VyOSのファイアウォール設定では下記のようにファイアウォールを設定します。
ファイアウォール設定例
set firewall name fw-test rule 1 action 'accept'
set firewall name fw-test rule 1 destination address '0.0.0.0/0'
set firewall name fw-test rule 1 source address '192.168.0.0/24'
set firewall name fw-test rule 2 action 'accept'
set firewall name fw-test rule 2 destination address '0.0.0.0/0'
set firewall name fw-test rule 2 source address '192.168.1.0/24'
set firewall name fw-test rule 2
・・・
同じようなルールを適用する対象ノードが多くなるとその分ルール数も増え、設定する行数も増えていきます。グループ機能を使うことで設定をまとめることができます。グループとして設定できるのは下記３種類です。
vyos@vyos# set firewall group
Possible completions:
+> address-group
Firewall address-group
+> network-group
Firewall network-group
+> port-group Firewall port-group
[edit]
vyos@vyos# set firewall group
今回はアドレスグループを設定します。使用するパラメーターは下記とします。
- アドレスグループ名：node-fw-lab.local
- 対象アドレス：10.0.0.64/32
set firewall group address-group node-fw-lab.local address '10.0.0.64'
set firewall group address-group node-fw-lab.local description 'FW-Grp-test'
設定したアドレスグループを利用してファイアウォールを設定します。
使用するパラメーターは下記とします。
- ファイアウォール名：fw-lab.local
- ルール番号：１
- 動作：accept
- 宛先アドレス：ANY
- 送信元アドレスグループ：node-fw-lab.local
- サービス：ANY
set firewall name fw-lab.local default-action 'drop'
set firewall name fw-lab.local rule 1 action 'accept'
set firewall name fw-lab.local rule 1 description 'FW-Grp-test'
set firewall name fw-lab.local rule 1 destination address '0.0.0.0/0'
set firewall name fw-lab.local rule 1 log 'enable'
set firewall name fw-lab.local rule 1 protocol 'all'
set firewall name fw-lab.local rule 1 source group address-group 'node-fw-lab.local'
設定した10.0.0.64を持つWindowsサーバーからインターネットへ通信できるか確認します。ブラウザからYAHOO!ニュースを閲覧します。閲覧できました。
VyOSのファイアウォール設定でlogオプションを有効にすると下記のように該当ファイアウォールルールを通過するトラフィックログを確認できます。
show log firewall name fw-lab.local
VyOSでファイアウォールを設定する場合、最初にアドレスグループの利用を検討しても良いかと思います。それでは。
下記は今回の設定Configです。参考まで。
vyos@vyos# run show configuration commands
set firewall all-ping 'enable'
set firewall broadcast-ping 'disable'
set firewall config-trap 'disable'
set firewall group address-group node-fw-lab.local address '10.0.0.64'
set firewall group address-group node-fw-lab.local description 'FW-Grp-test'
set firewall ipv6-receive-redirects 'disable'
set firewall ipv6-src-route 'disable'
set firewall ip-src-route 'disable'
set firewall log-martians 'enable'
set firewall name fw-lab.local default-action 'drop'
set firewall name fw-lab.local rule 1 action 'accept'
set firewall name fw-lab.local rule 1 description 'FW-Grp-test'
set firewall name fw-lab.local rule 1 destination address '0.0.0.0/0'
set firewall name fw-lab.local rule 1 log 'enable'
set firewall name fw-lab.local rule 1 protocol 'all'
set firewall name fw-lab.local rule 1 source group address-group 'node-fw-lab.local'
set firewall name fw-test default-action 'drop'
set firewall name fw-test rule 1 action 'accept'
set firewall name fw-test rule 1 destination address '0.0.0.0/0'
set firewall name fw-test rule 1 source address '192.168.0.0/24'
set firewall name fw-test rule 2 action 'accept'
set firewall name fw-test rule 2 destination address '0.0.0.0/0'
set firewall name fw-test rule 2 source address '192.168.1.0/24'
set firewall name fw-test rule 3 action 'accept'
set firewall name fw-test rule 3 destination address '0.0.0.0/0'
set firewall name fw-test rule 3 source address '192.168.0.0/16'
set firewall name fw-test rule 4 action 'accept'
set firewall name fw-test rule 4 destination address '0.0.0.0/0'
set firewall name fw-test rule 4 source address '10.0.0.0/8'
set firewall receive-redirects 'disable'
set firewall send-redirects 'enable'
set firewall source-validation 'disable'
set firewall syn-cookies 'enable'
set firewall twa-hazards-protection 'disable'
set interfaces ethernet eth0 address 'dhcp'
set interfaces ethernet eth0 duplex 'auto'
set interfaces ethernet eth0 hw-id '00:0c:29:02:82:5f'
set interfaces ethernet eth0 smp_affinity 'auto'
set interfaces ethernet eth0 speed 'auto'
set interfaces ethernet eth1 address '10.0.0.1/24'
set interfaces ethernet eth1 duplex 'auto'
set interfaces ethernet eth1 firewall in name 'fw-lab.local'
set interfaces ethernet eth1 hw-id '00:0c:29:02:82:69'
set interfaces ethernet eth1 smp_affinity 'auto'
set interfaces ethernet eth1 speed 'auto'
set interfaces loopback 'lo'
set nat source rule 1 description 'Internal-to-External-NAPT'
set nat source rule 1 outbound-interface 'eth0'
set nat source rule 1 source address '10.0.0.0/8'
set nat source rule 1 translation address 'masquerade'
set service dhcp-server disabled 'false'
set service dhcp-server shared-network-name dhcp-pool-1 authoritative 'disable'
set service dhcp-server shared-network-name dhcp-pool-1 description 'lab-1-dhcp'
set service dhcp-server shared-network-name dhcp-pool-1 subnet 10.0.0.0/24 default-router '10.0.0.1'
set service dhcp-server shared-network-name dhcp-pool-1 subnet 10.0.0.0/24 dns-server '10.0.0.1'
set service dhcp-server shared-network-name dhcp-pool-1 subnet 10.0.0.0/24 domain-name 'lab.local'
set service dhcp-server shared-network-name dhcp-pool-1 subnet 10.0.0.0/24 domain-search 'lab.local'
set service dhcp-server shared-network-name dhcp-pool-1 subnet 10.0.0.0/24 lease '86400'
set service dhcp-server shared-network-name dhcp-pool-1 subnet 10.0.0.0/24 start 10.0.0.64 stop '10.0.0.223'
set service dhcp-server shared-network-name dhcp-pool-1 subnet 10.0.0.0/24 static-route destination-subnet '172.16.0.0/24'
set service dhcp-server shared-network-name dhcp-pool-1 subnet 10.0.0.0/24 static-route router '10.0.0.2'
set service dns forwarding cache-size '150'
set service dns forwarding listen-on 'eth0'
set service dns forwarding listen-on 'eth1'
set service dns forwarding name-server '8.8.8.8'
set service ssh port '22'
set system config-management commit-revisions '20'
set system console device ttyS0 speed '9600'
set system host-name 'vyos'
set system login user vyos authentication encrypted-password '$1$[password]'
set system login user vyos authentication plaintext-password ''
set system login user vyos level 'admin'
set system name-server '8.8.8.8'
set system name-server '8.8.4.4'
set system ntp server 'ntp.nict.jp'
set system package auto-sync '1'
set system package repository community components 'main'
set system package repository community distribution 'helium'
set system package repository community password ''
set system package repository community url 'http://packages.vyos.net/vyos'
set system package repository community username ''
set system syslog global facility all level 'notice'
set system syslog global facility protocols level 'debug'
set system time-zone 'Asia/Tokyo'
[edit]
vyos@vyos#
