ipfw常用配置

我的规则.
安装的时候,选择的 install-deny.cmd

[code]
#!/bin/sh
#
#

cmd="./ipfw add"

# First flush the firewall rules
./ipfw -q -f flush

#Localhost rules
$cmd 100 pass all from any to any via lo*

# Prevent any traffic to 127.0.0.1, common in localhost spoofing
$cmd 110 deny log all from any to 127.0.0.0/8 in
$cmd 120 deny log all from 127.0.0.0/8 to any in

#动态检查规则
$cmd  check-state

#永远打开
$cmd  allow log all from 10.xxx.xx.xx to any in

#可以ping别人
$cmd allow icmp from any to any icmptypes 11 in

#FTP
$cmd allow tcp from any to any 20,21
$cmd allow tcp from any 20,21 to any

#QQ
$cmd allow log udp from any to any 8000-8009
$cmd allow log udp from any 8000-8009 to any

#DHCP
$cmd allow udp from any to any 67,68
$cmd allow udp from any 67,68 to any

#SSH
$cmd allow tcp from any to any 22
$cmd allow tcp from any 22 to any

#HTTP 下载
#$cmd allow tcp from any 80 to any

#DNS
$cmd allow tcp from any to any 53
$cmd allow tcp from any 53 to any
$cmd allow udp from any to any 53
$cmd allow udp from any 53 to any

#以下是 本地连接(eth3) 的防火墙规则

#以下是 ipmsg 的规则
$cmd 31050 allow udp from 10.xxx.0.0/16 2425 to any in
$cmd 31060 allow tcp from 10.xxx.0.0/16 2425 to any in

$cmd 31070 allow udp from 10.xxx.0.0/16 to me 2425 in
$cmd 31080 allow tcp from 10.xxx.0.0/16 to me 2425 in

#服务器的telnetd和sshd允许通过
$cmd 32010 allow tcp from 10.xxx.0.0/16 23 to me in
$cmd 32020 allow tcp from 10.xxx.0.0/16 22 to me in

#腾讯通的服务器
$cmd 32030 allow tcp from 10.xxx.xx.xxx 8000 to me in
$cmd 32040 allow tcp from 10.xxx.xx.xx 8000 to me in

#end 本地连接(eth3)

$cmd pass all from me to any out keep-state
#$cmd count log ip from any to any