Solaris和IP Filter软件包搭建防火墙的详细步骤
     (3) Firewall

(a) C compiler:
- GNU gcc can be download from http://www.sunfreeware.com .
- or download/try Eval Sun WorkShop CD (a must for 64bit)

(b) IP Filter Firewall/NAT:
(i) Download IPfilter from:
http://coombs.anu.edu.au/~avalon/ip-filter.html

(ii) compiling and installing ipf module:
# make solaris
# cd SunOS5
# make package

Note: if you want to see the state table real time like the
top utility, edit the Makefile to enable it.

STATETOP_CFLAGS=-DSTATETOP
STATETOP_INC=-I/usr/include
STATETOP_LIB=-L/lib -lncurses

I use the libcurses bundles in SUNWcsl and SUNWarc packages
Just link these libs to libncurses in /usr/lib:

libncurses.a -> libcurses.a
libncurses.so.1 -> libcurses.so.1*
libncurses.so -> libcurses.so.1*

Once installed, you can run the cool utility "ipfstat -t"

Note1.1: New release of ipf already have state top enable.

Note2: If you want to have block all by default, change:

POLICY=-DIPF_DEFAULT_PASS=FR_PASS
to :
POLICY=-DIPF_DEFAULT_PASS=FR_BLOCK

(iii) turn on ip forwarding
To enable your system to correctly forward IP packets from
within your private network via NAT, you need to enable
ip_forwarding on your NAT system. First check to see whether
ip_forwarding is enabled via the ndd command:

# ndd -get /dev/tcp ip_forwarding
0

The zero indicates ip_forwarding is not enabled in the kernel.
To enable ip_forwarding, pass the following command to ndd:

# ndd -set /dev/tcp ip_forwarding 1

You should now check that ip_forwarding is indeed enabled by
checking as previously described, with the answer being the
value "1".


(iv) Now let's make this permanent uppon reboot.

#/bin/rm /etc/rc2.d/S65ipfboot
#ln -s /etc/init.d/ipfboot /etc/rc2.d/S65ipfboot

Create a startup script /etc/init.d/ipforward
#!/bin/sh
case "$1" in
start)
echo "Activating IP Forwarding..."
/usr/sbin/ndd -set /dev/tcp ip_forwarding 1
;;

stop)
echo "De-activating IP Forwarding..."
/usr/sbin/ndd -set /dev/tcp ip_forwarding 0
;;
*)
echo "Usage: $0 (start|stop)" >&2
exit 1
;;
esac
exit 0

Make it executable
# chmod 744 /etc/init.d/ipforward

Then link it as /etc/rc2.d/S69ipforward
# ln -s /etc/init.d/ipforward /etc/rc2.d/S69ipforward

Note: ipforwarding must run after ipf & inet

(v) ipf and nat rules set:
Create a file called /etc/opt/ipf/ipnat.conf.
/etc/opt/ipf/ipf.conf is already exist and is empty.

The file /etc/opt/ipf/ipf.conf is used to write your
firewall rules, which is beyond the scope of this document.
Check the IP Filter HOWTO page for more info:
http://unixcircle.com/ipf

(4) Installing OpenSSH (optional)
One can go the easy way and just grab a binary package from
http://www.sunfreeware.com or learn alot of stuff by hand-build:
(in order). Make sure you read the README or INSTALL file that
comes in each package:

1. Get & install Perl
2. Get & install zlib
3. Get & install OpenSSL
4. Get & install OpenSSH

- Startup scrip for sshd, save it as /etc/rc3.d /S99sshd

#!/sbin/sh
#
case "$1" in
'start')
if [ -x /usr/local/sbin/sshd ]; then
echo 'Starting Secure Shell: sshd';
/usr/local/sbin/sshd
fi
;;
'stop')
/usr/bin/pkill -x -u 0 sshd
;;
*)
echo "Usage: $0 { start | stop }"
exit 1
;;
esac
exit 0

- Then make it executable:
# chmod 744 /etc/rc3.d/S99sshd

(5) Config syslogd to send to a syslog server

Make sure ipmon is run with option -Dsnxa in /etc/init.d/ipfboot

To have ipmon login info to syslog you need to add the following
to /etc/syslog.conf

...
# IP Filter
# Log to local
local0.info;local0.err;local0.debug /var/log/ipflog
#
# Log to a dedicate syslog server
local0.info;local0.err;local0.debug ifdef('LOGHOST', /var/log/ipflog, @loghost)
...

Remember syslog requires a tab instead of space

(6) Reboot and enjoy（完）