Gateway Sederhana Menggunakan ipfw+ipnat

by: Ogev Gustav (  ogb@indofreebsd.or.id  ) Membangun Sebuah Gateway  merupakan hal yang tidak begitu sulit. Terlebih anda mempunyai sedikit...

by: Ogev Gustav ( ogb@indofreebsd.or.id )
Membangun Sebuah Gateway  merupakan hal yang tidak begitu sulit. Terlebih anda mempunyai sedikit
keinginan dan pengetahuan tentang browser anda sudah bisa menginstall gateway dengan mudah
tanpa menghadapi kesulitan yang berarti.
Banyak Tulisan atau catatan mengenai pembuatan Gateway router yang masing masing memiliki kelebihan
dan kekurangan yang bervariasi.
Pada kesempatan kali ini saya hadirkan tentang tata cara pembuatan gateway yang sederhana, untuk menghandel
sebuah network kecil. 
Untuk membangun sebuah gateway menggunakan IPFW dan IPNAT , maka diperlukan mengkompile kernel terlebih
dahulu. asumsi source kernel tercopy pada lokasi yang seperti biasa.
indofreebsd# cd /sys/i386/conf
indofreebsd#cp GENERIC INDOFREEBSD
 indofreebsd#pico INDOFREEBSD
hal hal yang saya edit adalah bagian ini
ident  indofreebsd
#options        INET6 # saya belum merasa perlu mengaktifkan in.
 dan menambahkan option ini
options         IPFILTER
options         IPFILTER_LOG
options         IPFIREWALL
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=5
options         DUMMYNET
options         HZ=1000
setelah mengedit konfigurasi kernel lalu saya mengcompile kernel ulang.
indofreebsd# cd /usr/src
indofreebsd#make buildkernel KERNCONF=INDOFREEBSD
--------------------------------------------------------------
>>> Kernel build for INDOFREEBSD completed on Fri Feb  9 05:57:45 UTC 2007
--------------------------------------------------------------
indofreebsd# make installkernel KERNCONF=INDOFREEBSD
install -o root -g wheel -m 555   if_xe.ko /boot/kernel
===> xl (install)
install -o root -g wheel -m 555   if_xl.ko /boot/kernel
===> zlib (install)
install -o root -g wheel -m 555   zlib.ko /boot/kernel
kldxref /boot/kernel
indofreebsd#
setelah selesai  masukan beberapa parameter yang kita butuhkan pada rc.conf
router_flags="-q"
router="/sbin/routed"
router_enable="YES"
gateway_enable="YES"
sendmail_enable="NONE"
firewall_enable="YES"
firewall_script="/etc/ipfw.rules"
ipnat_enable="YES"                # Start ipnat function
ipnat_rules="/etc/ipnat.rules"    # rules definition file for ipnat
lalu save 
indofreebsd#


buat ipfw rules
indofreebsd#pico /etc/ipfw.rules
################ Start of IPFW rules file ###############################
# Flush out the list before we begin.
ipfw -q -f flush

ipfw pipe 1 config mask dst-ip 0x000000ff bw 256Kbit/s
ipfw pipe 2 config mask src-ip 0x000000ff bw 64Kbit/s
ipfw add 1 pipe 1 all from any to 192.168.1.0/24 in
ipfw add 2 pipe 2 all from 192.168.1.0/24 to any out
# Set rules command prefix
cmd="ipfw -q add"
pif="rl0"     # public interface name of NIC
              # facing the public Internet

#################################################################
# No restrictions on Inside LAN Interface for private network
# Not needed unless you have LAN.
# Change xl0 to your LAN NIC interface name
#################################################################
$cmd 00008 allow all from any to any via rl1
#################################################################
# No restrictions on Loopback Interface
#################################################################
$cmd 00010 allow all from any to any via lo0

#################################################################
# Allow the packet through if it has previous been added to the
# the "dynamic" rules table by a allow keep-state statement.
#################################################################
$cmd 00015 check-state

#################################################################
# Interface facing Public Internet (Outbound Section)
# Interrogate session start requests originating from behind the
# firewall on the private network or from this gateway server
# destine for the public Internet.
#################################################################
# Get the IP addresses from /etc/resolv.conf file
$cmd 00114 allow tcp from any to any   53 out via $pif setup keep-state
$cmd 00115 allow udp from any to any   53 out via $pif keep-state
$cmd 00122 allow tcp from any to any   21 out via $pif setup keep-state
# Allow out non-secure standard www function
$cmd 00200 allow tcp from any to any 80 out via $pif setup keep-state

# Allow out secure www function https over TLS SSL
$cmd 00220 allow tcp from any to any 443 out via $pif setup keep-state

# Allow out send & get email function
$cmd 00230 allow tcp from any to any 25 out via $pif setup keep-state
$cmd 00231 allow tcp from any to any 110 out via $pif setup keep-state

# Allow out FBSD (make install & CVSUP) functions
# Basically give user root "GOD" privileges.
$cmd 00240 allow tcp from me to any out via $pif setup keep-state uid root

# Allow out ping
$cmd 00250 allow icmp from any to any out via $pif keep-state
$cmd 00251 allow udp from any to any 33434-33523
# Allow out Time
$cmd 00260 allow tcp from any to any 37 out via $pif setup keep-state

# Allow out nntp news (i.e. news groups)
$cmd 00270 allow tcp from any to any 460-30000  out via $pif setup keep-state

# Allow out secure FTP, Telnet, and SCP
# This function is using SSH (secure shell)
$cmd 00280 allow tcp from any to any 22 out via $pif setup keep-state

# Allow out whois
$cmd 00290 allow tcp from any to any 43 out via $pif setup keep-state

# deny and log everything else that.s trying to get out.
$cmd 00299 deny log all from any to any out via $pif

#################################################################
# Interface facing Public Internet (Inbound Section)
# Interrogate packets originating from the public Internet
# destine for this gateway server or the private network.
#################################################################

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 00300 deny all from 192.168.0.0/16 to any in via $pif  #RFC 1918 private IP
$cmd 00301 deny all from 172.16.0.0/12 to any in via $pif     #RFC 1918 private IP
$cmd 00302 deny all from 10.0.0.0/8 to any in via $pif          #RFC 1918 private IP
$cmd 00303 deny all from 127.0.0.0/8 to any in via $pif        #loopback
$cmd 00304 deny all from 0.0.0.0/8 to any in via $pif            #loopback
$cmd 00305 deny all from 169.254.0.0/16 to any in via $pif   #DHCP auto-config
$cmd 00306 deny all from 192.0.2.0/24 to any in via $pif       #reserved for docs
$cmd 00307 deny all from 204.152.64.0/23 to any in via $pif  #Sun cluster interconnect
$cmd 00308 deny all from 224.0.0.0/3 to any in via $pif         #Class D & E multicast
$cmd 00309 allow icmp from any to any icmptypes 11 in
###########allow me to ping out and receive response back
$cmd  00311 allow icmp from any to any icmptypes 0 in
# Deny public pings
#$cmd 00312 deny icmp from any to any in via $pif

# Deny all Netbios service. 137=name, 138=datagram, 139=session
# Netbios is MS/Windows sharing services.
# Block MS/Windows hosts2 name server requests 81
$cmd 00320 deny tcp from any to any 137 in via $pif
$cmd 00321 deny tcp from any to any 138 in via $pif
$cmd 00322 deny tcp from any to any 139 in via $pif
$cmd 00323 deny tcp from any to any 81 in via $pif

# Deny any late arriving packets
$cmd 00330 deny all from any to any frag in via $pif

# Deny ACK packets that did not match the dynamic rule table
$cmd 00332 deny tcp from any to any established in via $pif
# Allow traffic in from ISP's DHCP server. This rule must contain
# the IP address of your ISP.s DHCP server as it.s the only
# authorized source to send this packet type.
# Only necessary for cable or DSL configurations.
# This rule is not needed for .user ppp. type connection to
# the public Internet. This is the same IP address you captured
# and used in the outbound section.
#$cmd 00360 allow udp from any to x.x.x.x 67 in via $pif keep-state
$cmd 00361 allow tcp from any to any 1023-7000 in via $pif setup limit src-addr 2

# Allow in standard www function because I have apache server
$cmd 00400 allow tcp from any to me 80 in via $pif setup limit src-addr 2

# Allow in secure FTP, Telnet, and SCP from public Internet
#$cmd 00410 allow tcp from any to me 22 in via $pif setup limit src-addr 2
$cmd 00410 allow tcp from any to me 222 in via $pif setup limit src-addr 2
# Allow in non-secure Telnet session from public Internet
# labeled non-secure because ID & PW are passed over public
# Internet as clear text.
# Delete this sample group if you do not have telnet server enabled.
$cmd 00420 allow tcp from any to me 113 in via $pif setup limit src-addr 2

# Reject & Log all incoming connections from the outside
$cmd 00499 deny log all from any to any in via $pif

# Everything else is denied by default
# deny and log all packets that fell through to see what they are
$cmd 00999 deny log all from any to any
################ End of IPFW rules file ###############################

indofreebsd#
buat ipnat.rules
indofreebsd#pico /etc/ipnat.rules 
# ------------------------------------------------------------
# Use ipfilter FTP proxy for the firewall doing transfer mode
# active.
# ------------------------------------------------------------
map rl0  0.0.0.0/0 -> 0.0.0.0/32 proxy port ftp ftp/tcp
# ------------------------------------------------------------
# Use ipfilter FTP proxy for hosts behind NAT doing transfer
# mode active.
# ------------------------------------------------------------
map rl0  192.168.0.0/24 -> 0.0.0.0/32 proxy port ftp ftp/tcp
# -----------------------------------------------------------
# Map all internal UDP and TCP traffic to the external IP address
# -----------------------------------------------------------
map rl0  192.168.0.0/24 -> 0.0.0.0/32  portmap tcp/udp 40000:60000
# -----------------------------------------------------------
# Map all other traffic e.g. ICMP to the external IP address
# -----------------------------------------------------------
map rl0  192.168.0.0/24 -> 0.0.0.0/32
lalu save
langkah selanjut nya adalah me restart nya
indofreebsd#reboot
test gateway anda dengan menghubungkan pc client pada gateway tersebut
kalo packet tidak berhasil di lewatkan artinya anda kurang teliti.
demikian langkah langkah pembuatan gateway menggunakan ipfw + ipnat
semoga berhasil.

COMMENTS

Name

Application Support,19,database server,1,Desktop/XWindow,1,DNS Server,2,Email Server,3,Firewall,1,FTP Server,2,General,2,IPFilter,1,Kernel,2,Networking,8,Proxy Server,4,Security,6,Tips and Trick,5,Web Server,2,
ltr
item
IndoFreeBSD: Gateway Sederhana Menggunakan ipfw+ipnat
Gateway Sederhana Menggunakan ipfw+ipnat
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZ5DC1ITM2Q4dx3V75ovL8o1iri_itPUV-ygjcRbnCu8f_gs0bAyJRsk55brMLbqHkMI3lWbZ3sw3sgqYEY5GE_gqlBkKcGT-bQXjrZa0M3Qj4CN9Qk5FV7oGxQcsZwzCig7lc6tO8SNHM/s1600/gateway.jpg
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZ5DC1ITM2Q4dx3V75ovL8o1iri_itPUV-ygjcRbnCu8f_gs0bAyJRsk55brMLbqHkMI3lWbZ3sw3sgqYEY5GE_gqlBkKcGT-bQXjrZa0M3Qj4CN9Qk5FV7oGxQcsZwzCig7lc6tO8SNHM/s72-c/gateway.jpg
IndoFreeBSD
https://www.indofreebsd.or.id/2015/02/gateway-sederhana-menggunakan-ipfwipnat.html
https://www.indofreebsd.or.id/
http://www.indofreebsd.or.id/
http://www.indofreebsd.or.id/2015/02/gateway-sederhana-menggunakan-ipfwipnat.html
true
1901051463523757307
UTF-8
Loaded All Posts Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS PREMIUM CONTENT IS LOCKED STEP 1: Share to a social network STEP 2: Click the link on your social network Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy Table of Content