服务器 频道

如何在AIX上实现IP包过滤的功能

  【IT168 服务器学院】AIX操作系统支持静态的IP包过滤功能,您可以利用这一功能来保护连接在网络上的服务器。在使用这一功能之前,您需要安装以下软件包:
  bos.net.ipsec.keymgt
  bos.net.ipsec.rte
  然后您就可以进行包过滤的配置了。
  首先运行smitty ipsec4, 选择Advanced IP Security Configuration->Configure IP Security Filter Rules->Add an IP Security Filter Rule,然后在其中填写过滤的细节。具体介绍如下:

  Rule Action 操作:
  deny
  拒绝
  permit
  允许

  IP Source Address 源地址。可以是 IP 地址或主机名。

  IP Source Mask 比较位掩码。设置为“1”的位表示源地址中对应的位将被比较。

  IP Destination Address 目标地址。可以是 IP 地址或主机名。

  IP Destination Mask 目标比较位掩码。设置为“1”的位表示目标地址中对应的位将被比较。

  Apply to Source Routing? (PERMIT/inbound only) 源路由控制:yes 或 no。决定是(yes)否(no)允许Source Routing包。

  Protocol 协议。值可以是 udp、icmp、tcp、tcp/ack、ospf、pip、esp、ah 和 all。

  Source Port / ICMP Type Operation 源端口或 ICMP 类型操作。可以是等于(eq)、大于(gt)、小于(lt)、不等于(neq)、小于等于(le)、大于等于(ge)、任何(any)。

  Source Port Number / ICMP Type 源端口或 ICMP 类型值。 ICMP 类型值列出如下:
  0 = Echo Reply
  3 = Destination Unreachable
  4 = Source Quench
  5 = Redirect
  8 = Echo Request
  11 = Time Exceeded
  12 = Parameter Problem
  13 = Timestamp Request
  14 = Timestamp Reply
  15 = Information Request
  16 = Information Reply
  A1 = Address Format Request
  A2 = Address Format Reply

  Destination Port / ICMP Code Operation 目标端口或 ICMP 代码操作。可以是等于(eq)、大于(gt)、小于(lt)、不等于(neq)、小于等于(le)、大于等于(ge)、任何(any)。

  Destination Port Number / ICMP Type 目标端口或 ICMP 代码值。ICMP类型对应的代码值列出如下:
  TYPE = 0 - Echo Reply sent by:
  0 = (no special meaning) host, router
  TYPE = 3 - Destination Unreachable sent by:
  0 = network unreachable router
  1 = host unreachable router
  2 = protocol unreachable host
  3 = port unreachable host
  4 = fragmentation needed but impossible router
  because of ''don''t fragment'' command
  5 = source route not reachable router
  TYPE = 4 - Source Quench sent by:
  0 = datagram could not be received host, router
  or routed
  TYPE = 5 - Redirect sent by:
  redirection of all datagrams ...
  0 = ...to a specific IP network router
  1 = ...to a specific IP host router
  2 = ...of a spedific type of service and network router
  3 = ...of a specific type of service and host router
  TYPE = 8 - Echo Request sent by:
  0 = (no special meaning) host, router
  TYPE = 11 - Time Exceeded sent by:
  0 = TTL set to 0 router
  1 = reassembly timer exceeded host
  TYPE = 12 - Parameter Problem sent by:
  0 = the ICMP header''s pointer identifies host, router
  a faulty octett within the datagram
  TYPE = 13/14 - Timestamp Request/Reply sent by:
  0 = (no special meaning) host, router
  TYPE = 15/16 - Information Request/Reply sent by:
  0 = (no special meaning) host, router
  TYPE = A1 - Address Format Request sent by:
  0 = (no special meaning) host, router
  TYPE = A2 - Address Format Reply sent by:
  n = [number of bits in a subnet mask] host, router

  Routing 路由:
  route
  转发的信息包
  local
  本地目标/源信息包
  both
  二者

  Direction 方向。
  inbond
  传入的信息包
  outbound
  传出的信息包
  both
  二者

  Log Control 日志控制。
  yes
  包含在日志中
  no
  不包含在日志中。
  Fragmentation Control 分段控制。
  all packets
  应用到分段头部分、分段部分和非分段部分
  fragments and fragment headers only
  只应用于分段部分和分段头部分
  unfragmented packets only
  只应用于非分段部分
  fragment headers and unfragmented packets only
  只应用于非分段部分和分段头部分

  Tunnel ID 报文封装标识。
  Interface 接口,如 tr0 或 en0。

  配置完成后选择Move IP Security Filter Rules调整适合的过滤器顺序,然后选择 Start/Stop IP Security启动过滤器。
  使用lsfilt可以按顺序列出当前配置的过滤器。
   
  

   

  

0
相关文章