如何理解EdgeOS/VyOS防火墙

防火墙基础

防火墙是建立在网络会话的基础上,对网络流量进行访问控制的重要工具。

通常一个会话,可以由5个元素来确定,即源地址和端口,目的地址和端口,以及协议类型,这常常成为五元组。防火墙规则通常就会基于这五大元素展开。

根据防火墙的会话跟踪机制,进入防火墙的包又可以分为四类。

  • 新建New:在已有的会话中找不到匹配的会话,并且TCP包的SYN位ON。
  • 已建立Established:属于已有的会话。
  • 相关Related:这个包不属于任何已有的会话,但是和现有会话有关,例如ftp的数据连接是依附于控制连接的。
  • 非法Invalid:凡是不属于以上三类的包都属于非法包。

下面我们就三种不同的应用场景介绍在VyOS上防火墙的配置与使用。

场景一:内网访问互联网

我们先看看相应的流量走向图。

内网的流量(绿色)首先经过DNAT,一般访问外网的流量无需DNAT,然后进入LAN口eth1的防火墙IN规则。如果没有配置规则,缺省都是accept,就是允许任何流量进入。经过内部路由后,流量再经过WAN口OUT规则过滤(缺省accept),再经过SNAT(masquerate)把源地址切换成WAN口外网地址,最后发送出去。

返程流量(蓝色),正好走反过来的路线。WAN口IN方向,缺省规则是丢弃,因为我们不允许外来未知流量进入,并且要丢弃非法状态的流量包。

因此,要让回程的流量正常通过,我们需要在WAN口防火墙IN的规则集里,配置一条允许已经建立连接和相关连接的规则。

下面是对应的防火墙配置:

configure
set firewall name WAN_IN default-action 'drop'

set firewall name WAN_IN rule 10 action 'accept'
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established 'enable'
set firewall name WAN_IN rule 10 state related 'enable'

set firewall name WAN_IN rule 20 action 'drop'
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid 'enable'

set interfaces ethernet eth0 firewall in name 'WAN_IN'
commit;save;exit

场景二:端口转发

内网有一个http服务器,IP地址是10.0.0.100/24,开放公网访问。我们知道http/https用的端口是80/433。

我们还是可以参考场景一的示意图,只不过流量走向正好反过来。要让外网发起的访问内部网站的流量通过,我们需要配置一条防火墙规则,允许符合条件(目的地址和端口,协议)的流量通过。注意执行顺序防火墙排在DNAT之后,所以目的地址应当是转换过的内网地址。

返程不需要设置规则,因为WAN口OUT的缺省规则是accept,允许外向流量。

下面是参考配置。

configure
set firewall name WAN_IN rule 100 action 'accept'
set firewall name WAN_IN rule 100 destination port 80,443
set firewall name WAN_IN rule 100 destination address 10.0.0.100
set firewall name WAN_IN rule 100 protocol tcp
set firewall name WAN_IN rule 100 log disable
set firewall name WAN_IN rule 100 description "allow web access"
commit;save;exit

场景三:IPSec VPN

IPSec的流量是终结在路由器内部的,如下图:

IPSec分成IKE协商阶段,会用到两个固定的端口,500/udp和4500/udp。隧道建立后,流量会封装在ESP包里。流量从隧道出来,也是被视作来源于WAN口,还需要在LOCAL和IN规则集里各配置一条对应的规则,这里要用到匹配IPSec流量的关键字 ipsec match-ipsec。对应的规则如下:

configure
set firewall name WAN_LOCAL default-action 'drop'

set firewall name WAN_LOCAL rule 200 action 'accept'
set firewall name WAN_LOCAL rule 200 description 'ipsec ike'
set firewall name WAN_LOCAL rule 200 destination port '500'
set firewall name WAN_LOCAL rule 200 log 'disable'
set firewall name WAN_LOCAL rule 200 protocol 'udp'

set firewall name WAN_LOCAL rule 210 action 'accept'
set firewall name WAN_LOCAL rule 210 description 'ipsec esp'
set firewall name WAN_LOCAL rule 210 log 'disable'
set firewall name WAN_LOCAL rule 210 protocol 'esp'

set firewall name WAN_LOCAL rule 220 action 'accept'
set firewall name WAN_LOCAL rule 220 description 'ipsec nat-t'
set firewall name WAN_LOCAL rule 220 destination port '4500'
set firewall name WAN_LOCAL rule 220 log 'disable'
set firewall name WAN_LOCAL rule 220 protocol 'udp'

set firewall name WAN_LOCAL rule 230 action 'accept'
set firewall name WAN_LOCAL rule 230 destination address 10.0.0.0/24
set firewall name WAN_LOCAL rule 230 source address 10.1.0.0/24
set firewall name WAN_LOCAL rule 230 ipsec match-ipsec
set firewall name WAN_LOCAL rule 230 log 'disable'
set firewall name WAN_LOCAL rule 230 protocol 'all'

set firewall name WAN_IN rule 200 action 'accept'
set firewall name WAN_IN rule 200 destination address 10.0.0.0/24
set firewall name WAN_IN rule 200 source address 10.1.0.0/24
set firewall name WAN_IN rule 200 ipsec match-ipsec
set firewall name WAN_IN rule 200 log 'disable'
set firewall name WAN_IN rule 200 protocol 'all'

set interfaces ethernet eth0 firewall local name 'WAN_LOCAL'
commit;save;exit

如何理解EdgeOS/VyOS防火墙》有148个想法

  1. rucame.club

    Good – I should definitely pronounce, impressed
    with your site. I had no trouble navigating through all tabs as well as related info ended up being truly easy to do to access.
    I recently found what I hoped for before you know it at all.
    Quite unusual. Is likely to appreciate it
    for those who add forums or something, website theme . a tones way for your customer
    to communicate. Nice task.

    My blog – One Shot Max Review [rucame.club]

    回复
  2. usedtiresbrowardcounty.com

    Just to follow up on the up-date of this subject on your web page and would want to let you know how much I loved the time you took to generate this valuable post.
    In the post, you really spoke of how to truly handle this problem with
    all ease. It would be my own pleasure to collect some
    more ideas from your web site and come as much as offer some others what
    I discovered from you. Thank you for your usual excellent effort.

    My website :: La Velours Serum Review (usedtiresbrowardcounty.com)

    回复
  3. Drusilla

    Everyone loves what you guys are up too. This kind of clever work and coverage!
    Keep up the superb works guys I’ve added you guys to my own blogroll.

    my blog – Keto Advantage Reviews (Drusilla)

    回复
  4. clubriders.men

    I love your blog.. very nice colors & theme. Did you design this website yourself or
    did you hire someone to do it for you? Plz respond as I’m looking to construct my own blog and would like to know where u got this
    from. appreciate it

    Stop by my web blog … Stark Max Keto Pills [clubriders.men]

    回复
  5. Autumn

    Attractive component to content. I simply stumbled
    upon your website and in accession capital to say that I acquire actually enjoyed account your blog posts.
    Any way I will be subscribing in your feeds or even I achievement you
    get entry to persistently rapidly.

    Feel free to visit my web page :: Provia NO2 Review (Autumn)

    回复
  6. www.qiurom.com

    Hello I am so grateful I found your site, I really found you by accident, while
    I was searching on Aol for something else,
    Regardless I am here now and would just like to say thanks for a fantastic post and a all round enjoyable blog (I
    also love the theme/design), I don’t have time
    to browse it all at the moment but I have bookmarked it and also added in your
    RSS feeds, so when I have time I will be back to read much more, Please do keep up
    the superb work.

    Feel free to surf to my website; Vitalyze Pro Male Enhancement
    (http://www.qiurom.com)

    回复
  7. kebe.top

    Nice read, I just passed this onto a colleague who was doing a little research on that.
    And he actually bought me lunch since I found it for
    him smile Thus let me rephrase that: Thank you for lunch!

    Stop by my web site: One Shot Max Keto Review (kebe.top)

    回复
  8. audiodat.ru

    Hello, i think that i saw you visited my blog thus i got here to go back the desire?.I am attempting to find issues to improve my web
    site!I assume its ok to use some of your ideas!!

    My blog: Keto Advantage Keto Burn Review (audiodat.ru)

    回复
  9. clubriders.men

    Hi there just wanted to give you a quick heads up. The text in your content seem to be running off the
    screen in Ie. I’m not sure if this is a format issue or something to do with browser compatibility but I figured I’d post to let you know.
    The design look great though! Hope you get the issue solved soon. Thanks

    My blog BTC Upbeat Platform (clubriders.men)

    回复
  10. yesbol.top

    I wanted to thank you for this fantastic read!! I absolutely loved every little bit of it.
    I have got you book marked to check out new stuff you
    post…

    Take a look at my site Green Country Growers CBD Oil – yesbol.top,

    回复
  11. clubriders.men

    I haven’t checked in here for some time as I thought it was getting boring, but the last few posts are great quality
    so I guess I’ll add you back to my everyday bloglist. You deserve it friend :
    )

    Here is my web blog :: Stark Max Keto Pills (clubriders.men)

    回复
  12. Latia

    Hello I am so excited I found your blog, I really
    found you by mistake, while I was looking on Bing for something else, Anyhow I am here now and would just like to
    say many thanks for a fantastic post and a all round enjoyable blog (I also love
    the theme/design), I don’t have time to read through it all at the moment but I have saved it and also added your RSS feeds,
    so when I have time I will be back to read much more, Please do
    keep up the awesome job.

    Feel free to visit my web page :: Vitalyze Pro Reviews (Latia)

    回复
  13. https://www.qiurom.com/forum.php?mod=viewthread&tid=660129

    With havin so much written content do you ever run into any problems of plagorism or copyright violation? My site has a lot of exclusive content I’ve
    either authored myself or outsourced but it appears a lot of it is popping
    it up all over the internet without my agreement.
    Do you know any solutions to help protect against content from
    being stolen? I’d genuinely appreciate it.

    my blog: One Shot Max Reviews (https://www.qiurom.com/forum.php?mod=viewthread&tid=660129)

    回复

发表评论

邮箱地址不会被公开。