨Ó¤F)¡C¨Ò¦p¡M­n«ü©w¤@±ø³W«h¨Ó²Å¦X©Ò¦³ªº PPP ¬É­±ªº¸Ü¡M{\ttfamily -i ppp+} ¿ï¶µ´N¥i¥H¥Î¤W¤F¡C



¬É­±¦WºÙ«e­±¥i¥H¥Î¤@­Ó`!' ²Å¸¹¨Ó²Å¦X¤@­Ó»P«ü©w¬É­± {\bfseries ¤£} ²Å¦Xªº«Ê¥]¡C




\subsubsection{«ü©w«Ê¥]¸H¤ù (Fragments)}

¦³®É­Ô¡M¤@­Ó«Ê¥]·|¦]¬°¤Ó¤j¦Ó¤£¯à¤@¦¸¹L¶ë¶i³s½u¥h¡C·í³o¼Ëªº¨Æ±¡µo¥Í¤F¡M«Ê¥]·|³Q¤Á³Î¦¨ {\bfseries ¸H¤ù(fragments)}¡M¦P®É·|¥H¦h­Ó«Ê¥]¨Ó¶Ç°e¡C¦Ó¥t¤@ºÝ«h­«²Õ³o¨Ç¸H¤ù¥HÁÙ­ì¾ã­Ó«Ê¥]¡C



¦ý¸H¤ùªº°ÝÃD¬O¡M²Ä¤@­Ó°_©l¸H¤ù¦³¾ã­Ó«Ê¥]ªíÀYÄæ¦ì(IP+TCP¡NUDP¡N©M ICMP)¥i¨ÑÀË¬d¡M¦ý«áÄ~«Ê¥]«o¥u¥]§tªíÀYªº¤p³¡¥÷(¤£±aÃB¥~¨ó©wÄæ¦ìªº IP)¡C³o¼Ëªº¸Ü¡M­nÀË¬d«áÄ~¸H¤ù¤§¨ó©wªíÀY(¤ñ¤è¥Ñ TCP¡NUDP¡N©M ICMP extensions ¦Ó¦¨)¡M´N¤£¥i¯à¤F¡C



¦pªG±z­n°µ³s½u°lÂÜ©Î NAT¡M¨º©Ò¦³¸H¤ù¦b»¼µ¹«Ê¥]¹LÂo½X¤§«e³£·|¶×¦X¦^¤@°_¡M©Ò¥H±zµL»Ý¾á¤ß¸H¤ù°ÝÃD¡C



µM¦Ó¡M­n§Ë©ú¥Õ¹LÂo³W«h¦p¦ó³B²z¸H¤ùªº¡M´NÅÜ±o«D±`­«­n¤F¡C¥ô¦ó³W«h­n¸ß°Ýªº¸ê®Æ¦Ó§Ú­Ì¨Ã¨S¦³®É¡M±N³Qµø¬° {\itshape ¤£\/} ²Å¦X¡C¤]´N¬O»¡¡M²Ä¤@­Ó¸H¤ù«Ê¥]ªº³B²z©M¨ä¥¦«Ê¥]¤@¼Ë¡C¦ý²Ä¤G¤Î¤§«áªº¸H¤ù´N¤£¬O³o¼Ë¤F¡C³o¼Ëªº¸Ü¡M¤@±ø {\ttfamily -p TCP --sport www} («ü©w¨Ó·½°ð¤f¬°`www')ªº³W«h¡M±N¥Ã»·¤£©M¸H¤ù²Å¦X(°£²Ä¤@­Ó¸H¤ù¥~)¡C¬Û¤Ïªº³W«h¦p{\ttfamily -p TCP --sport ! www} ¤]¤@¼Ë´N¬O¤F¡C



¤£¹L¡M±z¥i¥H¥Î `-f' (or `--fragment') ºX¼Ð¯S§O¬°²Ä¤G¤Î¥H«áªº¸H¤ù«ü©w¤@±ø³W«h¡C¦b `-f' «e­±¥[¤W¤@­Ó `!' ¨Ó«ü©w¤@±ø³W«h {\itshape ¤£\/} ¾A¥Î©ó²Ä¤G¤Î¥H«á¸H¤ù¡M¤]¬O¥i¦æªº¡C



³q±`¡MÅý²Ä¤G¤Î¥H«á¸H¤ù³q¹L¬O³Qµø¬°¦w¥þªº¡M¦]¬°¦pªG¹LÂo·|¼vÅT²Ä¤@­Ó¸H¤ùªº¸Ü¡M¨º»ò¤]´N¥i¥HÁ×§K¦b¥Ø¼Ð¥D¾÷¶i¦æ­«²Õ¡Q¦ý¬O¡M¤@¨Ç¤wª¾ªº¯ä¦äÅã¥Ü¡M¥á°e¸H¤ù«Ê¥]¥i¥H»´©öªºÅý¥D¾÷·í±¼¡C¨º¬O»Õ¤U­nÀ³¥Iªº¨Æ±¡¤F¡C



ºô¸ôª±®a­n¯d·Nªº¬O¡R·í¶i¦æ³o¼ËªºÀË´ú®É¡M¤£§¹¾ãªº«Ê¥](¤Óµuªº TCP¡NUDP¡N©M ICMP «Ê¥]·|Åý¤õÀðµ{¦¡Åª¤£¨ì°ð¤f©Î ICMP ½X©MÃþ«¬) ·|³Q¥á±ó¡C¦]¦¹¡M TCP ¸H¤ù³£¥Ñ²Ä 8 ­Ó¦ì¸m¶}©lªº *¡C



(* Ä¶ªÌµù¡R§Ú¤]¤£¬O«Ü©ú¥Õ§@ªÌ³o¸Ì©Ò«ü¦óª«¡M­ì¤å¬O¡R¡¥So are TCP fragments starting at position 8¡¦¡C¦]¬°Ãi±o¥hÂ½¸ê®Æ¡M¬G¤£ª¾¹D position 8 ¬O«ü TCP ªíÀY¦ì¸mÁÙ¬O¨ä¥¦¡C°²¦p±z§ä¨ìµª®×¡MÅwªï¼g«Hµ¹§Ú¥H§@¼á²M¡C)



Á|¨Ò¨Ó»¡¡M¥H¤Uªº³W«h·|¥á±ó¥ô¦ó°eµ¹ 192.168.1.1 ªº¸H¤ù¡C

\begin{tscreen}
\begin{verbatim}
# iptables -A OUTPUT -f -d 192.168.1.1 -j DROP
#
\end{verbatim}
\end{tscreen}





\subsubsection{©µ¦ù iptables ¡R·sªº¤ñ¹ï(matches)}

{\ttfamily iptables} ¬O {\bfseries ¥i©µ¦ùªº(extensible)}¡M¤]´N¬O»¡¡M®Ö¤ß©M iptables ¤u¨ã¥i¥H¶i¦æÂX®i¥H´£¨Ñ·sªº¥\¯à¡C



¬Y¨Ç©µ¦ù(Extensions)¬O¼Ð·Çªº¡M¦ý¦³¨Ç«h¥i¥H»¡¬O¬£¥Í¥X¨Óªº¡C§OªºªB¤Í©Î³\·|»s°µ¥X¤@¨Ç©µ¦ù¡M¦P®É´²¼½µ¹¦X¾Aªº¥Î¤á¡C



®Ö¤ßªº©µ¦ù³q±`©~©ó®Ö¤ß¼Ò²Õ¥Ø¿ý¤º¡M¨Ò¦p /lib/modules/2.3.15/net ¡C°²¦p±zªº®Ö¤ß¬O¥Î CONFIG\_KMOD ³]©w¨Ó½sÄ¶ªº¸Ü¡M¥¦­Ì¬OÀ³»Ý¨D¸ü¤Jªº¡M©Ò¥H±zµL»Ý¤â°Êªº´¡¤J¥¦­Ì¡C



µM¦Ó¡Miptables µ{¦¡ªº©µ¦ù«h³q±`¬O©~©ó /usr/local/lib/iptables/ ¸Ì­±ªº¤À¨É¨ç¦¡®w¡M©ÎªÌ¦³¨Ç´²¼½ª©¥»·|±N¥¦­Ì©ñ¶i /lib/iptables ©Î /usr/lib/iptables ¸Ì¥h¡C



©µ¦ù¦³¨â­ÓºØÃþ¡R·s¥Ø¼Ð(target)¡M©M·s¤ñ¹ï(match)¡Q¤U­±§Ú­Ì´NÁ¿Á¿·s¥Ø¼Ð§a¡C¦³¨Ç¨ó©w·|¦Û°Ê´£¨Ñ·sªº´ú¸Õ(tests)¡R¥Ø«e¦³ TCP¡NUDP¡N©M ICMP¡M¦p¤U­z¡C



¦b©R¥O«á¨Ï¥Î  `-p' ¿ï¶µ§â©µ¦ù¸ü¤J¶i¨Ó¡M±z´N¥i¥H¨Ó«ü©w¤@­Ó·s´ú¸Õ¤F¡C·í©µ¦ù¿ï¶µ¤¹³\ªº®É­Ô¡M¨Ï¥Î `-m' ¨Ó¸ü¤J©µ¦ù¡M«h¥i¥H©ú½T«ü¥Ü¤@­Ó·s´ú¸Õ¡C



¦p»Ý¬Y­Ó©µ¦ùªº¨D§U¸ê®Æ¡M¥i¥H¨Ï¥Î¿ï¶µ«á±µ `-h' ©Î `--help' ±N¤§¸ü¤J(`-p'¡N `-j'¡N©Î `-m')¡M¨Ò¦p¡R
\begin{tscreen}
\begin{verbatim}
# iptables -p tcp --help
#
\end{verbatim}
\end{tscreen}





\paragraph{TCP ©µ¦ù}

¦pªG«ü©w¤F `-p tcp' ¡MTCP ¤§©µ¦ù·|¦Û°Ê¸ü¤Jªº¡C¥¦´£¨Ñ¦p¤U¿ï¶µ(¨Ã¤£²Å¦X fragments)¡C



\begin{description}
\item[--tcp-flags] \mbox{}

«á±µ¤@­Ó `!' ¿ï¶µ¡M«h¦³¨â­ÓºX¼Ðªº¦r¦êÅý±z¯à°÷¹ï«ü©wªº TCP ºX¼Ð¶i¦æ¹LÂo¡C ²Ä¤@­Ó¦r¦ê¬O¾B¸n(mask)¡R¤@­Ó±z±ýÀË¬dªººX¼Ð¦Cªí¡C²Ä¤G­Ó¦r¦ê¬O­n»¡­þ¨ÇªF¦è­n³]©w¡C¨Ò¦p¡R

\begin{tscreen}
\begin{verbatim}
# iptables -A INPUT --protocol tcp --tcp-flags ALL SYN,ACK -j DENY
\end{verbatim}
\end{tscreen}


³oªí¥Ü©Ò¦³ºX¼Ð³£­nÀË¬d (`ALL' ´N¬Oªx«ü `SYN,ACK,FIN,RST,URG,PSH')¡M¦ý¥u¦³ SNY ©M ACK ³Q³]©w¦Ó¤w¡C¥t¥~¦³¤@­Ó°Ñ¼Æ `NONE' «h¬O¨SºX¼Ðªº·N«ä¡C



\item[--syn] \mbox{}

¬°`--tcp-flags SYN,RST,ACK SYN' ªºÂ²¼g¡M¨ä«e­±¥i¥H³Æ¿ï¤@­Ó `!' ²Å¸¹¡C



\item[--source-port] \mbox{}

¨ä«á¥i¥H³Æ¿ï `!' ¡MµM«á¬O¤@­Ó³æ¿Wªº TCP °ð¤f©Î¤@­Ó°ð¤f­È°ì(range)¡C°ð¤f¥i¥H¬° /etc/services ©Ò¦C®q°ð¤f¦WºÙ¡M¤]¥i¥H¬O¤@­Ó¼Æ¦r¡C¦pªG¬O­È°ìªº¸Ü¡M¥i¥H¬O¤@¹ï¥Î`:' ²Å¸¹¤À¹jªº°ð¤f¦W¦r¡M©Î¤@­Ó°ð¤f«á­±±a `:' («ü¤j©ó©Mµ¥©ó¸Ó°ð¤f)¡M¤S©Î¬O¤@­Ó°ð¤f«e­±±a `:' («ü¤p©ó©Mµ¥©ó¸Ó°ð¤f)¡C



\item[--sport] \mbox{}

µ¥¦P©ó `--source-port'¡C



\item[--destination-port] \mbox{}

©M 

\item[--dport] \mbox{}

»P¤W¦P¡M¥u¬O¥¦­Ì¬O¥Î¨Ó«ü©w¥Øªº¦a¦Ó«D¨Ó·½°ð¤f¥[¥H¤ñ¹ï¡C



\item[--tcp-option] \mbox{}

¨ä«á¥i¥H³Æ¿ï `!' ¡MµM«á¬°¤@­Ó¼Æ¦r¡M¥Î¨Ó¤ñ¹ï¤@­Ó TCP ¿ï¶µµ¥©ó¸Ó¼Æ¦rªº«Ê¥]¡C°²¦p»Ý­nÀË¬d TCP ¿ï¶µ¡M¨º¨Ç TCP ªíÀY¤£§¹¾ãªº«Ê¥]´N·|¦Û°Êªº³Q¥á±ó¡C

\end{description}





\subparagraph{¤@­Ó TCP ºX¼Ðªº¸ÑÄÀ}

¦³®É­Ô¡M¤¹³\³æ¦V¦Ó«DÂù¦Vªº TCP ³s½u·|«Ü¦n¥Î¡C¨Ò¦p¡M±z©Î³\·Q¤¹³\³s½u¨ì¥~³¡ WWW ¦øªA¾¹¡M¦ý«o¤£·Q¨Ó¦Û¸Ó¦øªA¾¹ªº³s½u¡C



³Ì¥®¸XªºÁ|°Ê©Î³\·|¬O¾×±¼¨Ó¦Û¸Ó¦øªA¾¹ªº TCP «Ê¥]¡C¦ý¤£©¯ªº¬O¡MTCP ³s½u®Ú¥»´N­n¨D«Ê¥]¬OÂù¦V¶Ç»¼ªº¡C



¸Ñ¨M¤§¹D¬O§â¨º¨Ç­n¨D³s½uªº«Ê¥]¾×±¼¡C³o¨Ç«Ê¥]³QºÙ¬° {\bfseries SYN} «Ê¥](¶â¡M§Þ³N¤WÁ¿¡M¥¦­Ì¬O±a SYN ³]©wªº«Ê¥]¡M¦Ó FIN ©M ACK ¼ÐÅÒ«h¬OªÅ¥Õ¡M¥u¬O§Ú­Ì±N¤§Â²ºÙ¬° SYN «Ê¥]¦Ó¤w)¡C­n¥u­­¨î³o¼Ëªº«Ê¥]ªº¸Ü¡M§Ú­Ì´N¥i¥H¨î¤î¨º¨Ç¥~¨Óªº³s½u¹Á¸Õ¤F¡C



`--syn' ºX¼Ð¥i¥H¥Î©ó³o¨Ç¤è­±¡R¥¦¶È¹ï¨º¨Ç«ü©w¬° TCP ¨ó©wªº³W«h¦³§@¥Î¡C¨Ò¦p¡M«ü©w¨Ó¦Û 192.168.1.1 ªº TCP ³s½u½Ð¨D¡R
\begin{tscreen}
\begin{verbatim}
-p TCP -s 192.168.1.1 --syn
\end{verbatim}
\end{tscreen}




³oºX¼Ð¤]¥i¥H«á±µ¤@­Ó `!' ¨Ó¤Ï³]¡M·N«ü¨C¤@­Ó«D¸ÓÃþªì©l³s½uªº«Ê¥]¡C




\paragraph{UDP ©µ¦ù}

¦pªG `-p udp' ³Q«ü©wªº¸Ü¡M³o¨Ç©µ¦ù´N·|¦Û°Ê¸ü¤J¡C¥¦´£¨Ñ¤F `--source-port'¡N `--sport'¡N`--destination-port'¡N¥H¤Î `--dport' ³o¨Ç¿ï¶µ¡M¤@¦p«e­zªº TCP ³]©w¡C




\paragraph{ICMP ©µ¦ù}

¦pªG `-p icmp' ³Q«ü©wªº¸Ü¡M³o­Ó©µ¦ù´N·|¦Û°Ê¸ü¤J¡C¥¦¥u´£¨Ñ¤@­Ó·sªº¿ï¶µ¡R



\begin{description}
\item[--icmp-type] \mbox{}

¨ä«á¥i¥H³Æ¿ï `!' ¡MµM«á¬O¤@­Ó icmp ¦WºÙÃþ«¬(¦p `host-unreachable' )¡M©Î¬O¤@­Ó¼Æ¦rÃþ«¬(¦p `3' )¡M©Î¬O¤@¹ï¥Î `/' ¤À¹jªº¼Æ¦rÃþ«¬©M½s½X(¦p `3/3' )¡C¨Ï¥Î `-p icmp --help' ´N¥i¥HÀò±o¤@¥÷¥i¥Î icmp Ãþ«¬¦WºÙ²M³æ¡C



\end{description}





\paragraph{¨ä¥¦¤ñ¹ïªº©µ¦ù}

¦b nerfilter ®M¥ó¤¤ªº¨ä¥¦©µ¦ù«h¬O®i¥Ü©Ê(demonstration)ªº©µ¦ù¤º®e¡M¥i¥H¥Î `-m' ¿ï¶µ¨Ó©I¥s(°²¦p¤w¦w¸Ë¤Fªº¸Ü)¡C

\begin{description}
\item[mac] \mbox{}

¦¹¤@¼Ò²Õ¥²¶·­n©ú½Tªº¥Î `-m mac' ©Î `--match mac' ¨Ó«ü©w¡C¥¦¥Î©ó¤ñ¹ï¶Ç¤J«Ê¥]ªº¨Ó·½ Ethernet (MAC) ¦a§}¡M¦]¦Ó¥u¹ï¨º¨Ç¬ï¶V PREROUTING ©M INPUT Ãìªº«Ê¥]°_§@¥Î¡C¥¦¥u´£¨Ñ¤@­Ó¿ï¶µ¡R

\begin{description}
\item[--mac-source] \mbox{}

¨ä«á¥i¥H³Æ¿ï `!' ¡MµM«á¬O¤@­Ó¥Î«_¸¹¤À¹jªº¤Q¤»¶i¨î ethernet ¦a§}¡M¦p  `--mac-source 00:60:08:91:CC:B7'¡C

\end{description}




\item[limit] \mbox{}

³o­Ó¼Ò²Õ¥²¶·©ú½Tªº¥Î `-m limit' ©Î `--match limit'¨Ó«ü©w¡C¥¦¥Î¨Ó­­¨î¤@­Ó¤ñ¹ïµ¥¯Å¡M½Ñ¦p§í¨î°O¿ý«H®§µ¥¡C¥¦¥u¯à¤ñ¹ï¤@­Ó¨C¬í¦¸¼Æ­È(¹w³]¬O¨C¤@­Ó¤p®É 3 ­Ó¤ñ¹ï¡M¦ñÀH 5 ­ÓÄ²µo(burst))¡C¥¦±µ¨ü¨â­Ó³Æ¿ï°Ñ¼Æ¡R

\begin{description}
\item[--limit] \mbox{}

«á±µ¤@­Ó¼Æ­È¡Q«ü©w¥i¤¹³\ªº¨C¬í³Ì¤j¥­§¡¤ñ¹ï¼Æ­È¡C¸Ó¼Æ­È¥i¥H¥Î `/second'¡N`/minute'¡N`/hour'¡N©Î  `/day'¡N©Î¨ä¤¤³¡¥÷ (¬G `5/second' ©M `5/s' ¬O¤@¼Ëªº)¡M¨Ó©ú½T«ü©w³æ¦ì(unit)¡M



\item[--limit-burst] \mbox{}

«á±µ¤@­Ó¼Æ­È¡M«ü¥Ü¥X¤Þ°_«e­z­­¨î¤§«eªº³Ì¤jÄ²µo¦¸¼Æ¡C

\end{description}


³o­Ó¤ñ¹ï±`¥Î©ó LOG ¥Ø¼Ð¡M¥H¶i¦æ¤ñ²v­­¨î(rate-limited) ¤§°O¿ý¡C¬°¤F§ó¦n¤F¸Ñ¥¦¬O¦p¦ó¤u§@ªº¡MÅý§Ú­Ì¬Ý¤@¬Ý¤U­±ªº³W«h¡M¬O¥H¹w³]­­¨î¤Þ¼Æ¨Ó°O¿ý«Ê¥]ªº¡R

\begin{tscreen}
\begin{verbatim}
# iptables -A FORWARD -m limit -j LOG
\end{verbatim}
\end{tscreen}


·í¦¹³W«h²Ä¤@¦¸¤Þ¥Îªº®É­Ô¡M«Ê¥]´N·|³Q°O¿ý¤U¨Ó¡Q¨Æ¹ê¤W¡M¥Ñ©ó¹w³]ªºÄ²µo¬° 5 ¡M¨º¬°­ºªº 5 ­Ó«Ê¥]´N·|°O¿ý¤U¨Ó¡CµM«á¡M¦A¹j 20 ¤ÀÄÁ¦¹³W«h¤~·|¦A°O¿ý«Ê¥]¡M¦Ó¤£ºÞ´Á¶¡¦³¦h¤Ö­Ó«Ê¥]©è¹F¡C¦Ó¥B¡M¨C 20 ¤ÀÄÁ¦pªG¨S¦³²Å¦Xªº«Ê¥]³q¹L¡M«h·|«ì´_ (regained) ¤@­ÓÄ²µo¼Æ­È¡Q°²¦p 100 ¤ÀÄÁ¤º¦AµL³o¼Ëªº«Ê¥]Ä²¤Î³o³W«hªº¸Ü¡M¨º»òÄ²µo¦¸¼Æ´N·|§¹¥þ´_­ì(recharged)¡Q¦^¨ì§Ú­Ì¶}©l®Éªºª¬ºA¡C



µù¡R±z¥Ø«e¤£¯à¥H¤j©ó 59 ¤p®Éªº´_­ì®É¶¡¨Ó«Ø¥ß¤@­Ó³W«h¡M¬G¦¹¡M°²¦p±z³]©w¤@­Ó¥­§¡²v¬°¨C¤Ñ¤@¦¸¡M¨º»ò¡M±zªºÄ²µo²v«h¤@©w­n¤Ö©ó 3 ¡C



±z¤]¥i¥H¥Î³o¼Ò²Õ¥hÁ×§K¥H§Ö³t¤ñ²v´£ª@ªA°È¦^À³ªºªýÂ_ªA°È§ðÀ»(DoS)¡C



Syn-flood protection¡R
\begin{tscreen}
\begin{verbatim}
# iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
\end{verbatim}
\end{tscreen}


Furtive port scanner¡R
\begin{tscreen}
\begin{verbatim}
# iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
\end{verbatim}
\end{tscreen}


Ping of death¡R
\begin{tscreen}
\begin{verbatim}
# iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
\end{verbatim}
\end{tscreen}


¦¹¼Ò²Õªº¤u§@­ì²z¦³ÂI¹³¡§ºI¬y»Ö¡¨¤@¼Ë¡M½Ð°Ñ¦Ò¤U­±ªº¹Ï¥Ü¡C

\begin{tscreen}
\begin{verbatim}
       rate (pkt/s)  
             ^        .---.
             |       / DoS \
             |      /       \
Edge of DoS -|.....:.........\.......................
 = (limit *  |    /:          \
limit-burst) |   / :           \         .-.
             |  /  :            \       /   \
             | /   :             \     /     \
End of DoS  -|/....:..............:.../.......\..../.
 = limit     |     :              :`-'         `--'
-------------+-----+--------------+------------------> time (s)
   LOGIC =>  Match | Didn't Match |    Match
\end{verbatim}
\end{tscreen}


¤ñ¤è»¡¡M§Ú­Ì¥H 5 ­Ó«Ê¥]Ä²µo¨Ó¤ñ¹ï¨C¬í¤@­Ó«Ê¥]¡M¦ý«Ê¥]±q¨C¬í¥|­Ó¶}©l¶Ç¤J¡M«ùÄò¤T¬í¡MµM«áµ¥¤T¬í¦A­«·s¶}©l¡C
\begin{tscreen}
\begin{verbatim}


        <--Flood 1-->           <---Flood 2--->

Total  ^                   Line  __--      YNNN
Packets|               Rate  __--      YNNN
       |            mum  __--      YNNN
    10 |        Maxi __--         Y
       |         __--            Y
       |     __--               Y
       | __--    YNNN           
       |-    YNNN
     5 |    Y    
       |   Y                                Key:  Y -> Matched Rule
       |  Y                                       N -> Didn't Match Rule
       | Y
       |Y 
     0 +-------------------------------------------------->  Time (seconds)
        0   1   2   3   4   5   6   7   8   9  10  11  12
\end{verbatim}
\end{tscreen}


±z·|µo²{ÀY¤­­Ó«Ê¥]³Q¤¹³\¶W¹L¨C¬í¤@­Ó«Ê¥]¡MµM«á´N¤Þ°_­­¨î¤F¡M¦pªG¦³¤@­Ó°±·²¡M¨ä¥¦ªºÄ²µo¤]±N³Q¤¹³\¡M¦ý´N¤£¯à³q¹L³W«h³]©wªº³Ì°ª¤ñ²v(¦b¸ÓÄ²µo¨Ï¥Î«á¬°¨C¬í¤@­Ó«Ê¥])¡C



\item[owner] \mbox{}

¦¹¼Ò²Õ¬°¥»¾÷²£¥Íªº«Ê¥]¤ñ¹ï¤£¦P¯S©ºªº«Ê¥]«Ø¥ßªÌ(creator)¡C¥¦¶È¹ï OUTPUT Ãì¦³¥Î¡M¦Ó¥B¡M¬Æ¦Ü¬Y¨Ç«Ê¥](¦p ICMP ping responses)©Î³\¨S¦³ owner¡M±N³Qµø¬°¤£²Å¦X®@¡C

\begin{description}
\item[--uid-owner userid] \mbox{}

¦pªG«Ê¥]¥Ñ¤@­Ó¦æµ{¥H¦³®Ä(¼Æ¦r¦¡) user id «Ø¥ßªº¡M«h¬°²Å¦X¡C

\item[--uid-owner groupid] \mbox{}

¦pªG«Ê¥]¥Ñ¤@­Ó¦æµ{¥H¦³®Ä(¼Æ¦r¦¡) group id «Ø¥ßªº¡M«h¬°²Å¦X¡C

\item[--pid-owner processid] \mbox{}

¦pªG«Ê¥]¥Ñ¤@­Ó¦æµ{¥H process id «Ø¥ßªº¡M«h¬°²Å¦X¡C

\item[--sid-owner processid] \mbox{}

¦pªG«Ê¥]¥Ñ¤@­Ó¦æµ{¥H session group «Ø¥ßªº¡M«h¬°²Å¦X¡C

\end{description}




\item[unclean] \mbox{}

¦¹¤@¹êÅç©Ê¼Ò²Õ¥²¶·¥H `-m unclean' ©Î `--match unclean' ¨Ó©ú½T«ü©w¡C¥¦·|¹ï«Ê¥]¶i¦æ¤£¦PªºÀH¾÷§PÂ_ÀË´ú¡C³o¼Ò²Õ©|¥¼³Q½]¬d¹L¡M©Ò¥H¤£À³¸Ó¥Î©ó¦w¥þ³]³Æ¤W(¥¦©Î³\·|§â¨Æ±¡·d¯{¡M¦]¬°¥¦¥»¨­©Î³\¦³¯ä¦äªº)¡C¥¦¨Ã¨S´£¨Ñ¿ï¶µ³]©w¡C

\end{description}





\paragraph{The State Match}

³Ì¦³¥Îªº¤ñ¹ï§PÂ_¼Ð·Ç¥Ñ `state' ©µ¦ù©Ò´£¨Ñ¡M¥H¸àÄÀ `ip\_conntrack' ¼Ò²Õªº³s½u°lÂÜ¤ÀªR¡C³o¬O«D±`­È±o¹ªÀy¨Ï¥Îªº¡C



«ü©w  `-m state' «h¤¹³\¥t¤@­ÓÃB¥~ªº `--state' ¿ï¶µ¡M¥i¥H¬°¤@­Ó¨§ÂI¤À¹jªº¤ñ¹ï³¯­z¦Cªí(  `!'  ºX¼Ð«ü¥Ü {\bfseries ¤£(not)} ²Å¦X¨º¨Ç³¯­z)¡C³o¨Ç³¯­z¬O¡R

\begin{description}
\item[NEW] \mbox{}

¤@­Ó«Ø¥ß·s³s½uªº«Ê¥]¡C



\item[ESTABLISHED] \mbox{}

¤@­ÓÄÝ©ó²{¦³³s½u(¦p¡R¤w¸g¦^À³«Ê¥]¤F)¤§«Ê¥]¡C



\item[RELATED] \mbox{}

¤@­Ó»P²{¦³³s½u¬ÛÃö¡M¦ý«o¨Ã¤£­­©ó¨ä¤¤³¡¥÷ªº«Ê¥]¡M½Ñ¦p ICMP ¿ù»~¡M©Î¬O«Ø¥ß FTP ¼Æ¾Ú³s½uªº«Ê¥](FTP ¼Ò²Õ¤w´¡¤J)¡C



\item[INVALID] \mbox{}

¤@­Ó¦]¬Y¨Ç­ì¦]¤£¯à³QÅ³§Oªº«Ê¥]¡R³o¥]¬A°O¾ÐÅé¤£¨¬©M¤£¯à¦^À³¥ô¦ó¤wª¾³s½uªº ICMP ¿ù»~¡C³q±`¡M³o¼Ëªº«Ê¥]³£·|³Q¥á±ó±¼¡C

\end{description}





\subsection{¥Ø¼Ð(Target)³W®æ}

²{¦b¡M§Ú­Ìª¾¹D¥i¥H¹ï«Ê¥]°µ¤°»ò¼ËªºÀË¬d¤F¡M§Ú­ÌÁÙ»Ý­n¤@­Ó¤èªk¨Ó»¡¥X¹ï¤@­Ó²Å¦X§Ú­Ì´ú¸Õªº«Ê¥]­n°µ¤°»ò¼Ë°Ê§@¡C³o´N¬O©Ò¿×ªº¤@±ø³W«h¤§{\bfseries ¥Ø¼Ð(target)} °Õ¡C



¦³¨â­Ó«D±`¬ÛÃþªº¤º«Ø¥Ø¼Ð¡RDROP ©M ACCEPT¡M§Ú­Ì¤w¸g±µÄ²¹L¤F¡C¦pªG¤@±ø³W«h²Å¦X¤@­Ó«Ê¥]¡M¦P®É¥Ø¼Ð¬O¨ä¤¤¤§¤@¡M¨º»ò´N¦A¨S¦³³W«h»Ý­n«t¸ß¡R«Ê¥]ªº©R¹B¤w¸g©w¤U¨Ó¤F¡C



°£¤F¤º«Ø¥~¡M¤]¦³¨âºØÃþ«¬ªº¥Ø¼Ð¡R©µ¦ù©M¥Î¤á¦Û©wÃì¡C




\subsubsection{¥Î¤á¦Û©wÃì}

{\ttfamily iptables} ©ÓÅ§¤F {\ttfamily ipchains} ¤@­Ó«D±`¼F®`ªº¥\¯à¡M´N¬OÅý¨Ï¥ÎªÌ¥i¥H³Ð«Ø¥X·sÃì¡Mªþ¥[©ó¤T­Ó¤º«ØÃì(INPUT¡NFORWARD¡N©M OUTPUT)¤§¥~¡C«öºD¨Ò¡M¥Î¤á¦Û©wÃì¥Î¤p¼g¥H¥Ü°Ï§O(«Ý·|§Ú­Ì·|¦b«á­±ªº \ref{chain-ops} {(¦b¾ãÃì¤W¹B§@(Operations on an Entire Chain))} ¨º¸Ì¸ÑÄÀ¦p¦ó¥h«Ø¥ß·sªº¥Î¤á¦Û©w³s)



·í¤@­Ó«Ê¥]²Å¦X¤@±ø¥Ø¼Ð¬°¥Î¤á¦Û©wÃì¤§³W«h®É¡M«Ê¥]´N·|¶}©l¬ï¶V¥Î¤á¦Û©wÃì¤¤ªº³W«h¡C°²¦p¸ÓÃì¥¼¯à¨M©w¥X«Ê¥]ªº©R¹B¡M«h¤@¥¹µ²§ô¬ï¶V¸ÓÃì«á¡M´N·|±µµÛ·í«eÃì¤¤ªº¤U¤@­Ó³W«hÄ~Äò¬ï¶V¤U¥h¡C



Ä~Äòª±ª± ASCII ÃÀ³N¦n¤F¡C°²³]¦³³o»ò¨â±ø(©Ç)Ãì¡R{\ttfamily INPUT} (¤º«ØÃì)¡M ©M {\ttfamily test} (¥Î¤á¦Û©wÃì)¡C

\begin{tscreen}
\begin{verbatim}
         `INPUT'                         `test'
        ----------------------------    ----------------------------
        | Rule1: -p ICMP -j DROP   |    | Rule1: -s 192.168.1.1    |
        |--------------------------|    |--------------------------|
        | Rule2: -p TCP -j test    |    | Rule2: -d 192.168.1.1    |
        |--------------------------|    ----------------------------
        | Rule3: -p UDP -j DROP    |
        ----------------------------
\end{verbatim}
\end{tscreen}




°²³]¤@­Ó¨Ó¦Û192.168.1.1 ªº TCP «Ê¥]¡M­n¨ì 1.2.3.4 ¨º¸Ì¥h¡C¥¦¶i¤J{\ttfamily INPUT} Ãì¡M¨Ã¨ü¨ì Rule1 ªº´ú¸Õ - ¦ý¤£²Å¦X¡C¦ý¬O²Å¦X Rule2 ¡M¥B¥¦ªº¥Ø¼Ð¬O {\ttfamily test}¡M©Ò¥H¤U¤@­Ó­nÀËÅçªº³W«h±N±q {\ttfamily test} ¶}©l¡C¦b {\ttfamily test} ¤¤ªº Rule1 ²Å¦X¡M¦ý¨Ã¨S¦³«ü©w¥Ø¼Ð¡M©Ò¥H¦AÀËÅç¤U¤@±ø³W«h¡M¤]´N¬O Rule2 ¡C¤£¹L¥¦¨Ã¤£²Å¦X¡M©Ò¥H§Ú­Ì¤w¸g©è¹F³o±øÃìªº¥½ºÝ¤F¡CµM«á§Ú­Ì¦^¨ì {\ttfamily INPUT} Ãì¤¤¡M¤]´N¬O§Ú­Ì­è¤~ÀËÅç Rule2 ¨º¸Ì¡M©Ò¥H§Ú­Ì²{¦b´N­nÀË¬d Rule3¡M¨ÌµM¤£²Å¦X¡C



³o¼Ë¡M¸Ó«Ê¥]ªº¸ô®|¬O³o¼Ë¤lªº¡R
\begin{tscreen}
\begin{verbatim}
                                v    __________________________
         `INPUT'                |   /    `test'                v
        ------------------------|--/    -----------------------|----
        | Rule1                 | /|    | Rule1                |   |
        |-----------------------|/-|    |----------------------|---|
        | Rule2                 /  |    | Rule2                |   |
        |--------------------------|    -----------------------v----
        | Rule3                 /--+___________________________/
        ------------------------|---
                                v
\end{verbatim}
\end{tscreen}




¥Î¤á¦Û©wÃì¤]¥i¥H¦A¸õ¨ì¥t¤@­Ó¥Î¤á¦Û©wÃì¥h(¦ý¤£­n°µ¦¨°j°é¡R±zªº«Ê¥]¦pªG³Qµo²{³B©ó°j°é¤¤´N·|³Q¥á±ó)¡C




\subsubsection{iptables ¤§©µ¦ù¡R·s¥Ø¼Ð}

¥t¤@Ãþ«¬ªº¥Ø¼Ð¬O¤@­Ó©µ¦ù¡C¤@­Ó¥Ø¼Ðªº©µ¦ù¥Ñ®Ö¤ß¼Ò²Õ©M¥i¿ïªº {\ttfamily iptables} ©µ¦ù²Õ¦¨¡M¥H´£¨Ñ·sªº©R¥O¦æ¿ï¶µ¡C¦b¹w³]ªº netfilter ´²¼½ª©¥»¤¤¦³¦n´X­Ó©µ¦ù¡R

\begin{description}
\item[LOG] \mbox{}

¦¹¼Ò²Õ´£¨Ñ®Ö¤ß°O¿ý²Å¦Xªº«Ê¥]¡C¥¦´£¨Ñ³o¨ÇÃB¥~¿ï¶µ¡R
\begin{description}
\item[--log-level] \mbox{}

«á±µ¤@­Ó¼h¦¸(level)¸¹½X©Î¦WºÙ¡C¦Xªkªº¦WºÙ¦³(¤j¤p¼g¦³§O)¡R`debug'¡N`info'¡N`notice'¡N`warning'¡N`err'¡N`crit'¡N`alert'¡N¥H¤Î `emerg'¡M¬Û¹ïªº¸¹½X¥Ñ 7 ¨ì 0 ¡C¦U¼h¦¸¸¹½Xªº¸ÑÄÀ½Ð°Ñ¦Ò syslog.conf ªº man page¡C



\item[--log-prefix] \mbox{}

«á±µ¤@­Ó³Ì¦h 30 ­Ó¦r¥Àªº¦r¦ê¡C¦¹¤@«H®§¥Ñ°O¿ý«H®§¶}©l®É°e¥X¡M¥O¨ä¥i¥H­Ó§Oªº³QÅ³§O¥X¨Ó¡C

\end{description}


¦¹¼Ò²Õ±`¥Î©ó¤@­Ó­­¨î¥Ø¼Ð«á¡M©Ò¥H¡M±z¤£­nÄéÃz±zªº°O¿ýÀÉ®@¡C



\item[REJECT] \mbox{}

¦¹¼Ò²Õ°£¤F¦Vµo°eºÝ°e¥X¤@­Ó `port unreachable' ³o¼Ëªº ICMP ¿ù»~¥~¡M©M `DROP' ¬O¤@¼Ëªº¡Cµù¡R¦b¤U¦C±ø¥ó¤¤¡MICMP ¿ù»~«H®§±N¤£·|°e¥X(½Ð°Ñ¦Ò RFC 1122)¡R

\begin{itemize}
\item  ³Q¹LÂoªº«Ê¥]¤@¶}©l´N¬O¤@­Ó ICMP ¿ù»~«H®§¡M©Î¬O¨ä¥¦¤£©úªº ICMP Ãþ«¬¡C
\item  ³Q¹LÂoªº«Ê¥]¬°¤@­ÓµLÀY (non-head) ¸H¤ù¡C
\item  §Ú­Ì¥Ø«e¤w¸g°e¥X¤Ó¦h¦Ü¸Ó¥Øªº¦aªº ICMP ¿ù»~«H®§¤F¡C
\end{itemize}


REJECT ¥t¥~ÁÙ±µ¨ü¤@­Ó `--reject-with' ¿ï¶µ¨Ó§ó§ï¨ä¦^À³«Ê¥]¡R½Ð°Ñ¦Ò»¡©ú¤å¥ó¡C

\end{description}





\subsubsection{¯S®íªº¤º«Ø¥Ø¼Ð}

¦³¨âºØ¯S®íªº¤º«Ø¥Ø¼Ð¡R{\ttfamily RETURN} ©M {\ttfamily QUEUE}¡C



{\ttfamily RETURN} ©M±¼¨ì¤@­ÓÃìªº¥½ºÝ¦³¬Û¦Pªº®ÄªG¡R¹ï¤@±ø¤º«ØÃìªº³W«h¦Ó¨¥¡M«h±Ò¥Î¸ÓÃìªº­ì«h¡C¹ï¤@±ø¥Î¤á¦Û©w³W«h¦Ó¨¥¡M«h·|¦^¨ì«e¤@­ÓÃì¤¤Ä~Äò¬ï¶V¡M´N±µ¦b¸õ¨ì³o­ÓÃìªº¨º±ø³W«h¤§«á¡C



{\ttfamily QUEUE} ¤]¬O¤@­Ó¯S®í¥Ø¼Ð¡M¥i¥H´À¨Ï¥ÎªÌªÅ¶¡(userspace)¦æµ{Àx¦C«Ê¥]¡C­n¹B¥Î¥¦¡M¨â­Ó¥\¯à²Õ¥ó¬O¥²»Ýªº¡R

\begin{itemize}
\item ¨ä¤@¬° "queue handler"¡M³B²z¨Ï¥ÎªÌªÅ¶¡»P®Ö¤ß¤§¶¡¶Ç°e«Ê¥]ªº¹ê½è¾÷¨î¡Q
\item ¥t¤@­Ó¬°¤@¨Ï¥ÎªÌªÅ¶¡ªºÀ³¥Îµ{¦¡¡M¥h±µ¦¬¡M©Î»¡¾Þ±±¡M¥H¤Î¹ï«Ê¥]°µ¥Xµô¨M¡C
\end{itemize}

IPv4 iptables ªº¼Ð·Ç queue handler ¬° ip\_queue ¼Ò²Õ¡M¥¦¥Ø«e¬O¥H¹êÅç©Ê½è»P®Ö¤ß¤@°_µo§Gªº¡C

¦p¤U¬O¤@­Ó¦p¦ó¥Î iptables ¬°¨Ï¥ÎªÌªÅ¶¡¦æµ{¶i¦æÀx¦C«Ê¥]ªºÂ²³æ¨Ò¤l¡R
\begin{tscreen}
\begin{verbatim}
# modprobe iptable_filter
# modprobe ip_queue
# iptables -A OUTPUT -p icmp -j QUEUE
\end{verbatim}
\end{tscreen}

¥Î¦¹³W«h¡M¥»¾÷²£¥Íªº¹ï¥~ ICMP «Ê¥](¦p¥Î ping «Ø¥ß) ´N·|³Q°e¦Ü ip\_queue ¼Ò²Õ¥h¡MµM«á¹Á¸Õ±N«Ê¥]¶Çµ¹¨Ï¥ÎªÌªÅ¶¡À³¥Îµ{¦¡¡C¦pªG¨S¦³¨Ï¥ÎªÌªÅ¶¡À³¥Îµ{¦¡¦bµ¥«Ýªº¸Ü¡M¸Ó«Ê¥]´N·|³Q¥á±ó¡C



­n¼g¤@­Ó¨Ï¥ÎªÌªÅ¶¡À³¥Îµ{¦¡¡M»Ý¨Ï¥Î libipq API ¡C¥¦¤]¬O©M iptables ¤@°_µo§Gªº¡Cµ{¦¡½X½d¨Ò¥i¥H¦b CVS ¤¤ªº testsuite ¤u¨ã(¦p redirect.c) §ä¨ì¡C



ip\_queue ªºª¬ºA¥i¥H¥Î¦p¤U¤èªk¨ÓÀË¬d¡R
\begin{tscreen}
\begin{verbatim}
/proc/net/ip_queue
\end{verbatim}
\end{tscreen}

Àx¦Cªº³Ì¤jªø«×(¦p¶Ç»¼µ¹¨Ï¥ÎªÌªÅ¶¡¥BµL»Ý°e¦^µô¨M«Ê¥]¤§¼Æ¶q)¥i¥H³q¹L³o¼Ëªº¤è¦¡¨Ó±±¨î¡R
\begin{tscreen}
\begin{verbatim}
/proc/sys/net/ipv4/ip_queue_maxlen
\end{verbatim}
\end{tscreen}

³Ì¤jÀx¦Cªø«×ªº¹w³]­È¬° 1024¡C¤@¥¹¹F¨ì¦¹­­¨î¡M·sªº«Ê¥]´N·|³Q¥á±ó¡Mª½¨ìÀx¦Cªø«×¶^¦^§C©ó­­¨î¤§¼Æ¬°¤î¡C¦nªº¨ó©w¡M¦p TCP¡M·|±N¥á±óªº«Ê¥]¸ÑÄÀ¬°¾ÖÀ½(congestion)¡M¦P®É²z·Q¦a¡M·íÀx¦C¶ñ°_¨Ó«á·|±N¤§¾×¦^¥h¡CµM¦Ó¡M¦pªG¹w³]­È¦b©ÒÁ|±¡§Î¤UÄ±±o¤Ó¤pªº¸Ü¡M©Î³\»Ý­n¤@¨Ç¹êÅç¨Ó¨M©w¨ä²z·Qªº³Ì°ªÀx¦Cªø«×¡C




\subsection{¦b¾ãÃì¤W¹B§@\label{chain-ops}}

{\ttfamily iptables} ªº¤@­Ó«D±`¦³¥Îªº¥\¯à¬O¡M¥¦¯à°÷²Õ¦X(group)¬ÛÃöªº³W«h©óÃì¤¤¡C¥u­n±z³ßÅw¡M±z¥i¥HÀH«K¬°Ãì°_¤@­Ó¦W¦r¡M¦ý§Ú«ØÄ³±z¨Ï¥Î¤p¼g¦r¥À¥HÁ×§K©M¤º«ØÃì¤Î¥Ø¼Ð·d²V¤F¡CÃì¦W³Ìªø¥i¥H¥h¨ì 31 ­Ó¦r¥À¡C




\subsubsection{«Ø¥ß¤@­Ó·sÃì}

²{¦b´NÅý§Ú­Ì¤@°_«Ø¤@­Ó·sÃì§a¡C¦]¬°§Ú¹ê¦b¬O¤@­Ó·R¤Û·Qªº³Ã¥ë¡M©Ò¥H§ÚºÙ¤§¬°{\ttfamily test} («¢¡M¦³ÂI¿Ø¨ë)¡C³o¸Ì¡M§Ú­Ì¥Î `-N' ©Î `--new-chain' ¿ï¶µ¡R

\begin{tscreen}
\begin{verbatim}
# iptables -N test
#
\end{verbatim}
\end{tscreen}




´N¬O³o»òÂ²³æ¡C¦n¤F¡M²{¦b±z¥i¥H±N¤@¨Ç³W«h¥[¤J¨ä¤¤¡M¤@¦p«e­±»¡ªº¨º¼Ë¡C




\subsubsection{§R°£¤@±øÃì}

­n§R°£¤@±øÃì¤]¬O¤@¼ËÂ²³æ¡M¥Î `-X' ©Î `--delete-chain' §Y¥i¡C¬°¤°»ò¥Î `-X' ©O¡S¶â¡M ¦n¥Îªº¦r¥À³£¤@¦­µ¹¥Î¥ú¤F°Õ¡C

\begin{tscreen}
\begin{verbatim}
# iptables -X test
#
\end{verbatim}
\end{tscreen}




­n§R°£¤@±øÃìªº¸Ü¡M·|¦³¦n¨Ç­­¨î¡R¥¦­Ì¥²»Ý¬OªÅªº (½Ð°Ñ¦Ò«á­±ªº \ref{flushing} {(²MªÅ¤@±øÃì(Flushing a Chain))} ) ¡M¦P®É¥¦­Ì¥²»Ý¤£¯à§@¬°¥ô¦ó³W«hªº¥Ø¼Ð¡C¥ô¦ó¤T±ø¤º«ØÃì±z³£¤£¯à§R°£´N¬O¤F¡C



°²¦p±z¤£«ü©w¤@±øÃì¡M¨º»ò¦pªG¥i¯àªº¸Ü¡M {\itshape ¥þ³¡\/} ¥Î¤á¦Û©wÂIÃì³£·|³Q§R°£¡C




\subsubsection{²MªÅ¤@±øÃì\label{flushing}}

¦³¤@­ÓÂ²³æªº¤èªk¥i¥H²MªÅ¤@±øÃì¤¤ªº©Ò¦³³W«h¡M´N¬O¨Ï¥Î `-F' (©Î `--flush') ©R¥O¡C

\begin{tscreen}
\begin{verbatim}
# iptables -F forward
#
\end{verbatim}
\end{tscreen}




¦pªG±z¤£«ü©w¬O­þ¤@±øÃì¡M¨º»ò {\itshape ¥þ³¡\/} Ãì³£·|³Q²MªÅ¡C




\subsubsection{¦C¥Ü¤@±øÃì}

±z¥i¥H¨Ï¥Î `-L' (©Î `--list') ©R¥O¦C¥Ü¤@±øÃì¤¤ªº©Ò¦³³W«h¡C



¨C¤@­Ó¥Î¤á¦Û©wÃì©Ò¦Cªº `refcnt' ¡M¬O»¡¦³¦h¤Ö¼Æ¥Øªº³W«h¬O¥H¸ÓÃì¬°¥Ø¼Ðªº¡C¦b¸ÓÃì³Q§R°£¤§«e¡M³o¼Æ¥Ø¥²»Ý¬°¹s(¦P®ÉÃì¬OªÅªº)¡C



¦pªG¨S´£¨ÑÃì¦WºÙªº¸Ü¡M©Ò¦³Ãì³£·|³Q¦C¥Ü¥X¨Ó¡M´NºâªÅÃì¤]¤@¼Ë¡C



¦³¤T­Ó¿ï¶µ¥i¥H¦ñÀH  `-L' ¤@°_¨Ï¥Îªº¡C­º¥ý¬O `-n' (numeric) ¿ï¶µ¡M¥¦«Ü¦³¥Î¡M¦]¬°¥¦¥i¥HÁ×§K {\ttfamily iptables} ¥h¹Á¸Õ¬d§ä IP ¦a§}¡M°²¦p±zªº DNS ¨S¦³³]©w¥¿½Tªº¸Ü¡M©Î¬O±z¤w¸g¹LÂo±¼ DNS ½Ð¨D¤F¡M³o©Î³\·|³y¦¨ÄY­«ªº©µ¿ð(°²³]±z©M¤j¦h¼Æ¤H¤@¼Ë³£¬O¨Ï¥Î DNS )¡C¥¦¦P®É¤]·|±N TCP »P UDP °ð¤fÅã¥Ü¬°¼Æ¦r¦Ó«D¦WºÙ¡C



²Ä¤G­Ó¬O `-v' ¿ï¶µ¡M¥¦·|Åã¥Ü¥X±z¥þ³¡³W«hªº²Ó¸`¡M½Ñ¦p«Ê¥]ªº byte ¬y¶q²Î­p¡NTOS ¤ñ¸û¡N¥H¤Î¬É­±µ¥¡C§_«h³o¨Ç¼Æ­È¬O³Q²¤±¼ªº¡C



µù¡R«Ê¥]ªº byte ¬y¶q²Î­p¥i¥H¤À§O¨Ï¥Î `K', `M' ©Î `G' ³o¨Ç¦r§À¡M¤À§O¥Nªí 1000¡N1,000,000¡N¥H¤Î1,000,000,000¡M¨ÓÅã¥Ü¡C¨Ï¥Î `-x' (expand numbers) ºX¼Ð¦P¼Ë¤]¥i¥HÅã¥Ü¥X§¹¾ãªº¼Æ¦r¡M®Ú¥»¤£²z·|¥¦­Ì¦³¦hªø¡C




\subsubsection{­«³](Âk¹s)¬y¶q°O¼Æ¾¹(counter)}

¯à°÷­«³]¬y¶q°O¼Æ¾¹·íµM¬O¦³¥Îªº¡C±z¥i¥H¥Î  `-Z' (©Î `--zero') ¿ï¶µ¨Ó°µ¡C



°ß¤@³Â·Ð¬O¡M¦³®É­Ô¦b¶i¦æ­«³]¤§«e¡M±z¥²»Ý¥ß§Y°O¦í¬y¶q²Î­p­È¡C¦b«e­±ªº¨Ò¤l¤¤¡M·í±z¤U `-L' µM«á `-Z' ©R¥O¡M¬Y¨Ç«Ê¥]¥i¯à·|¦b³o´Á¶¡³q¹L¡C¦]¦¹¡M±z¥i¥H§â `-L' ©M `-Z' {\itshape ¤@°_\/} ¨Ï¥Î¡M¦bÅª¨úªº¦P®É¶i¦æ°O¼Æ¾¹­«³]¡C






\subsubsection{³]©w­ì«h(policy)\label{policy}}

§Ú­Ì¦b«e­±±´°Q«Ê¥]¦p¦ó³q¹L¤@­ÓÃìªº®É­Ô¡M¤w¸àÄÀ¹L·í«Ê¥]©è¹F¤º«ØÃì¥½ºÝ®É±N·|µo¥Í¤°»ò¨Æ±¡¡C¦¹®É¡M´N¥Ñ¸ÓÃìªº{\bfseries ­ì«h}¨Ó¨M©w«Ê¥]ªº©R¹B¡C¥u¦³¤º«ØÃì({\ttfamily INPUT}¡N{\ttfamily OUTPUT}¡N¥H¤Î {\ttfamily FORWARD}) ¤~¦³­ì«h³]©w¡M¦]¬°¡M¦pªG¤@­Ó«Ê¥]±¼¦Ü¤@­Ó¥Î¤á¦Û©wÃìªº®É­Ô¡M«h·|¦^¨ì¤W¤@­ÓÃì¤¤Ä~Äò¬ï¶V¡C



­ì«h¥i¥H¬° {\ttfamily ACCEPT} ©Î {\ttfamily DROP}¡C




\section{¨Ï¥Î ipchains »P ipfwadm\label{oldstyle}}

 ¦b netfilter ®M¥ó¤¤¡M¦³¨â­Ó¼Ò²Õ¤À§O¥s°µ ipchains.o ©M ipfwadm.o¡C±z¥u­n±N¨ä¤¤¤@­Ó´¡¤J¶i®Ö¤ß¸Ì­±( µù¡R¥¦­Ì©M iptables.o¡Nip\_conntrack.o ¤Î ip\_nat.o ¬O¤£­Ý®eªº¡T)¡CµM«á±z´N¥i¥H¦p©¹±`¤@¯ë¨Ï¥Î ipchains ©Î ipfwadm ¤F¡C



 ³o¦b¤@©w®É´Á¤º³o¤´·|³Q¤ä«ùªº¡C§Ú»{¬°¦X²zªº­pºâ¤½¦¡¬O¡R2 * {[} ´À¥N²£«~µo§G - ªì©lÃ­©wµo¦æ ] ¡M¦A¥[¤W´À¥N²£«~¥i¥H¯u¥¿Ã­©wµo¦æªº¤é¤l¡C



´«¦Ó¨¥¤§¡M¹ï ipfwadm ªº³Ì«á¤ä«ù±N·|©µ¦Ü¡R

\begin{tscreen}
\begin{verbatim}
2 * [October 1997 (2.1.102 release) - March 1995 (ipfwadm 1.0)]
        + January 1999 (2.2.0 release)
    = November 2003.
\end{verbatim}
\end{tscreen}




 ¦Ó¹ï ipchains ªº³Ì«á¤ä«ù«h¬°¡R

\begin{tscreen}
\begin{verbatim}
2 * [August 1999 (2.3.15 release) - October 1997 (2.2.0 release)]
        + July 2000 (2.4.0 release?)
    = March 2004.
\end{verbatim}
\end{tscreen}


©Ò¥H¡M¦b 2004 ¦~¤§«e³£¥i¥H°ªªEµLïÊ°Õ¡C




\section{¾ã¦X NAT »P Packet Filtering}

­n°µ Network Address Translation (½Ð°Ñ¾\ NAT HOWTO) ¥H¤Î«Ê¥]¹LÂo¡M¤w¬O«Ü¥­±`¤§¨Æ¤F¡C¦n®ø®§¬O¡M±N¥¦­Ì²V¦X°_¨Ó¨Ï¥Î¹ê¬O§¹¥þ¨S°ÝÃDªº¡C



·í§A³]­p«Ê¥]¹LÂoªº®É­Ô¡M¥i¥H§¹¥þ¤£¥Î²z·|±z­n°µ«ç¼Ëªº NAT ¡C©ó«Ê¥]¹LÂo¤¤¬Ý¨ìªº¨Ó·½»P¥Øªº¦a¡M¥u·|¬O `¯u¥¿ªº' ¨Ó·½©M¥Øªº¦a¡CÁ|¨Ò¨Ó»¡¡M¦pªG±z°µ NAT ¡M­n±N©Ò¦³³s¨ì 1.2.3.4 port 80 ªº³s½u°e¨ì 10.1.1.1 port 8080 ¥h¡M³o¼Ë«Ê¥]¹LÂo·|¬Ý¨º¨Ç°e¨ì 10.1.1.1 port 8080 (¯u¥¿ªº¥Øªº¦a)¡M¦Ó¤£¬O 1.2.3.4 port 80¡CÃþ¦üªº¡M±z¤]¥i¥H©¿²¤«Ê¥]°°¸Ë¡R«Ê¥]·|¬Ý°_¨Ó¬O¨Ó¦Û¯u¥¿ªº¤º³¡ IP ¦a§}(¤ñ¤è 10.1.1.1)¡M¦^À³¤]¬Ý°_¨Ó°e¦^¨º¸Ì¡C



±z¥i¥H¹B¥Î `state' ¤ñ¹ï©µ¦ù(match extension)¦ÓµL»ÝÅý«Ê¥]¹LÂo°µÃB¥~ªº¤u§@¡M¦]¬°µL½×¦p¦ó¡M NAT ³£·|­n¨D³s½u°lÂÜ¡C¬°¤F¼W±j¦b NAT HOWTO ¸Ì­±¨º­ÓÂ²³æªº«Ê¥]°°¸Ë¨Ò¤l¡M¥h¾×±¼¨Ó¦Û ppp0 ¬É­±ªº¥ô¦ó·s³s±µ¡M±z¥i¥H³o¼Ë°µ¡R

\begin{tscreen}
\begin{verbatim}
# Masquerade out ppp0
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# Disallow NEW and INVALID incoming or forwarded packets from ppp0.
iptables -A INPUT -i ppp0 -m state --state NEW,INVALID -j DROP
iptables -A FORWARD -i ppp0 0 -m state --state NEW,INVALID -j DROP

# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
\end{verbatim}
\end{tscreen}





\section{iptables »P ipchains ªº®t²§\label{Appendix-A}}

\begin{itemize}
\item  ­º¥ý¡M¤º«ØÃì¦WºÙ±q¤p¼gÁÙ´«¦¨¤j¼g¡M¦]¬° INPUT »P OUTPUT Ãì¥Ø«e¥u·|§ì¥Ø¼Ð¬°¥»¾÷¥H¤Î±q¥»¾÷²£¥Íªº«Ê¥]¡C¥¦­Ì¤À§O¥Î¨Ó¬d¬Ý¶Ç¤J»P¶Ç¥Xªº«Ê¥]¡C
\item  ²{¦b¦³¤@­Ó `-i' ºX¼Ð¨Ó¥Nªí¶Ç¤J¬É­±¡M¨Ã¥B¥u¤u§@©ó INPUT ©M FORWARD Ãì¤¤¡C¦b FORWARD »P OUTPUT Ãì¤¤´N­n±N `-i' §ï¦¨ `-o' ¤F¡C
\item  TCP »P UDP °ð¤f²{¦b³£­n¥Î --source-port ©Î --sport ¿ï¶µ¨Ó«÷¼g¥X¨Ó(©Î¬O±¼¹L¨Ó¼g --destination-port ©Î --dport)¡M¦P®É¡M¥²»Ý¸m©ó `-p tcp' ©Î `-p udp' ¿ï¶µ¤§«á¡M¦]¬° TCP ©Î UDP ©µ¦ù¬O¤À¶}¸ü¤Jªº¡C
\item  ¥H«e TCP ¨º­Ó -y ²{¦bÅÜ¦¨ --syn¡M¨Ã¥B¥²»Ý¸m©ó `-p tcp' ¤§«á¡C
\item  ­ì¨Óªº DENY ¥Ø¼Ð²{¦b²×©óÅÜ¦¨ DROP ¤F¡C
\item  ¦b¦C¥Ü¨ä¤u§@ªº¦P®É¥i¥H±N¸ÓÃìÂk¹s(zeroing)¡C
\item  Âk¹s¤º«ØÃì¤]¥i¥H²M±¼­ì«h°O¼Æ¾¹(policy counters)¡C
\item  ¦C¥ÜÃì¥i¥HÅý±z§â°O¼Æ¾¹ÅÜ¦¨·L¤p§Ö·Ó(atomic snapshot)¡C
\item  REJECT »P LOG ²{¦bÅÜ¦¨©µ¦ù¥Ø¼Ð¤F¡M·N¨ýµÛ¥¦­Ì¤w¸g©M®Ö¤ß¼Ò²Õ¤À¶}¡C
\item  Ãì¦WºÙ³Ìªø¥i¹F 31 ­Ó¦r¥À¡C
\item  MASQ ²{¦bÅÜ¦¨ MASQUERADE¡M ¦Ó¥B¨Ï¥Î¤£¦Pªº»yªk¡CREDIRECT ¦b«O¯d¬Û¦P¦WºÙªº¦P®É¡M¤]¸g¾ú¤F»yªkªºÅÜ¾E¡C¦Ü©ó¦p¦ó³]©w¥¦­Ìªº¸Ô²Ó¸ê®Æ¡M½Ð°Ñ¾\ NAT-HOWTO¡C
\item  ¦Ó -o ¿ï¶µ«h¤£¦A¥Î¨Ó±N«Ê¥]¶Ç»¼µ¹¨Ï¥ÎªÌªÅ¶¡³]³Æ¤F(°Ñ¦Ò«e­±ªº -i )¡C²{¦b«h¥Î QUEUE ¥Ø¼Ð±N«Ê¥]°eµ¹¨Ï¥ÎªÌªÅ¶¡¡C
\item  ®@¡M§Ú¥i¯à¤w°O¤£±o¨º»ò¦h¤F¡C
\end{itemize}





\section{Ãö©ó³]­p«Ê¥]¹LÂoªº«ØÄ³}

¦b¹q¸£¦w¥þ¾Ô³õ¤W³Ì©ú´¼¤§Á|²ö¹L©ó¥ý¾×±¼¤@¤Á¡MµM«á¶}©ñ¥²»Ýªº¡C¦³¤@¥y¦Ü²z¦W¨¥¬O¡R`«D½Ð¤Å¶i'¡C§Ú«ØÄ³±z¨c°O©ó¤ß¡M°²¦p±z³Ìª`­«¦w¥þªº¸Ü¡C



¤£­n¶]¨º¨Ç±z¥Î¤£¨ìªºªA°È¡M¤£ºÞ±z¬O§_¥H¬°¤w¸g±N¤§¾×¤U¨Ó¤F¡C



¦pªG±z­n«Ø¥ß¤@­Ó«ü©w¦¡¨¾¤õÀð(dedicated firewall)¡M¶}©l¤£­n¶]¥ô¦óªF¦è¡M¦P®É¾×±¼©Ò¦³«Ê¥]¡MµM«á¼W¥[ªA°È¥H¤ÎÅý©Ò»Ýªº«Ê¥]³q¹L¡C



§Ú¯S§O±j½Õ¦w¥þ©Ê¡Rµ²¦X tcp-wrappers(¹ï©ó«Ê¥]¹LÂo¥»¨­ªº³s±µ)¡NªA°È¥N²z(¹ï©ó³q¹L«Ê¥]¹LÂoªº³s±µ)¡N¸ô¥ÑÅçÃÒ¡N¥H¤Î«Ê¥]¹LÂoµ¥¤â¬q¡C¸ô¥ÑÅçÃÒ¬O«ü¡M¨º¨Ç¨Ó¦Û¥¼¹w´Á¬É­±ªº«Ê¥]´N·|³Q¥á±ó¡RÁ|¨Ò»¡¡M¦pªG±zªº¤º³¡ºô¸ô¦³¤@¬q 10.1.1.0/24 ªº¦a§}¡M¦P®É¦³¤@­Ó¨Ó¦Û¸Ó¦a§}ªº«Ê¥]«o±q¥~³¡¬É­±¶i¤J¡M¨º¥¦´N·|³Q¥á±ó±¼¡C¥¦¥i¥H¬°¤@­Ó¬É­±(¦p ppp0) ³]°_¨Ó¡M¦p¡R

\begin{tscreen}
\begin{verbatim}
# echo 1 > /proc/sys/net/ipv4/conf/ppp0/rp_filter
#
\end{verbatim}
\end{tscreen}


©Î¬O¥þ³¡²{¦³¤Î±N¦³ªº¬É­±¡M¦p¡R

\begin{tscreen}
\begin{verbatim}
# for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
#     echo 1 > $f
# done
# 
\end{verbatim}
\end{tscreen}


Debian ¦b¥i¯à¤§¤U¹w³]´N·|¦p¦¹¤F¡C¦pªG±z¦³¤£¹ïºÙ¸ô¥Ñ(¨Ò¦p¡M±z¹w´Á«Ê¥]·|±q¨ä¥¦¤è¦V¶i¤J)¡M±zÀ³¸Ó¦b¨º¨Ç¬É­±¤WÃö³¬¦¹¤@¹LÂo¡C



³]©w¨¾¤õÀðªº®É­Ô¡M°²¦p¦³¬Y¨ÇªF¦è¤£¤u§@ªº¸Ü¡M°O¿ý¥\¯à´NÅã±o«Ü¦³¥Î¤F¡Q¦ý¦b¤@­Ó¹ê»Ú¹B§@ªº¨¾¤õÀð¤W¡M¥ô¦ó®É­Ô³£­n±N¥¦µ²¦X `limit' ¤ñ¹ï¨Ó¤@°_¨Ï¥Î¡M¥HÁ×§K¦³¤HÄéÃz±zªº°O¿ýÀÉ¡C

§Ú±j¯P«ØÄ³¹ï¦w¥þ¨t²Î°µ³s½u°lÂÜ¡R¥¦ÁöµM·|¤Þ­P¤@¨Ç­t¾á(¦]¬°©Ò¦³³s½u³£­n°lÂÜ)¡M¦ý¹ï©ó¶Qºô¸ôªº³s±µ±±¨î«o«Ü¦³¥Î¡C¦pªG±zªº®Ö¤ß¤£·|¦Û°Ê¸ü¤J¼Ò²Õªº¸Ü¡M±z©Î³\»Ý­n¸ü¤J`ip\_conntrack.o' ¼Ò²Õ¡C°²¦p±z­nºë½T°lÂÜ½ÆÂøªº¨ó©w¡M±zÁÙ»Ý­n¸ü¤J¦X¾Aªº helper ¼Ò²Õ(¦p¡M`ip\_conntrack\_ftp.o' )¡C

\begin{tscreen}
\begin{verbatim}
# iptables -N no-conns-from-ppp0
# iptables -A no-conns-from-ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A no-conns-from-ppp0 -m state --state NEW -i ! ppp0 -j ACCEPT
# iptables -A no-conns-from-ppp0 -i ppp0 -m limit -j LOG --log-prefix "Bad packet from ppp0:"
# iptables -A no-conns-from-ppp0 -i ! ppp0 -m limit -j LOG --log-prefix "Bad packet not from ppp0:"
# iptables -A no-conns-from-ppp0 -j DROP

# iptables -A INPUT -j no-conns-from-ppp0
# iptables -A FORWARD -j no-conns-from-ppp0
\end{verbatim}
\end{tscreen}




«Ø¸m¤@­Ó¨}¦nªº¨¾¤õÀð¤w¸g¶W¥X³o­Ó HOWTO ªº½d³ò¤F¡M¦ý§Úªº«ØÄ³¬O¡R `¤@¤Á±qÄY(always be minimalist)'¡C¹ï©ó¦b±z¾÷¾¹¤W¶i¦æ´ú¸Õ»P±´¯Áªº§ó¦h¸ê®Æ¡M´N­n°Ñ¦Ò Security HOWTO ¤F¡C



\end{document}
