Erweiterteten Filterregeln im commitedcfg.cfg Format
Aus ModemWiki
Auch hier zunächst die Regeln, wie sie
mit dem Webinterface erstellt
werden.
Telnet für Router
create ipf rule entry ruleid 2001 dir in act accept destaddr eq 192.168.200.4 srcaddr eq 192.168.200.1 transprot eq num 6 srcport eq num 23 seclevel high medium low create ipf rule entry ruleid 2002 dir out act accept srcaddr eq 192.168.200.1 destaddr eq 192.168.200.4 transprot eq num 6 destport eq num 23 seclevel high medium low
Alle TCP und UDP Ports am Router schließen
create ipf rule entry ruleid 2003 dir in destaddr eq 192.168.200.1 transprot eq num 6 seclevel high medium low create ipf rule entry ruleid 2004 dir out srcaddr eq 192.168.200.1 transprot eq num 6 seclevel high medium low create ipf rule entry ruleid 2005 dir in destaddr eq 192.168.200.1 transprot eq num 17 seclevel high medium low create ipf rule entry ruleid 2006 dir out srcaddr eq 192.168.200.1 transprot eq num 17 seclevel high medium low
Ausgehende Ports für Rechner aus dem lokalen Netzt erlauben
create ipf rule entry ruleid 2007 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport range 20 22 seclevel high medium low create ipf rule entry ruleid 2008 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 23 seclevel high medium low create ipf rule entry ruleid 2009 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 25 seclevel high medium low create ipf rule entry ruleid 2010 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 17 destport eq num 53 seclevel high medium low create ipf rule entry ruleid 2011 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 80 seclevel high medium low create ipf rule entry ruleid 2012 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 110 seclevel high medium low create ipf rule entry ruleid 2013 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 443 seclevel high medium low create ipf rule entry ruleid 2014 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 5190 seclevel high medium low create ipf rule entry ruleid 2015 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 8245 seclevel high medium low create ipf rule entry ruleid 2016 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 8080 seclevel high medium low create ipf rule entry ruleid 2017 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 119 seclevel high medium low
Eingehende Ports für Rechner im lokalen Netz erlauben
create ipf rule entry ruleid 2018 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport range 20 22 seclevel high medium low create ipf rule entry ruleid 2019 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 23 seclevel high medium low create ipf rule entry ruleid 2020 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 25 seclevel high medium low create ipf rule entry ruleid 2021 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 17 srcport eq num 53 seclevel high medium low create ipf rule entry ruleid 2022 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 80 seclevel high medium low create ipf rule entry ruleid 2023 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 110 seclevel high medium low create ipf rule entry ruleid 2024 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 443 seclevel high medium low create ipf rule entry ruleid 2025 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 5190 seclevel high medium low create ipf rule entry ruleid 2026 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 8245 seclevel high medium low create ipf rule entry ruleid 2027 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 8080 seclevel high medium low create ipf rule entry ruleid 2028 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 119 seclevel high medium low
Eingehende Serververbindungen zulassen
create ipf rule entry ruleid 2029 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport range 20 22 seclevel high medium low create ipf rule entry ruleid 2030 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 80 seclevel high medium low create ipf rule entry ruleid 2031 dir in act accept destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 destport eq num 8080 seclevel high medium low
Ausgehende Serververbindungen zulassen
create ipf rule entry ruleid 2032 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport range 20 22 seclevel high medium low create ipf rule entry ruleid 2033 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 80 seclevel high medium low create ipf rule entry ruleid 2034 dir out act accept srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 srcport eq num 8080 seclevel high medium low
Alle TCP und UDP Ports für das lokale Netzwerk schließen
create ipf rule entry ruleid 2035 dir in destaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 seclevel high medium low create ipf rule entry ruleid 2036 dir out srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 6 seclevel high medium low create ipf rule entry ruleid 2037 dir in destaddr range 192.168.200.2 192.168.200.255 transprot eq num 17 seclevel high medium low create ipf rule entry ruleid 2038 dir out srcaddr range 192.168.200.2 192.168.200.255 transprot eq num 17 seclevel high medium low
Filterregeln zu Fuß definiert
Ping für alle Rechner freigeben
create ipf rule entry ruleid 2000 dir in act accept transprot eq ICMP seclevel high medium low create ipf rule entry ruleid 2001 dir out act accept transprot eq ICMP seclevel high medium low
Für einen Rechner (192.168.1.4) den Zugriff auf dem telnet Port (23) freigeben
create ipf rule entry ruleid 2002 dir in act accept destaddr eq 192.168.1.4 srcaddr eq 192.168.1.1 transprot eq TCP srcport eq telnet seclevel high medium low create ipf rule entry ruleid 2003 dir out act accept srcaddr eq 192.168.1.1 destaddr eq 192.168.1.4 transprot eq TCP destport eq telnet seclevel high medium low
FTP Port freigeben
create ipf rule entry ruleid 2005 ifname public dir out act accept transprot eq TCP destport range 20 22 seclevel high medium low
Telnet Port freigeben
create ipf rule entry ruleid 2006 ifname public dir out act accept transprot eq TCP destport eq num 23 seclevel high medium low
SMTP (Email senden) Port freigeben
create ipf rule entry ruleid 2007 ifname public dir out act accept transprot eq TCP destport eq num 25 seclevel high medium low
DNS Freigeben
create ipf rule entry ruleid 2008 ifname public dir out act accept transprot eq UDP destport eq num 53 seclevel high medium low
HTTP Freigeben
create ipf rule entry ruleid 2009 ifname public dir out act accept transprot eq TCP destport eq num 80 seclevel high medium low
POP3 (Email empfangen)
create ipf rule entry ruleid 2010 ifname public dir out act accept transprot eq TCP destport eq num 110 seclevel high medium low
HTTPS
create ipf rule entry ruleid 2011 ifname public dir out act accept transprot eq TCP destport eq num 443 seclevel high medium low
ICQ
create ipf rule entry ruleid 2012 ifname public dir out act accept transprot eq TCP destport eq num 5190 seclevel high medium low
NO IP- DNS übertragem
create ipf rule entry ruleid 2013 ifname public dir out act accept transprot eq TCP destport eq num 8245 seclevel high medium low
Alternativer HTTP Port (z. B. Proxy)
create ipf rule entry ruleid 2014 ifname public dir out act accept transprot eq TCP destport eq num 8080 seclevel high medium low
News Server
create ipf rule entry ruleid 2015 ifname public dir out act accept transprot eq TCP destport eq num 119 seclevel high medium low
Und das ganze für eingehenden Verkehr
create ipf rule entry ruleid 2016 ifname public dir in act accept transprot eq TCP srcport range 20 22 seclevel high medium low create ipf rule entry ruleid 2017 ifname public dir in act accept transprot eq TCP srcport eq num 23 seclevel high medium low create ipf rule entry ruleid 2018 ifname public dir in act accept transprot eq TCP srcport eq num 25 seclevel high medium low create ipf rule entry ruleid 2019 ifname public dir in act accept transprot eq UDP srcport eq num 53 seclevel high medium low create ipf rule entry ruleid 2020 ifname public dir in act accept transprot eq TCP srcport eq num 80 seclevel high medium low create ipf rule entry ruleid 2021 ifname public dir in act accept transprot eq TCP srcport eq num 110 seclevel high medium low create ipf rule entry ruleid 2022 ifname public dir in act accept transprot eq TCP srcport eq num 443 seclevel high medium low create ipf rule entry ruleid 2023 ifname public dir in act accept transprot eq TCP srcport eq num 5190 seclevel high medium low create ipf rule entry ruleid 2024 ifname public dir in act accept transprot eq TCP srcport eq num 8245 seclevel high medium low create ipf rule entry ruleid 2025 ifname public dir in act accept transprot eq TCP srcport eq num 8080 seclevel high medium low create ipf rule entry ruleid 2026 ifname public dir in act accept transprot eq TCP srcport eq num 119 seclevel high medium low
Zugriff von außen gestatten
FTP und SFTP
create ipf rule entry ruleid 2026 ifname public dir out act accept transprot eq TCP srcport range 20 22 seclevel high medium low create ipf rule entry ruleid 2027 ifname public dir in act accept transprot eq TCP destport range 20 22 seclevel high medium low
Beide HTTP Ports
create ipf rule entry ruleid 2028 ifname public dir out act accept transprot eq TCP srcport eq num 8080 seclevel high medium low create ipf rule entry ruleid 2029 ifname public dir in act accept transprot eq TCP destport eq num 8080 seclevel high medium low create ipf rule entry ruleid 2030 ifname public dir out act accept transprot eq TCP srcport eq num 80 seclevel high medium low create ipf rule entry ruleid 2031 ifname public dir in act accept transprot eq TCP destport eq num 80 seclevel high medium low
Portbereich für Datenverbindungen im FTP-Passivmodus
create ipf rule entry ruleid 2032 ifname public dir in act accept transprot eq tcp destport range 50000 50100 seclevel high medium low
Emule
create ipf rule entry ruleid 2033 ifname public dir in act accept transprot eq tcp destport eq num 4662 seclevel high medium low create ipf rule entry ruleid 2034 ifname public dir out act accept transprot eq TCP srcport eq num 4662 seclevel high medium low create ipf rule entry ruleid 2035 ifname public dir in act accept transprot eq UDP destport eq num 4672 seclevel high medium low create ipf rule entry ruleid 2036 ifname public dir out act accept transprot eq udp srcport eq num 4672 seclevel high medium low
Torrent
create ipf rule entry ruleid 2037 ifname public dir in act accept transprot eq tcp destport range 6881 6889 seclevel high medium low
Allen übrigen Datenverkehr von außerhalb blocken
create ipf rule entry ruleid 2235 ifname public dir in seclevel high medium low create ipf rule entry ruleid 2236 ifname public dir out seclevel high medium low
->Zurück zu Webdienste
