OPENBSD上的ADSL和防火墙设置

　　偶在翻阅了大量网上文档后，实验整理了一下OPENBSD环境中ADSL、PF的配置过程。希望对OPENBSD的初学者有些帮助。下面我用的是OPENBSD 3.6

　　配置ADSL：

　　# vi /etc/ppp/ppp.conf

　　========================ppp.conf=======================

default:
set log Phase Chat IPCP CCP tun command
set redial 15 0
set reconnect 15 10000
pppoe:
set device "!/usr/sbin/pppoe -i rl1"
disable acfcomp protocomp
deny acfcomp
set mtu max 1492
set crtscts off
set speed sync
enable lqr
set lqrperiod 5
set cd 5
set dial
set login
set timeout 0
set authname "sjz681a0156@adsl2"
set authkey 123456
add! default HISADDR
enable mssfixup

　　========================ppp.conf=======================

　　建立防火墙代理配置：

　　# vi /etc/pf.conf

　　=========================pf.conf=======================

ext_if = "tun0"
int_if = "{ dc0, rl0 }"
int_net = "{ 192.168.0.0/24, 192.168.10.0/24 }"
loop = "lo0"
tcp_services = "{ www, ftp }"
boss_ip = "{ 192.168.10.10, 192.168.10.11, 192.168.10.12, 192.168.10.13, 192.168.10.14, 192.168.10.15 }"
noroute = "{ 127.0.0.1/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 255.255.255.255/32 }"
web_server = "{ 192.168.10.5, 192.168.100.16 }"
set block-policy return
set loginterface $ext_if
set optimization aggressive
scrub in all
altq on $int_if cbq bandwidth 1200Kb queue { dflt, boss }
queue dflt bandwidth 300Kb cbq(default)
queue boss bandwidth 900Kb cbq(borrow)
nat on $ext_if from $int_net to any -> $ext_if
block all
block return
block in quick on $ext_if os NMAP
block in quick on $ext_if from $noroute to any
block out quick on $ext_if from any to $noroute
pass in quick on $ext_if inet proto tcp from any to any port > 60000 keep state
#pass in quick on $ext_if inet proto icmp all icmp-type 8 code 0 keep state
pass in quick on $ext_if inet proto tcp from any to any port $tcp_services flags S/SAFR keep state
pass quick on $loop all
pass in on $int_if from $int_net
pass out on $int_if from any to $int_net
pass out on $int_if from any to $boss_ip queue boss
pass out on $ext_if all keep state
pass in on $ext_if inet proto tcp from any to $web_server port = 80 flags S/SAFR keep state (max 200, source-track rule, max-src-nodes 200, max-src-states 2) queue boss