下面是我觉得有必要的法则: Here are the rules I feel the need to:
# Between The World and Public Interface # Between The World and Public Interface
# Service : Anti Spoofing # Service: Anti Spoofing
# Description : Deny inbound non-secure packets with secure # Description: Deny inbound non-secure packets with secure
source addresses source addresses
# #
# 禁止IP欺骗： # Disable IP spoofing:
# 攻击者伪造IP，使IP包看来像从安全网络的一台信任主机发出的，所以我们拒绝目标地址为安全网段IP的包从非安全网卡出站 # Attacker forges IP, the IP packet network looks like from a security issued by a trusted host, so we refuse to address the target segment for the safety net non-secure IP packets from the network card out of station
# #
deny 0 0 192.168.1.1 255.255.255.0 all any 0 any 0 non-secure deny 0 0 192.168.1.1 255.255.255.0 all any 0 any 0 non-secure
both outbound l=nf=y both outbound l = nf = y
# #
# Between RFC 1627 Clase B reserves IP and The World # Between RFC 1627 Clase B reserves IP and The World
# Service : Deny Inbound Non-secure Interface # Service: Deny Inbound Non-secure Interface
# Description : Deny Inbound Non-secure Interface # Description: Deny Inbound Non-secure Interface
# #
# 禁止源IP地址为B类保留IP地址的IP包从非安全网卡进站 # Disable source IP address reserved for the Class B IP address of IP packets from the non-stop security card
# #
deny 172.16.0.0 255.240.0.0 0 0 all any 0 any 0 non-secure deny 172.16.0.0 255.240.0.0 0 0 all any 0 any 0 non-secure
both inbound l=nf=y both inbound l = nf = y
# #
# Between RFC 1627 Clase C reserves IP and The World # Between RFC 1627 Clase C reserves IP and The World
# Service : Deny Inbound Non-secure Interface # Service: Deny Inbound Non-secure Interface
# Description : Deny Inbound Non-secure Interface # Description: Deny Inbound Non-secure Interface
# #
# 禁止源IP地址为C类保留IP地址的IP包从非安全网卡进站 # Disable source IP address reserved for the Class C IP addresses of IP packets from the non-stop security card
# #
deny 192.168.0.0 255.255.0.0 0 0 all any 0 any 0 non-secure deny 192.168.0.0 255.255.0.0 0 0 all any 0 any 0 non-secure
both inbound l=nf=y both inbound l = nf = y
# #
# Between RFC 1627 Clase A reservers IP and The World # Between RFC 1627 Clase A reservers IP and The World
# Service : Deny Inbound Non-secure Interface # Service: Deny Inbound Non-secure Interface
# Description : Deny Inbound Non-secure Interface # Description: Deny Inbound Non-secure Interface
# #
# 禁止源IP地址为A类保留IP地址的IP包从非安全网卡进站 # Disable source IP address reserved for the Class A IP address of IP packets from the non-stop security card
# #
deny 10.0.0.0 255.0.0.0 0 0 all any 0 any 0 non-secure both deny 10.0.0.0 255.0.0.0 0 0 all any 0 any 0 non-secure both
inbound l=nf=y inbound l = nf = y
# #
# Between The World and The World # Between The World and The World
# Service : Definiton UDP port 514 # Service: Definiton UDP port 514
# Description : Definiton UDP port 514 # Description: Definiton UDP port 514
# #
# 保护SYSLOG SERVER（UDP PROT 514） # Protection SYSLOG SERVER (UDP PROT 514)
# #
deny 0 0 0 0 udp any 0 eq 514 both both both l=nf=y deny 0 0 0 0 udp any 0 eq 514 both both both l = nf = y
# #
# Between Loopback Address and The World # Between Loopback Address and The World
# Service : All Deny # Service: All Deny
# Description : All Deny # Description: All Deny
# #
# Loopback地址是不会出现在真实的网卡上的，禁止Loopback地址进出FIREWALL # Loopback address will not appear on the actual card, prohibit access to FIREWALL Loopback Address
# #
deny 127.0.0.0 255.0.0.0 0 0 all any 0 any 0 both both both deny 127.0.0.0 255.0.0.0 0 0 all any 0 any 0 both both both
l=yf=y l = yf = y
# #
# Between The World and The World # Between The World and The World
# Service : Protect Resource System # Service: Protect Resource System
# Description : Protect Resource System # Description: Protect Resource System
# #
# 这是AIX控制系统资源的端口，Ω媒 # This is an AIX system resource control port, Ω media
# #
deny 0 0 0 0 all any 0 eq 200 non-secure both inbound l=n deny 0 0 0 0 all any 0 eq 200 non-secure both inbound l = n
f=y f = y
# #
# Between Security Network and The World # Between Security Network and The World
# Service : HTTP direct out # Service: HTTP direct out
# Description : Permit HTTP from secure network directly to # Description: Permit HTTP from secure network directly to
non-secure network non-secure network
# #
# 允许从安全网络访问外部网络的WEB资源 # Allow access from a secure network resources outside the network of the WEB
# #
permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 80 secure permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 80 secure
route inbound l=nf=y route inbound l = nf = y
permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 80 non-secure permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 80 non-secure
route outbound l=nf=y route outbound l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 tcp/ack eq 80 gt 1023 permit 0 0 192.168.1.0 255.255.255.0 tcp / ack eq 80 gt 1023
non-secure route inbound l=nf=y non-secure route inbound l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 tcp/ack eq 80 gt 1023 permit 0 0 192.168.1.0 255.255.255.0 tcp / ack eq 80 gt 1023
secure route outbound l=nf=y secure route outbound l = nf = y
# #
# Between Security Network and The World # Between Security Network and The World
# Service : Ping # Service: Ping
# Description : Permit Ping outbound secure network to anywhere # Description: Permit Ping outbound secure network to anywhere
# #
# 允许从安全网络PING外部网络 # Allow from external network security network PING
# #
permit 192.168.1.0 255.255.255.0 0 0 icmp eq 8 eq 0 both both permit 192.168.1.0 255.255.255.0 0 0 icmp eq 8 eq 0 both both
both l=nf=y both l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 icmp eq 0 eq 0 both both permit 0 0 192.168.1.0 255.255.255.0 icmp eq 0 eq 0 both both
both l=nf=y both l = nf = y
# #
# Between Security Network and The World # Between Security Network and The World
# Service : Allow FTP outbound Secure Interface # Service: Allow FTP outbound Secure Interface
# Description : Allow FTP outbound Secure Interface # Description: Allow FTP outbound Secure Interface
# #
# 允许从安全网络FTP到外部网络的FTP SERVER # Allow FTP from a secure network to the external network, FTP SERVER
# #
route inbound l=nf=y route inbound l = nf = y
permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 21 non-secure permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 21 non-secure
route outbound l=nf=y route outbound l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 tcp/ack eq 21 gt 1023 permit 0 0 192.168.1.0 255.255.255.0 tcp / ack eq 21 gt 1023
permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 21 secure permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 21 secure
non-secure route inbound l=nf=y non-secure route inbound l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 tcp/ack eq 21 gt 1023 permit 0 0 192.168.1.0 255.255.255.0 tcp / ack eq 21 gt 1023
secure route outbound l=nf=y secure route outbound l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 tcp eq 20 gt 1023 non-secure permit 0 0 192.168.1.0 255.255.255.0 tcp eq 20 gt 1023 non-secure
route inbound l=nf=y route inbound l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 tcp eq 20 gt 1023 secure permit 0 0 192.168.1.0 255.255.255.0 tcp eq 20 gt 1023 secure
route outbound l=nf=y route outbound l = nf = y
permit 192.168.1.0 255.255.255.0 0 0 tcp/ack gt 1023 eq 20 permit 192.168.1.0 255.255.255.0 0 0 tcp / ack gt 1023 eq 20
non-secure route outbound l=nf=y non-secure route outbound l = nf = y
permit 192.168.1.0 255.255.255.0 0 0 tcp/ack gt 1023 eq 20 permit 192.168.1.0 255.255.255.0 0 0 tcp / ack gt 1023 eq 20
secure route inbound l=nf=y secure route inbound l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 tcp/ack gt 1023 gt 1023 permit 0 0 192.168.1.0 255.255.255.0 tcp / ack gt 1023 gt 1023
non-secure route inbound l=nf=y non-secure route inbound l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 tcp/ack gt 1023 gt 1023 permit 0 0 192.168.1.0 255.255.255.0 tcp / ack gt 1023 gt 1023
secure route outbound l=nf=y secure route outbound l = nf = y
permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 gt 1023 secure permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 gt 1023 secure
route inbound l=nf=y route inbound l = nf = y
permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 gt 1023 non-secure permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 gt 1023 non-secure
route outbound l=nf=y route outbound l = nf = y
# #
# Between Security Network and The World # Between Security Network and The World
# Service : Telnet direct out # Service: Telnet direct out
# Description : Permit Telnet outbound from secure network # Description: Permit Telnet outbound from secure network
to non-secure network to non-secure network
# #
# 允许从安全网络TELNET外部网络的主机 # Allow from external network security network TELNET host
# #
permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 23 secure permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 23 secure
route inbound l=nf=y route inbound l = nf = y
permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 23 non-secure permit 192.168.1.0 255.255.255.0 0 0 tcp gt 1023 eq 23 non-secure
route outbound l=nf=y route outbound l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 tcp/ack eq 23 gt 1023 permit 0 0 192.168.1.0 255.255.255.0 tcp / ack eq 23 gt 1023
non-secure route inbound l=nf=y non-secure route inbound l = nf = y
permit 0 0 192.168.1.0 255.255.255.0 tcp/ack eq 23 gt 1023 permit 0 0 192.168.1.0 255.255.255.0 tcp / ack eq 23 gt 1023
secure route outbound l=nf=y secure route outbound l = nf = y
Tidak ada komentar:
Posting Komentar