<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
<META NAME="GENERATOR" CONTENT="SGML-Tools 1.0.9">
<TITLE>Firewall And Proxy Server HOWTO: IP $B%U%#%k%?%j%s%0$N@_Dj(B(IPCHAINS)</TITLE>
<LINK HREF="Firewall-HOWTO-9.html" REL=next>
<LINK HREF="Firewall-HOWTO-7.html" REL=previous>
<LINK HREF="Firewall-HOWTO.html#toc8" REL=contents>
</HEAD>
<BODY>
<A HREF="Firewall-HOWTO-9.html">$B<!$N%Z!<%8(B</A>
<A HREF="Firewall-HOWTO-7.html">$BA0$N%Z!<%8(B</A>
<A HREF="Firewall-HOWTO.html#toc8">$BL\<!$X(B</A>
<HR>
<H2><A NAME="s8">8. IP $B%U%#%k%?%j%s%0$N@_Dj(B(IPCHAINS)</A></H2>
<P>Linux $B$N(B ipchains $B$O!"(B Linux IPv4 firewalling $B%3!<%I$H(B ipfwadm $B$r(B
$B=q$-49$($?$b$N$G$9!#(B
ipfwadm $B$O(B BSD $B$N(B ipfw $B$r=q$-49$($?$b$N$@$C$?$H;W$$$^$9!#(B
ipchains $B$O(B Linux $B$N%+!<%M%k(B 2.1.102 $B0J9_$G(B IP $B%Q%1%C%H%U%#%k%?$r(B
$B4IM}$9$k$N$KI,MW$G$9!#(B
<P>$B0JA0$N%3!<%I$O%U%i%0%a%s%H!ZLuCm(B: fragment: $BCGJR2=$5$l$?%Q%1%C%H![$r(B
$B07$($^$;$s$7!"(B
($B>/$J$/$H$b(B Intel $BMQ$G$O(B) 32 $B%S%C%H$N%+%&%s%?$7$+$"$j$^$;$s$7!"(B
TCP/UDP/ICMP $B0J30$N;EMM$N%W%m%H%3%k$r9MN8$7$F$$$^$;$s$7!"(B
$B%"%H%_%C%/(B($B=V4VE*(B)$B$KBg$-$/(B($B%k!<%k$r(B)$BJQ99$9$k$3$H$b$G$-$^$;$s$7!"(B
$B5U%k!<%k$rK~$?$;$^$;$s$7!"$$$/$D$+L/$JJJ$,$"$j$^$7$?$7!"(B
$B4IM}$7$K$/$$(B ($B%f!<%6$N%_%9$r>7$-$d$9$$(B) $B$b$N$@$C$?$H(B
$B:n<T$O8@$C$F$$$^$9!#(B
<P>$B!ZLuCm(B: $B$3$N0l@a$O(B
<A HREF="http://www.linux.or.jp/JF/JFdocs/IPCHAINS-HOWTO-1.html#ss1.2">IPCHAINS-HOWTO $BBh0l>O(B 1.2 $B$J$<(B?</A>
$B$HKX$IF1$8$G$9!#![(B
<P>$B;d$O(B ipchains $B$r;H$C$?%U%!%$%"%&%)!<%k$N@)8f$K$D$$$F!"$3$3$G?<$/$O=R$Y$k(B
$B$D$b$j$O$"$j$^$;$s!#(B
$B$3$N7o$K$D$$$F$O$H$F$b$h$/=PMh$?(B HOWTO $B$,<!$N$H$3$m$K$"$j$^$9$+$i!"(B
$B$3$3$G$O4pK\$K$D$$$F$@$1=R$Y$^$9!#(B
<A HREF="http://netfilter.samba.org/ipchains/HOWTO.html">http://netfilter.samba.org/ipchains/HOWTO.html</A>$B$K(B HOWTO $B$,$"$j$^$9!#(B
<P>$B%A%'%$%s$OL>A0$G07$$$^$9!#(B
$B$^$:!"(Binput, output $B$=$7$F(B forward $B$H$$$&AH$_9~$_:Q$_%A%'%$%s$,$"$j!"(B
$B$3$l$i$O:o=|$G$-$^$;$s!#(B
$B<+J,$G%A%'%$%s$r:n$k$3$H$,$G$-$^$9!#(B
$B$=$7$F!"$3$l$i$N%A%'%$%s$N%k!<%k%;%C%H$KBP$7$F%k!<%k$rDI2C$7$?$j(B
$B:o=|$7$F$$$/$3$H$,$G$-$^$9!#(B
<P>$BA4$F$N%A%'%$%s$KBP$7$F9T$($kA`:n$O0J2<$NDL$j$G$9(B -
<P>
<P>
<OL>
<LI>$B?7$7$$%A%'%$%s$r:n$k(B (-N). </LI>
<LI>$B6u$N%A%'%$%s$r:o=|$9$k(B (-X). </LI>
<LI>$BAH$_9~$_%A%'%$%s$N%]%j%7!<$rJQ99$9$k(B (-P). </LI>
<LI>$B%A%'%$%s$K$"$k%k!<%k$r%j%9%H$9$k(B (-L). </LI>
<LI>$B%A%'%$%s$N%k!<%k$rA4$F>C$7$^$9(B (-F). </LI>
<LI>$B%A%'%$%s$K$"$kA4$F$N%k!<%k$N%Q%1%C%H$H%P%$%H?t$N%+%&%s%?$r%<%m$K$9$k(B (-Z). </LI>
</OL>
<P>$B%A%'%$%sFbIt$G%k!<%k$rA`:n$9$k$K$O$$$/$D$+$NJ}K!$,$"$j$^$9(B -
<P>
<P>
<OL>
<LI>$B%A%'%$%s$K?7$7$$%k!<%k$r2C$($k(B (-A). </LI>
<LI>$B%A%'%$%s$NE,Ev$J>l=j$K?7$7$$%k!<%k$rF~$l$k(B (-I). </LI>
<LI>$B%A%'%$%s$NE,Ev$J>l=j$G%k!<%k$rCV$-49$($k(B (-R). </LI>
<LI>$B%A%'%$%s$NE,Ev$J>l=j$G%k!<%k$r:o=|$9$k(B (-D). </LI>
<LI>$B%A%'%$%s$KE,9g$9$k:G=i$N%k!<%k$r:o=|$9$k(B (-D). </LI>
</OL>
<P>ipchains $B$O%^%9%+%l!<%G%#%s%0$NA`:n$NCV>l=j$H$7$F$bNI$$=j$J$N$G!"(B
$B$3$N0Y$NA`:n$,$$$/$D$+$"$j$^$9(B -
<P>
<P>
<OL>
<LI>$B8=:_$N%^%9%+%l!<%I$5$l$?@\B3$r%j%9%H$9$k(B (-M -L). </LI>
<LI> $B%^%9%+%l!<%I$N%?%$%`%"%&%HCM$r@_Dj$9$k(B (-M -S).</LI>
</OL>
<P>
<P>$B%U%!%$%"%&%)!<%k%k!<%k$NJQ99$K4X$7$F$O%?%$%_%s%0$NLdBj$,$$$/$D$+$"$j$^$9!#(B
$BCm0U?<$/$d$i$J$$$H!"JQ99$7$F$$$k4V$KIT40A4$J$H$3$m$+$i%Q%1%C%H$r(B
$BDL$7$F$7$^$$$^$9!#(B
$B$b$C$H$bC1=c$JJ}K!$O<!$N$h$&$K$9$k$3$H$G$9(B -
<P>
<PRE>
# ipchains -I input 1 -j DENY
# ipchains -I output 1 -j DENY
# ipchains -I forward 1 -j DENY
</PRE>
<P>
<P>... $BJQ99$7$^$9(B ...
<P>
<PRE>
# ipchains -D input 1
# ipchains -D output 1
# ipchains -D forward 1
#
</PRE>
<P>$B$3$NJ}K!$O!"JQ99$7$F$$$k4V$KA4$F$N%Q%1%C%H$rMn$7$^$9!#(B
<P>$B$3$l$O(B ipchains $B$K$D$$$F!"$3$l$^$G=R$Y$?%U%!%$%"%&%)!<%k%k!<%k$r(B
$B$^$H$a$?$b$N$G$9!#(B
<P>
<P>
<PRE>
#!/bin/sh
#
# rc.firewall $B$N5-=R!#(B
#
## $BA4$F$rGK4~$7$F:G=i$+$i;OF0$9$k!#(B
/sbin/ipchains -F input
/sbin/ipchains -F output
/sbin/ipchains -F forward
## HTTP $BF)2a%W%m%-%7$KBP$7$F%j%@%$%l%/%H$9$k!#(B
#$IPCHAINS -A input -p tcp -s 192.1.2.0/24 -d 0.0.0.0/0 80 -j REDIRECT 8080
## $B$"$J$?<+?H$N%A%'%$%s$r:n$k!#(B
/sbin/ipchains -N my-chain
# $B%5!<%P$KMh$k(B email $B$r5v2D$9$k!#(B
/sbin/ipchains -A my-chain -s 0.0.0.0/0 smtp -d 192.1.2.10 1024:-j ACCEPT
# $B30B&$N(B email $B%5!<%P$K(B email $B@\B3$r5v2D$9$k!#(B
/sbin/ipchains -A my-chain -s 192.1.2.10 -d 0.0.0.0/0 smtp -j ACCEPT
# $B$"$J$?$N(B web $B%5!<%P$K(B Web $B@\B3$r5v2D$9$k!#(B
/sbin/ipchains -A my-chain -s 0.0.0.0/0 www -d 192.1.2.11 1024: -j ACCEPT
# $B30B&$N(B Web $B%5!<%P$K(B Web $B@\B3$r5v2D$9$k!#(B
/sbin/ipchains -A my-chain -s 192.1.2.0/24 1024: -d 0.0.0.0/0 www -j ACCEPT
# DNS $B%H%i%U%#%C%/$r5v2D$9$k!#(B
/sbin/ipchains -A my-chain -p UDP -s 0.0.0.0/0 dns -d 192.1.2.0/24 -j ACCEPT
## $B%^%9%+%l!<%I$r;H$C$F$$$k$J$i!"(B
# $BFbB&$+$iFbB&$X$N%H%i%U%#%C%/$r%^%9%/$7$J$$!#(B
/sbin/ipchains -A forward -s 192.1.2.0/24 -d 192.1.2.0/24 -j ACCEPT
# $B30It%$%s%?!<%U%'!<%9$rD>@\%^%9%/$7$J$$!#(B
/sbin/ipchains -A forward -s 24.94.1.0/24 -d 0.0.0.0/0 -j ACCEPT
# $B30B&$K8~$+$&A4$F$NFbIt(B IP $B$r%^%9%+%l!<%I$9$k!#(B
/sbin/ipchains -A forward -s 192.1.2.0/24 -d 0.0.0.0/0 -j MASQ
## $BA4$F$rIT5v2D$K$9$k!#(B
/sbin/ipchains -P my-chain input DENY
</PRE>
<P>$B$3$3$G$d$a$F$O$$$1$^$;$s!#(B
$B$3$l$O40`z$J%U%!%$%"%&%)!<%k$G$O$"$j$^$;$s$7!"$"$J$?$ODs6!$7$F$$$k(B
$BB>$N%5!<%S%9$,$"$k$O$:$G$9!#(B
$B7+$jJV$7$^$9$,(B IPCHAINS-HOWTO $B$rFI$_$^$7$g$&!#(B
<P>$B!ZLuCm(B:
<A HREF="http://www.linux.or.jp/JF/JFdocs/IPCHAINS-HOWTO-1.html">IPCHAINS-HOWTO $BF|K\8lLu(B</A>
$B$b$"$j$^$9!#
