\documentclass[letterpaper]{article}
\nonstopmode
\akai
\usepackage{linuxdoc-sgml}
\usepackage{qwertz}
\usepackage{url}
\usepackage[latin1]{inputenc}
\usepackage{t1enc}
\usepackage[english]{babel}
\usepackage{epsfig}
\usepackage{null}
\def\addbibtoc{
\addcontentsline{toc}{section}{\numberline{\mbox{}}\relax\bibname}
}%end-preamble
\setcounter{page}{1}
\title{·À»ðÇ½ºÍ´úÀíËÅ·þÆ÷ - HOWTO}
\author{×÷Õß: Mark Grennan, {\ttfamily markg@netplus.net}\\ 
ÒëÕß: ÕÔÆ½Íû {\ttfamily tchao@worldnet.att.net}}
\date{v0.4, 1996Äê11ÔÂ8ÈÕ}
\abstract{v0.4, 1996Äê11ÔÂ8ÈÕ£¬ÕâÆªÎÄÕÂÖ÷ÒªÔÚÓÚËµÃ÷·À»ðÇ½ÏµÍ³µÄ¸÷ÖÖ»ù±¾¸ÅÄî£¬²¢Ê¾¡õÔÚLinuxÎª»ù´¡µÄ¸öÈËµçÄÔÉÏ°²×°×÷Îª¹ýÂËÖ®ÓÃµÄ·À»ðÇ½ºÍ´úÀíËÅ·þÆ÷µÄÏêÏ¸²½Öè¡£Õâ·ÝÎÄ¼þµÄHTML°æ±¾ÔØÓÚ{\itshape http://okcforum.org/\~{}markg/Firewall-HOWTO.html\/}}


\begin{document}
\maketitle
\tableofcontents

\section{µ¼ÑÔ}

×î³õµÄÕâÆª¡°·À»ðÇ½ - HOWTO¡±ÊÇDavid Rudder{\bfseries drig@execpc.com}µÄ×÷Æ·¡£ËûÈÃÎÒÔÚËûµÄÔ­¸åÉÏÔö¶©ÄÚÈÝ£¬¶Ô´ËÎÒÉî±í¸ÐÐ»¡£
×î½üÕâÒ»Õó×Ó, ·À»ðÇ½£¨Firewall£©³ÉÁËÍø¼ÊÍøÂ·µÄ°²È«ÎÊÌâµÄÈÈÃÅ»°Ìâ¡£µ«ÏñÐí¶àÆäËûÈÈÃÅ»°ÌâÒ»Ñù£¬ÕâÒ²Í¬Ê±Ôì³ÉÁËÐí¶àÈË¶ÔËüµÄÎó½â¡£ÕâÆªHOWTO ½«»áÌ½ÌÖÊ²÷áÊÇ·À»ðÇ½£¿ÈçºÎ°²×°£¿ºÎÎ½´úÀíËÅ·þÆ÷£¨Proxy Server£©£¿ÈçºÎÉè¶¨´úÀíËÅ·þÆ÷£¿ÒÔ¼°ÕâÐ©¼¼ÊõÔÚ°²È«ÁìÓòÒÔÍâµÄÓ¦ÓÃ¡£




\subsection{¶ÁÕß»ØÓ¦}

{\bfseries Èç¹û·¢ÏÖÕâÆªÎÄÕÂÖÐÓÐÈÎºÎ´íÎó, ÇëÎñ±ØÍ¨ÖªÎÒ}¡£ÈË·ÇÊ¥ÏÍ, ÊëÄÜÎÞ¹ý! ÈÎºÎ´íÎóÎÒ¶¼ÀÖÓÚ¸üÕý¡£À´ÐÅÎÒ¶¼»áÉè·¨»Ø¸², µ«ÎÒÏàµ±Ã¦, Èç¹ûÃ»ÓÐÊÕµ½ÎÒµÄ»ØÐÅ£¬»¹Çë°üº­¡£{\itshape »ØÐÅµØÖ·{\bfseries markg@netplus.net}\/}

Èç¹û·¢ÏÖÈÎºÎÎóÒëÖ®´¦£¬ÇëÁ¢¼´Í¨Öª±¾ÎÄÒëÕß£ºÕÔÆ½Íû£¨tchao@worldnet.att.net)¡£




\subsection{ÑÏÕýÉùÃ÷}

{\bfseries ÎÒ²»¶ÔÈÎºÎÒÀÕÕ±¾ÎÄËù×öÐÐÎªÔì³ÉµÄËðº¦¸ºÈÎºÎÔðÈÎ(I AM NOT RESPONSIBLE FOR ANY DAMAGES INCURRED DUE TO ACTIONS TAKEN BASED ON THIS DOCUMENT) }¡£ÕâÆªÎÄÕÂÖ»½éÉÜ·À»ðÇ½ºÍ´úÀíËÅ·þÆ÷µÄ×÷ÓÃ¡£ÒªÖªµÀ£¬ÎÒ²»ÊÇµçÄÔ°²È«ÎÊÌâ×¨¼Ò£¬Ò²´ÓÀ´Ã»ÓÐ×°³ÉÕâ·½ÃæµÄ×¨¼Ò¡£ÎÒÖ»ÊÇ¸öÏ²»¶¶ÁÊé£¬¶øÇÒ°®µçÄÔÊ¤¹ý°®ÈËÀàµÄ¼Ò»ï¡£ÎÒÏ£ÍûÕâÆªÎÄÕÂÄÜ°ïÖúÄãÊìÏ¤Õâ¸öÖ÷Ìâ, µ«²»±£Ö¤ÄÚÈÝ¾ø¶ÔÎÞÎó¡£




\subsection{°æÈ¨Ðû¸æ (Òë×¢¡Ã°æÈ¨Ðû¸æ²»Òë)}



Unless otherwise stated, Linux HOWTO documents are copyrighted by their respective authors. Linux HOWTO documents may be reproduced and distributed in whole or in part, in any medium physical or electronic, as long as this copyright notice is retained on all copies. Commercial redistribution is allowed and encouraged; however, the author would like to be notified of any such distributions.

All translations, derivative works, or aggregate works incorporating any Linux HOWTO documents must be covered under this copyright notice. That is, you may not produce a derivative work from a HOWTO and impose additional restrictions on its distribution. Exceptions to these rules may be granted under certain conditions; please contact the Linux HOWTO coordinator.

In short, we wish to promote dissemination of this information through as many channels as possible. However, we do wish to retain copyright on the HOWTO documents, and would like to be notified of any plans to redistribute the HOWTOs. 

If you have any questions, please contact Mark Grennan at $<$markg@netplus.net$>$.




\subsection{Ð´ÕâÆªÎÄÕÂµÄ¶¯»ú}

¾¡¹ÜÈ¥ÄêÔÚcomp.os.linuxÉÏÓÐÐí¶à¹ØÓÚ·À»ðÇ½ÎÊÌâµÄÌÖÂÛ£¬µ«ÎÒ·¢ÏÖºÜÄÑÕÒµ½Éè¶¨·À»ðÇ½ËùÐèµÄ×ÊÁÏ¡£ÕâÆªHOWTOµÄÔ­ÏÈ°æ±¾Ìá¹©ÁËÒ»Ð©°ïÖú£¬µ«ÄÚÈÝÈÔÏÓ²»×ã¡£ÎÒ¸ù¾ÝDavid Rudder±àÐ´µÄFirewall HOWTO×÷ÁËÔö¶©£¬Ï£ÍûÕâÆªÎÄÕÂÌá¹©ÁË×ã¹»µÄ×ÊÁÏ£¬Ê¹ÄãÄÜÔÚ¼¸Ð¡Ê±ÄÚ¾ÍÄÜÉè¶¨Ò»¸ö¿ÉÒÔÔË×÷µÄ·À»ðÇ½£¬¶ø²»ÔÙÐèÒª»¨¼¸ÐÇÆÚÖ®¾Ã¡£
ÎÒÒ²ÈÏÎªÎÒÓ¦¸ÃÂÔ¾¡ÃàÁ¦£¬»Ø±¨°®ºÃLinuxµÄÅóÓÑ¡£




\subsection{ÓÐ´ýÍê³ÉµÄ¹¤×÷}

\begin{itemize}
\item Ö¸µ¼ÈçºÎÉè¶¨¿Í»§»ú
\item Ñ°ÕÒÄÜÓëLinux´îÅäµÄUDP´úÀíËÅ·þÆ÷
\end{itemize}





\subsection{ÑÓÉì¶ÁÎï}

\begin{itemize}
\item NET-2 HOWTO
\item Ethernet HOWTO
\item Multiple Ethernet Mini HOWTO
\item LinuxµÄÁªÍø
\item  PPP HOWTO
\item O'Reilly and Associates³ö°æµÄTCP/IP Network Administrator's Guide 
\item TIS Firewall ToolkitµÄÎÄ¼þ
\end{itemize}


ÔÚTrusted Information System (TIS) ÍøÖ·ÉÏÊÕ¼¯ÁËÐí¶àÓÐ¹Ø·À»ðÇ½µÄÎÄ¼þºÍÏà¹Ø²ÄÁÏ¡£{\bfseries http://www.tis.com/}

´ËÍâ£¬ÎÒÒ²ÕýÔÚ´ÓÊÂÒ»Ïî³ÆÎª{\itshape Linux°²È«£¨Secure Linux£©\/}µÄÏîÄ¿¡£ÔÚ{\itshape Secure Linux\/}ÍøÖ·ÉÏ£¬ÎÒÊÕ¼¯ÁËËùÓÐÊ¹Linux°²È«¿É¿¿µÄ×ÊÁÏ¡¢ÎÄ¼þºÍ³ÌÊ½¡£Èç¹ûÄãÐèÒªÕâ·½ÃæµÄ×ÊÁÏ£¬ÇëÀ´ÐÅË÷È¡¡£




\section{Ê²Ã´ÊÇ·À»ðÇ½}

·À»ðÇ½ÊÇÆû³µÖÐÒ»¸ö²¿¼þµÄÃû³Æ¡£ÔÚÆû³µÖÐ£¬ÀûÓÃ·À»ðÇ½°Ñ³Ë¿ÍºÍÒýÇæ¸ô¿ª£¬ÒÔ±ãÆû³µÒýÇæÒ»µ©Öø»ð£¬·À»ðÇ½²»µ«ÄÜ±£»¤³Ë¿Í°²È«£¬¶øÍ¬Ê±»¹ÄÜÈÃË¾»ú¼ÌÐø¿ØÖÆÒýÇæ¡£
ÔÚµçÄÔÖÐ£¬·À»ðÇ½ÊÇÒ»ÖÖ×°ÖÃ£¬¿ÉÊ¹¸ö±ðÍøÂ·²»ÊÜ¹«¹²²¿·Ö£¨Õû¸öÍø¼ÊÍøÂ·£©µÄÓ°Ïì¡£
´Ëáá£¬ÎÄÖÐ½«·À»ðÇ½µçÄÔ³ÆÎª¡°·À»ðÇ½¡±£¬ËüÄÜÍ¬Ê±Á¬½ÓÊÜµ½±£»¤µÄÍøÂ·ºÍÍø¼ÊÍøÂ·Á½¶Ë¡£µ«ÊÜµ½±£»¤µÄÍøÂ·ÎÞ·¨½Óµ½Íø¼ÊÍøÂ·£¬Íø¼ÊÍøÂ·Ò²ÎÞ·¨½Óµ½ÊÜµ½±£»¤µÄÍøÂ·¡£
Èç¹ûÒª´ÓÊÜµ½±£»¤µÄÍøÂ·ÄÚ²¿½Óµ½Íø¼ÊÍøÂ·£¬¾ÍµÃtelnetµ½·À»ðÇ½£¬È»áá´Ó·À»ðÇ½ÁªÉÏÍø¼ÊÍøÂ·¡£
×î¼òµ¥µÄ·À»ðÇ½ÊÇdual homedÏµÍ³£¨¾ßÓÐÁ½¸öÍøÂ·Áª½áµÄÏµÍ³£©¡£Èç¹ûÄãÄÜÏàÐÅËùÓÐÄãµÄÓÃ»§£¬ÄÇÄãÖ»Òª×°ÉèÒ»Ì¨Linux£¨Éè¶¨Ê±½« IP forwarding/gatewaying ÉèÎª OFF£©£¬²¢ÈÃÃ¿ÈËÉèÒ»ÕÊ»§¡£ËûÃÇËæááÄÜµÇÂ¼ÕâÒ»ÏµÍ³£¬Ê¹ÓÃtelnet¡¢FTP£¬ÔÄ¶Áµç×Óº¯¼þºÍÊ¹ÓÃËùÓÐÄãÌá¹©µÄÈÎºÎÆäËû·þÎñ¡£¸ù¾ÝÕâÏîÉèÖÃ£¬ÕâÒ»ÍøÂ·ÖÐÎ¨Ò»ÄÜÓëÍâ½çÁªÏµµÄµçÄÔ±ãÊÇÕâ¸ö·À»ðÇ½¡£ÔÚÕâ¸öÍøÂ·ÖÐµÄÆäËûµçÄÔÉõÖÁ²»ÐèÒªÒ»Ìõ¹«ÓÃµÄÂ·¾¶¡£
ÐèÒªÔÙ´ÎËµÃ÷¡ÃÒªÊ¹ÉÏÊö·À»ðÇ½·¢»Ó×÷ÓÃ£¬{\bfseries ¾Í±ØÐëÏàÐÅËùÓÐÓÃ»§£¡}²»¹ý£¬ÎÒ¿É²»¸ÒÕâÃ´½¨Òé¡£




\subsection{·À»ðÇ½µÄÈ±ÏÝ}

ÓÃÓÚ¹ýÂËÖ®ÓÃµÄ·À»ðÇ½µÄÎÊÌâÊÇÕâÖÖ·À»ðÇ½²»ÈÃÍø¼ÊÍøÂ·½øÈëÄãµÄÍøÂ·¡£Ö»ÓÐÍ¨¹ý¹ýÂË·À»ðÇ½²ÅÄÜÈ¡ÓÃ¹¦ÄÜ¡£ÔÚÓÐ´úÀíËÅ·þÆ÷µÄÇé¿öÏÂ£¬ÓÃ»§¿ÉµÇÂ¼µ½·À»ðÇ½£¬È»áá½øÈëË½ÓÐÍøÂ·ÄÚµÄÈÎºÎÏµÍ³¡£
´ËÍâ£¬Ä¿Ç°¼¸ºõÃ¿Ìì¶¼ÓÐÐÂÐÍ¿Í»§»úºÍËÅ·þÆ÷ÉÏÊÐ¡£Òò´Ë£¬µÃÒªÓÐÐÂµÄ·½·¨½øÈëÍøÂ·²ÅÄÜµ÷ÓÃÕâÐ©¹¦ÄÜ¡£




\subsection{·À»ðÇ½µÄÖÖÀà}

·À»ðÇ½ÓÐÁ½ÖÖ¡£

\begin{enumerate}
\item IP¹ýÂË·À»ðÇ½ - ³ýÒ»Ð©ÍøÂ·¹¦ÄÜÍâ×èµ²Ò»ÇÐÁªÍø¹¦ÄÜ¡£
\item ´úÀíËÅ·þÆ÷ - ÌæÄã½øÐÐÍøÂ·Áª½á¡£
\end{enumerate}





\subsubsection{IP¹ýÂË·À»ðÇ½}

IP¹ýÂË·À»ðÇ½ÔÚÊý¾Ý°üÒ»²ã¹¤×÷¡£ËüÒÀ¾ÝÆðµã¡¢ÖÕµã¡¢²ººÅºÍÃ¿Ò»Êý¾Ý°üÖÐËùº¬µÄÊý¾Ý°üÖÖÀàÐÅÏ¢¿ØÖÆÊý¾Ý°üµÄÁ÷¶¯¡£
ÕâÖÖ·À»ðÇ½·Ç³£°²È«£¬µ«ÊÇÈ±ÉÙÓÐÓÃµÄµÇÂ¼¼ÇÂ¼¡£Ëü×èµ²±ðÈË½øÈë¸ö±ðÍøÂ·£¬µ«Ò²²»¸æËßÄãºÎÈË½øÈëÄãµÄ¹«¹²ÏµÍ³£¬»òºÎÈË´ÓÄÚ²¿½øÈëÍø¼ÊÍøÂ·¡£
¹ýÂË·À»ðÇ½ÊÇ¾ø¶ÔÐÔµÄ¹ýÂËÏµÍ³¡£¼´Ê¹ÄãÒªÈÃÍâ½çµÄÒ»Ð©ÈË½øÈëÄãµÄË½ÓÐËÅ·þÆ÷£¬ÄãÒ²ÎÞ·¨ÈÃÃ¿Ò»¸öÈË½øÈëËÅ·þÆ÷¡£
Linux´Ó1.3.x°æ¿ªÊ¼¾ÍÔÚÄÚºËÖÐ°üº¬ÁËÊý¾Ý°ü¹ýÂËÈí¼þ¡£




\subsubsection{´úÀíËÅ·þÆ÷}

´úÀíËÅ·þÆ÷ÔÊÐíÍ¨¹ý·À»ðÇ½¼ä½Ó½øÈëÍø¼ÊÍøÂ·¡£×îºÃµÄÀý×ÓÊÇÏÈtelnetÏµÍ³£¬È»áá´Ó¸Ã´¦ÔÙtelnetÁíÒ»¸öÏµÍ³¡£ÔÚÓÐ´úÀíËÅ·þÆ÷µÄÏµÍ³ÖÐ£¬ÕâÏî¹¤×÷¾ÍÍêÈ«×Ô¶¯¡£ÀûÓÃ¿Í»§¶ËÈí¼þÁ¬½Ó´úÀíËÅ·þÆ÷áá£¬´úÀíËÅ·þÆ÷Æô¶¯ËüµÄ¿Í»§¶ËÈí¼þ£¨´úÀí£©£¬È»áá´«»ØÊý¾Ý¡£
ÓÉÓÚ´úÀíËÅ·þÆ÷ÖØ¸´ËùÓÐÍ¨Ñ¶£¬Òò´ËÄÜ¹»¼ÇÂ¼ËùÓÐ½øÐÐµÄ¹¤×÷¡£
Ö»ÒªÅäÖÃÕýÈ·£¬´úÀíËÅ·þÆ÷¾Í¾ø¶Ô°²È«£¬Õâ×îËü×î¿ÉÈ¡Ö®´¦¡£Ëü×èµ²ÈÎºÎÈË½øÈë£¬ÒòÎªÃ»ÓÐÖ±½ÓµÄIPÍ¨Â·¡£




\section{ÉèÖÃ·À»ðÇ½}


\subsection{Ó²¼þÐèÇó}

                            
ÔÚ¡õÀýÖÐ£¬ËùÓÃµÄµçÄÔÅäÖÃÊÇÒ»¿é486-DX66Ð¾Æ¬£¬16MÄÚ´æºÍ500M Linux·Ö¸î¡£ÏµÍ³ÄÚ»¹×°ÁËÁ½ÕÅÍøÂ·¿¨£¬Ò»ÕÅÁ¬µ½Ë½ÓÐÍøÂ·£¬ÁíÒ»ÕÅ½Óµ½Ò»¸ö³ÆÎª¡°·Ç¾üÊÂÇø¡±µÄÍøÂ·£¨Òë×¢£ºÖ¸¹«ÓÃÍøÂ·£©£¬¶øÔÚÕâ¸ö·Ç¾üÊÂÇøµÄÍøÂ·ÉÏ£¬ÓÐÒ»¸ö½Óµ½Íø¼ÊÍøÂ·µÄÂ·ÓÉÆ÷£¨router£©¡£
ÕâÖÖÅäÖÃ¼«Îª³£¼û£¬ÉõÖÁ»¹¿ÉÓÃÒ»ÕÅÍø¿¨ºÍÒ»Ì¨Êý¾Ý»úÍ¨¹ýPPP½Óµ½Íø¼ÊÍøÂ·£¬µ«¹Ø¼üÖ®´¦ÊÇ·À»ðÇ½ÉÏ±ØÐëÓÐÁ½¸öIPºÅÂë¡£
²»ÉÙÈË¼ÒÖÐ¶¼ÓÐÐ¡ÍøÂ·£¬°ÑÁ½¡¢ÈýÌ¨µçÄÔ½ÓÔÚÒ»Æð¡£²»·ÁÊÔÊÔ°ÑËùÓÐÊý¾Ý»ú¶¼½ÓÔÚÅÜLinuxµÄµçÄÔÉÏ£¨ÀÏ¾ÉµÄ386»ú£©£¬È»ááÀûÓÃ¸ºÔØÆ½ºâµÄ·½Ê½°ÑÊý¾Ý»ú¶¼½Óµ½Íø¼ÊÍøÂ·¡£ÀûÓÃÕâÖÖ×°ÖÃ£¬Èç¹ûÒª´«ÊäÊý¾Ý£¬Á½²¿Êý¾Ý»úÍ¬Ê±¹¤×÷£¬¿É¼Ó±¶´«ÊäµÄËÙ¶È¡£




\section{ÉèÖÃ·À»ðÇ½µÄÈí¼þ}


\subsection{ÏÖÓÐµÄÌ××°Èí¼þ}

Èç¹ûÖ»ÒªÉèÖÃÒ»¸ö¹ýÂË·À»ðÇ½£¬ÄÇÖ»ÒªLinuxºÍ»ù±¾ÍøÂ·Èí¼þ¾Í¹»ÁË¡£ÓÐÒ»Ì×Èí¼þ¿ÉÄÜ²»ÔÚÄãÊ¹ÓÃµÄLinux°æ±¾ÖÐ£¬³ÆÎª IP Firewall Administration¹¤¾ß¡£
(IPFWADM) ¿É´Ó {\bfseries http://www.xos.nl/linux/ipfwadm/}È¡µÃ¡£
Èç¹ûÒªÉèÖÃ´úÀíËÅ·þÆ÷£¬¾ÍÐèÒªÒ»¸öÕâÖÖÌ××°Èí¼þ¡£
\begin{enumerate}
\item SOCKS
\item TIS Firewall Toolkit (FWTK)
\end{enumerate}





\subsection{TIS Firewall Toolkit ºÍSOCKS¼äµÄ²îÒì}

Trusted Information System ({\bfseries http://www.tis.com})Ìá¹©ÁËÒ»ÏµÁÐÈí¼þ£¬ÓÃÒÔ¼ò»¯°²×°·À»ðÇ½µÄ¹¤×÷¡£
ÕâÐ©Èí¼þ»ù±¾ÉÏÍ¬SOCKSµÄÈí¼þÏàÍ¬£¬µ«Éè¼Æ²ßÂÔ²»Í¬¡£SOCKSÀûÓÃÒ»Ì×Èí¼þÖ´ÐÐËùÓÐÓëInternetÓÐ¹ØµÄ¹¤×÷£¬¶øTIS¶ÔÃ¿Ò»¸öÏ£ÍûÊ¹ÓÃ·À»ðÇ½µÄutility¶¼Ìá¹©Ò»¸öÈí¼þ¡£
ÎªÁËËµÃ÷Á½ÕßÖ®¼äµÄ²»Í¬£¬¾ÍÒÔworld wide webºÍTelnetÎªÀý°É£¡ÔÚSOCKSÖÐ£¬Éè¶¨Ò»¸öÉèÖÃ£¨configuration£©µµºÍÒ»¸ödaemonáá£¬telnetºÍWWW¶¼ÄÜ¿ªÊ¼¹¤×÷£¬Í¬Ê±ÆäËûÃ»ÓÐ¹Ø±ÕµÄ¹¦ÄÜÒ²¶¼ÄÜ¹»ÔË×÷¡£
µ«ÔÚTISÖÐ£¬ÎªWWWºÍtelnet¶¼µÃÉè¶¨¸÷×ÔµÄconfigurationµµºÍdaemon¡£¾­´ËÉè¶¨áá£¬ÆäËûinternetµÄ¹¦ÄÜÈÔÎÞ·¨ÔËÓÃ£¬³ý·Ç¶ÔÕâÐ©¹¦ÄÜÒ²×÷³öÏà¹ØµÄÉè¶¨¡£Èç¹ûÄ³Ò»¹¦ÄÜ£¨ÀýÈçtalk£©Ã»ÓÐdaemon£¬ËäÈ»ÓÐ{\tt\char`\"}plug-in{\tt\char`\"} daemon¿ÉÓÃ£¬µ«Ëü²»ÏñÆäËû¹¤¾ßÄÇÑùÁé»î£¬¶øÇÒÒ²²»Ò×Éè¶¨¡£
ÕâËÆºõÊÇÐ¡ÊÂ£¬µ«ÇÒ´óÓÐ²î±ð¡£ÉèÖÃSOCKSÊ±±È½Ï¿ÉÒÔËæÒâ¡£Èç¹ûSOCKSËÅ·þÆ÷µÄÉèÖÃ²»Ì«ÍêÃÀ£¬´ÓÍøÂ·ÄÚ²¿¿ÉÒÔµ÷ÓÃÔ­ÏÈ²¢²»´òËãÌá¹©µÄinternet¹¦ÄÜ¡£ÈçÊ¹ÓÃTIS£¬´ÓÍøÂ·ÄÚ²¿Ö»ÄÜµ÷ÓÃÏµÍ³¹ÜÀíÕß¹æ¶¨µÄ¹¦ÄÜ¡£
SOCKSÒ×ÓÚÉè¶¨¡¢Ò×ÓÚ±à¼­£¬²¢ÇÒÁé»îÐÔ½Ï¸ß¡£ÈçÒª¹ÜÖÆÊÜµ½±£»¤µÄÍøÂ·ÄÚµÄÊ¹ÓÃÕß£¬ÔòTISµÄ°²È«ÐÔ½Ï¸ß¡£²»¹ýÁ½Õß¶¼Ìá¹©ÁË¾ø¶Ô±£»¤£¬Íâ½çÎÞ·¨½øÈë¡£
ÎÒ»áËµÃ÷Á½ÕßµÄ°²×°ºÍÉè¶¨·½·¨¡£




\section{Éè¶¨LinuxÏµÍ³}


\subsection{±à¼­ÄÚºË}

Ê×ÏÈÀûÓÃLinux°æ±¾ÖØÐÂ°²×°LinuxÏµÍ³£¨ÎÒÓÃRedHat 3.0.3£¬´ËááÊµÀý¾ùÒÔÕâÒ»°æ±¾Îª×¼£©¡£ÏµÍ³ÖÐ°²×°µÄÈí¼þÔ½ÉÙ£¬Ã«²¡ºÍÂ©¶´Ò²Ô½ÉÙ£¬ÒòÎªÕâÐ©Ã«²¡ºÍÂ©¶´¶ÔÏµÍ³µÄ°²È«¶¼»á²úÉúÎÊÌâ£¬ËùÒÔÖ»Òª°²×°¹»ÓÃµÄ×îÉÙÁ¿Èí¼þ¼´¿É¡£
Ñ¡ÓÃÒ»¸öÎÈ¶¨µÄÄÚºË¡£ÎÒµÄÏµÍ³ÓÃÁËLinux 2.0.14µÄÄÚºË¡£        Òò´Ë£¬Õâ·ÝÎÄ¼þÒÔÕâÖÖÄÚºËÉèÖÃÎª»ù´¡¡£
¸ù¾ÝÊÊµ±µÄÑ¡Ïî£¨options£©ÖØÐÂ±à¼­ÄÚºË¡£ Èç¹ûÒÔÇ°Ã»ÓÐ¶Á¹ýKernel HOWTO¡¢ Ethernet HOWTOºÍNET-2 HOWTO£¬´ËÊ±²»·ÁÀûÓÃÕâ¸ö»ú»á¶ÁÒ»¶ÁÕâÐ©HOWTO¡£ 
ÒÔÏÂÊÇÔÚ¡®make config¡¯ÄÚÓëÍøÂ·ÓÐ¹ØµÄÉè¶¨¡£ 
\begin{enumerate}
\item ÔÚGeneral setupÖÐ
\begin{enumerate}
\item ÉèNetworking Support ÎªON
\end{enumerate}
\item ÔÚNetworking OptionsÖÐ
\begin{enumerate}
\item ÉèNetwork firewallsÎª ON
\item ÉèTCP/IP NetworkingÎª ON
\item ÉèIP forwarding/gatewayingÎª OFF £¨³ý·ÇÒªÓÃIP¹ýÂË£©
\item ÉèIP FirewallingÎªON
\item ÉèIP firewall packet logginÎª ON£¨²»ÊÇ±ØÐè£¬ÉèÁË¸üºÃ£©
\item ÉèIP: masquerading ÎªOFF£¨²»Êô±¾ÎÄ·¶Î§£©
\item ÉèIP: accounting ÎªON
\item ÉèIP: tunneling ÎªOFF
\item ÉèIP: aliasing ÎªOFF
\item ÉèIP: PC/TCP compatibility mode ÎªOFF
\item Éè IP: Reverse ARP ÎªOFF
\item ÉèDrop source routed frames ÎªON
\end{enumerate}
\item ÔÚNetwork device supportÏîÏÂ
\begin{enumerate}
\item ÉèNetwork device support ÎªON
\item ÉèDummy net driver support ÎªON
\item ÉèEthernet (10 or 100Mbit) ÎªON
\item Ñ¡ÔñÍøÂ·¿¨
\end{enumerate}
\end{enumerate}

ÏÖÔÚÖØÐÂ±à¼­£¬ÖØÐÂ°²×°ÄÚºË£¬ÖØÐÂÆô¶¯¡£ÍøÂ·¿¨Ó¦ÔÚÆô¶¯µÄÌáÊ¾ÖÐÏÔÊ¾¡£Èç¹ûÃ»ÓÐ×¥µ½ÍøÂ·¿¨£¬²éÔÄÆäËûHOWTO£¬Ö±µ½Éè¶ÔÎªÖ¹¡£   




\subsection{Éè¶¨Á½ÕÅÍøÂ·¿¨}

µçÄÔÖÐÈçÓÐÁ½ÕÅÍøÂ·¿¨£¬¼«¿ÉÄÜÐèÒªÔÚ/etc/lilo.confµµÖÐÔö¼ÓÒ»ÐÐ£¬ËµÃ÷Á½ÕÅÍøÂ·¿¨µÄIRQºÍµØÖ·¡£ÔÚÎÒµÄ»úÆ÷ÖÐ£¬lilo.confµµÔö¼ÓµÄÒ»ÐÐÈçÏÂ¡Ã
\begin{verbatim}
    append="ether=12,0x300,eth0 ether=15,0x340,eth1"
\end{verbatim}





\subsection{Éè¶¨Network Addresses}



Õâ²¿·Ö±È½ÏÓÐÈ¤£¬¶øÇÒµÃÒª×öÐ©¾ö¶¨¡£ÓÉÓÚ²»´òËãÈÃÍø¼ÊÍøÂ·½øÈë×ÔÉèÍøÂ·µÄÈÎºÎ²¿·Ö£¬Òò´ËÍøÂ·ÖÐ²»ÐèÒªÓÃÊµ¼ÊµÄÍøÖ·¡£ÔÚÍø¼ÊÍøÂ·ÖÐÁôÁËÒ»Ð©µØÖ·¿ÉÈÃÍøÂ·ËæÒâÊ¹ÓÃ£¬ÒòÎª×ÔÉèÍøÂ·×ÜµÃÐèÒªµØÖ·£¬¶øÇÒÕâÐ©µØÖ·Ò²ÎÞ·¨½øÈëÍø¼ÊÍøÂ·£¬½Á»ëÈ«¾Ö¡£Òò´Ë²»·ÁÑ¡ÓÃÕâÐ©µØÖ·¡£
ÔÚÕâÐ©µØÖ·ÖÐ£¬192.168.2.xxxÊÇ±»ÁôÓÃµÄµØÖ·£¬Òò´Ë¾ÍÓÃÕâÐ©µØÖ·À´×÷ËµÃ÷¡£

ÓÉÓÚ´úÀíËÅ·þÆ÷Í¬Ê±Éí´¦Á½¸öÍøÂ·£¬Òò´ËËüÄÜ¾ÓÖÐ´«ËÍÁ½±ßµÄÊý¾Ý¡£

\begin{verbatim}
            199.1.2.10   __________    192.168.2.1
     _  __  _        \ |         | /         _______________
   | \/  \/ |             \|        |/          |            |          
     Íø¼ÊÍøÂ· \-------------| ·À»ðÇ½ |-------------------| ¹¤×÷Õ¾     |
     \_/\_/\_/\_/          |_________|           |______________|
\end{verbatim}

ÈçÒªÉèÖÃ¹ýÂË·À»ðÇ½£¬ÒÀ¾É¿ÉÓÃÕâÐ©ÍøÖ·£¬²»¹ýµÃÊ¹ÓÃIP masquerading¡£¾­¹ýÕâÖÖÉè¶¨£¬·À»ðÇ½¾Í»á×ªËÍÊý¾Ý°ü£¬²¢¼Ó¸½Êµ¼ÊµÄIPµØÖ·ËÍÍùÍø¼ÊÍøÂ·¡£
ÔÚÍøÂ·¿¨µÄÍø¼ÊÍøÂ·¶Ë£¨Íâ¶Ë£©µÃÉè¶¨ÕæÕýµÄIPµØÖ·£¬ÔÚÒÔÌ«Íø¿¨µÄÄÚ¶ËÉèÎª192.168.2.1¡£ÕâÊÇÕâÌ¨µçÄÔ´úÀí/Íø¹ØµÄIPµØÖ·¡£ÊÜ±£»¤µÄÍøÂ·ÄÚµÄËùÓÐÆäËûµçÄÔ¾ù¿ÉÑ¡ÓÃ192.168.2.xxxÖÐµÄÈÎºÎÒ»¸ö×÷ÎªµØÖ·£¨´Ó192.168.2.2 µ½192.168.2.254£©¡£
ÔÚRedHat Linux ÖÐ£¬µÃÔÚ /etc/sysconfig/network-scriptsÄ¿Â¼ÏÂÔö¼ÓÒ»¸öifcfg-eth1µµ£¬ÒÔ±ãÔÚÆô¶¯Ê±£¬Í¨¹ýÕâ¸öµµÉè¶¨ÍøÂ·ºÍrouting±í¡£
ifcfg-eth1µÄ²ÎÊý¿ÉÉè¶¨ÈçÏÂ¡Ã
\begin{verbatim}
    #!/bin/sh
    #>>>Device type: ethernet
    #>>>Variable declarations:
    DEVICE=eth1
    IPADDR=192.168.2.1
    NETMASK=255.255.255.0
    NETWORK=192.168.2.0
    BROADCAST=192.168.2.255
    GATEWAY=199.1.2.10
    ONBOOT=yes
    #>>>End variable declarations
\end{verbatim}

¿ÉÊÔÓÃÕâÐ©²ÎÊýÊ¹Êý¾Ý»úÓëISP×Ô¶¯Á¬½Ó¡£²»·Á¿´¿´ ipup-pppµµ¡£
ÈçÓÃÊý¾Ý»úÓëÍø¼ÊÍøÂ·Á¬½Ó£¬ISP»áÔÚÁ¬½ÓÊ±Ö¸¶¨Íâ¶ËµÄIPµØÖ·¡£




\subsection{²âÊÔÍøÂ·}

´Ó²âÊÔifconfigºÍroute¿ªÊ¼¡£Èç»úÆ÷ÉÏÓÐÁ½ÕÅÍøÂ·¿¨£¬¸÷ÏîÉèÖÃÓ¦ÓÐÈçÏÂÇé¿ö¡Ã
\begin{verbatim}
  #ifconfig
  lo        Link encap:Local Loopback
            inet addr:127.0.0.0  Bcast:127.255.255.255  Mask:255.0.0.0
            UP BROADCAST LOOPBACK RUNNING  MTU:3584  Metric:1
            RX packets:1620 errors:0 dropped:0 overruns:0
            TX packets:1620 errors:0 dropped:0 overruns:0

  eth0      Link encap:10Mbps Ethernet  HWaddr 00:00:09:85:AC:55
            inet addr:199.1.2.10 Bcast:199.1.2.255  Mask:255.255.255.0
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:0 errors:0 dropped:0 overruns:0
            TX packets:0 errors:0 dropped:0 overruns:0
            Interrupt:12 Base address:0x310

  eth1      Link encap:10Mbps Ethernet  HWaddr 00:00:09:80:1E:D7
            inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:0 errors:0 dropped:0 overruns:0
            TX packets:0 errors:0 dropped:0 overruns:0
            Interrupt:15 Base address:0x350
\end{verbatim}

route ±íÓ¦¿´ÆðÀ´ÈçÏÂ¡Ã
\begin{verbatim}
#route -n
Kernel routing table
Destination   Gateway   Genmask    Flags  MSS  Window  Use  Iface
199.1.2.0     *       255.255.255.0   U   1500   0      15 eth0
192.168.2.0   *       255.255.255.0   U   1500   0       0 eth1
127.0.0.0     *       255.0.0.0      U   3584   0       2 lo
default      199.1.2.10   *          UG  1500   0       72 eth0
\end{verbatim}


{\bfseries ×¢¡Ã} 199.1.2.0ÔÚ·À»ðÇ½µÄÍø¼ÊÍøÂ·¶Ë£¬192.168.2.0ÔÚ×ÔÉèÍøÂ·Ò»¶Ë¡£
Ê×ÏÈÊÔÊÔ´Ó·À»ðÇ½ping Íø¼ÊÍøÂ·¡£²»·Á°Ñnic.ddn.mil×÷ÊÔÑéµã¡£Õâ¸öÊÔÑéµã»¹²»´í£¬Ö»ÊÇ²»ÈçÎÒÔ¤ÆÚµÄ¿É¿¿¡£Èç¹ûÃ»ÁªÉÏ£¬ÊÔÊÔping¼¸¸ö²»ÊÇÄãÍøÂ·ÉÏµÄµØÖ·¡£Èç¹ûÈÔÁª²»ÉÏ£¬ÔòPPPµÄÉè¶¨Ò»¶¨²»¶Ô¡£ÔÙ¶ÁÒ»´ÎNet-2 HOWTO£¬È»ááÔÙÊÔ¡£
È»áá£¬ÊÔÑé´Ó·À»ðÇ½ping±£»¤ÍøÂ·ÄÚµÄµçÄÔ¡£ËùÓÐÍøÂ·ÄÚµÄµçÄÔÓ¦ÄÜpingÍøÂ·ÄÚµÄÈÎºÎÆäËûÒ»Ì¨µçÄÔ¡£Èç¹û²»ÐÐ£¬ÔÙ¶Á¶ÁNet-2 HOWTO£¬ÔÙÊÔÒ»´Î¡£
½ÓÖøÊÔÑé´Ó±£»¤ÍøÂ·ÄÚping·À»ðÇ½ÒÔÍâµÄµØÖ·¡££¨×¢Òâ¡Ã²»ÊôÓÚ192.168.2.xxxµÄÈÎºÎµØÖ·£©Èç¹û¿ÉÒÔ£¬±íÊ¾IP ForwardingµÄ¹¦ÄÜÃ»ÓÐÈ¡Ïû¡£ÏëÒ»ÏëÕâÊÇ·ñ·ûºÏÔ­ÏÈµÄ¹¹Ïë¡£Èç¹û±£ÁôIP ForwardingµÄ¹¦ÄÜ£¬¾Í±ð·Å¹ýÏÂÃæÉè¶¨IP filteringµÄ²¿·Ö¡£
ÏÖÔÚÊÔÊÔ´Ó·À»ðÇ½ááping Íø¼ÊÍøÂ·¡£ÀûÓÃÒÔÇ°ÊÔÍ¨µÄÍ¬Ò»µØÖ·£¨ÀýÈç£¬nic.ddn.mil£©¡£Èç¹û IP Forwarding¹¦ÄÜÒÑ¾­È¡Ïû£¬¾Í²»Ó¦½ÓÍ¨¡£²»¹ýÈç¹ûÕâÏî¹¦ÄÜÃ»ÓÐÈ¡Ïû£¬¾ÍÓ¦¸Ã½ÓÍ¨¡£
¼ÙÉè±£ÁôÁËIP Forwarding¹¦ÄÜ£¬¶øÔÚ×ÔÉèµÄÍøÂ·ÖÐÊ¹ÓÃÊµ¼ÊµÄIPµØÖ·£¨²»ÊÇ192.168.2.*£©£¬ÔÚÕâÖÖÉè¶¨ÏÂ£¬Èç¹ûÎÞ·¨ping Íø¼ÊÍøÂ·£¬µ«ÄÜ¹»pingÍø¼ÊÍøÂ·±ßµÄ·À»ðÇ½£¬¾ÍµÃ¼ì²éÉÏÒ»²ãµÄrouterÓÐ·ñ°ÑÊý¾Ý°ü´«ËÍµ½×ÔÉèÍøÂ·µÄµØÖ·ÉÏ¡££¨¿ÉÄÜµÃÓÉISP×÷ÕâÏî¼ì²é£©
Èç¹û±£»¤ÍøÂ·µÄµØÖ·¶¨Îª192.168.2.*£¬ÔòÈÎºÎÊý¾Ý°ü¶¼²»ÄÜ´«ËÍ¡£Èç¹ûÃ»ÓÐ×÷ÕâÐ©Éè¶¨£¬¶øÊ¹ÓÃÁËIP masquerading£¬ÕâÏîÊÔÑéÓ¦¸Ã³É¹¦¡£
ÖÁ´Ë£¬¸÷ÏîÉè¶¨»ù±¾Íê³É¡£




\subsection{¼Ó¹Ì·À»ðÇ½}

Èç¹ûÍ¨¹ý·À»ðÇ½ÉÏÃ»ÓÐÊ¹ÓÃµÄ¹¦ÄÜÄÜ¹»ËæÒâ½ø³ö·À»ðÇ½£¬ÔòÕâÖÖ·À»ðÇ½Ò²¾ÍÃ»ÓÐÊ²Ã´ÓÃ´¦¡£ {\tt\char`\"}º§¿Í{\tt\char`\"} ÄÜµ½·À»ðÇ½ÄÚ×÷³ö±ØÒªµÄÐÞ¸Ä£¬¹©ÆäËùÓÃ¡£
Ê×ÏÈ¹Ø±ÕËùÓÐ²»ÓÃµÄ¹¦ÄÜ¡£ÏÈ¼ì²é /etc/inetd.confµµ¡£Õâ¸öµµ¿ØÖÆËùÎ½µÄ{\tt\char`\"}³¬¼¶ËÅ·þÆ÷{\tt\char`\"}¡£Ëü¿ØÖÆÁËÐí¶àËÅ·þÆ÷µÄdaemon£¬È»ááÔÚÐèÒªÊ±Æô¶¯ÕâÐ©daemon¡£
ÍêÈ«È¡Ïûnetstat¡¢ systat¡¢ tftp¡¢ bootpºÍfinger¹¦ÄÜ¡£È¡Ïû¹¦ÄÜµÄ·½·¨ÊÇ°Ñ\#×÷Îª¹¦ÄÜÐÐµÄÐÐÊ××ÖÄ¸¡£Éè¶¨Íê±Ïáá£¬¼üÈë{\bfseries {\tt\char`\"}kill -HUP $<$pid$>${\tt\char`\"}}£¬Ö´ÐÐSIG-HUP £¬ÆäÖÐ$<$pid$>$ÊÇinetdµÄ³ÌÐò±àºÅ¡£inetd»áÔÙ´Î¶ÁÈ¡ÅäÖÃµµ£¨inetd.conf£©£¬²¢´ÓÐÂÆô¶¯ÏµÍ³¡£
ÀûÓÃtelnet ²âÊÔ·À»ðÇ½µÄ²ººÅ£¨port£©15£¬ÕâÊÇnetstatµÄ²ººÅ¡£Èçnetstat»ØÓ¦ÍøÂ·Çé¿ö£¬ÏµÍ³²¢Ã»ÓÐ°´ÒªÇóÕýÈ·µØ´ÓÐÂÆô¶¯¡£




\section{IP filtering µÄÉèÖÃ(IPFWADM)}

Ê×ÏÈÉè¶¨ÄÚºËµÄIP Forwarding¹¦ÄÜ£¬ÏµÍ³Ó¦¿ªÊ¼×ªËÍÃ¿Ò»ÐÅÏ¢¡£Â·¾¶±í£¨routing table£©Ó¦ÒÑÉè¶¨£¬Òò´ËÓ¦¸Ã¿ÉÒÔÍ¨ÍùÈÎºÎµØµã£¬´ÓÍøÄÚ¿ÉÒÔÁªµ½ÍøÍâ£¬´ÓÍøÍâÒ²¿É½øµ½ÍøÄÚ¡£
µ«ÊÇ·À»ðÇ½µÄ×÷ÓÃÊÇ²»ÈÃÈÎºÎÈË¿ÉÒÔËæ±ã½ø³öÍøÂ·¡£ 
ÔÚÊ¾¡õÏµÍ³ÖÐÉè¶¨ÁËÁ½Ì×Ö¸Áî£¨script£©£¬¶Ô·À»ðÇ½µÄforwardingºÍaccounting×÷ÁË¹æ¶¨¡£ÏµÍ³ÔÚÔËÐÐ/etc/rc.dÊ±È¡ÓÃÕâÁ½Ì×Ö¸Áî£¬Òò´ËÔÚÏµÍ³Æô¶¯Ê±¾Í¶ÔÏµÍ³×÷ÁËÉèÖÃ¡£
LinuxµÄÄÚºË×ÔÉè×ªËÍÒ»ÇÐÐÅÏ¢µÄIP ForwardingÏµÍ³¡£Òò´Ë£¬·À»ðÇ½µÄÖ¸ÁîÓ¦Ê×ÏÈ½ûÖ¹Ò»ÇÐ½øÈëÏµÍ³µÄÈ¨Àû£¬Çå³ýÉÏ´ÎÔËÐÐááÁôÏÂµÄÈÎºÎipfw¹æÔò¡£ÏÂÃæµÄÖ¸ÁîÓ¦ÄÜ´ïµ½ÕâÏîÄ¿µÄ¡£

\begin{verbatim}
  #
  # setup IP packet Accounting and Forwarding
  #
  #   Forwarding
  #
  # By default DENY all services
  ipfwadm -F -p deny
  # Flush all commands
  ipfwadm -F -f
  ipfwadm -I -f
  ipfwadm -O -f
\end{verbatim}

ºÃÁË£¬ÏÖÔÚÓÐÁË¾ø¶Ô±£ÏÕµÄ·À»ðÇ½¡£Ò»ÇÐ¶¼±»ÆÁµ²ÔÚÍâÃæ£¬ÎÞ·¨´©Ô½·À»ðÇ½Ò»²½¡£µ±È»£¬ÓÐÐ©¹¦ÄÜ»¹ÊÇÐèÒªµÄ£¬ÏÂÃæµÄÒ»Ð©Àý×Ó¿É×÷²Î¿¼¡£
\begin{verbatim}
  # Forward email to your server ¡Ã×ªËÍµç×ÓÓÊ¼þµ½ËÅ·þÆ÷
  ipfwadm -F -a accept -b -P tcp -S 0.0.0.0/0 1024:65535 -D 192.1.2.10 25

  # Forward email connections to outside email servers ¡Ã½«µç×ÓÓÊ¼þÁ¬µ½ÍøÂ·ÍâµÄµç×ÓÓÊ¼þËÅ·þÆ÷
  ipfwadm -F -a accept -b -P tcp -S 196.1.2.10 25 -D 0.0.0.0/0 1024:65535

  # Forward Web connections to your Web Server¡Ã½«WebÁ¬µ½WebËÅ·þÆ÷
  /sbin/ipfwadm -F -a accept -b -P tcp -S 0.0.0.0/0 1024:65535 -D 196.1.2.11 80

  # Forward Web connections to outside Web Server¡Ã½«WebÁ¬µ½Íâ½çWebËÅ·þÆ÷
  /sbin/ipfwadm -F -a accept -b -P tcp -S 196.1.2.* 80 -D 0.0.0.0/0 1024:65535 

  # Forward DNS traffic¡Ã×ªËÍDNSÐÅÏ¢
  /sbin/ipfwadm -F -a accept -b -P udp -S 0.0.0.0/0 53 -D 196.1.2.0/24
\end{verbatim}

Èç¹ûÏëÖªµÀÍ¨¹ý·À»ðÇ½µÄÐÅÏ¢À´ÍùÇé¿ö£¬ÏÂÁÐÖ¸Áî»áÍ³¼ÆËùÓÐÊý¾Ý°ü¡£
\begin{verbatim}
                      
  # Flush the current accounting rules
  ipfwadm -A -f
  # Accounting
  /sbin/ipfwadm -A -f
  /sbin/ipfwadm -A out -i -S 196.1.2.0/24 -D 0.0.0.0/0
  /sbin/ipfwadm -A out -i -S 0.0.0.0/0 -D 196.1.2.0/24
  /sbin/ipfwadm -A in -i -S 196.1.2.0/24 -D 0.0.0.0/0
  /sbin/ipfwadm -A in -i -S 0.0.0.0/0 -D 196.1.2.0/24
\end{verbatim}


Èç¹ûÖ»°ÑµçÄÔÉèÎª¹ýÂË·À»ðÇ½£¬µ½ÕâÀï¾Í´ó¹¦¸æ³ÉÁË£¡






\section{°²×°TIS´úÀíËÅ·þÆ÷}




\subsection{È¡µÃÈí¼þ}

TIS FWTKÈí¼þ¿É´ÓÏÂÁÐÍøÖ·µÃµ½¡Ã{\bfseries ftp://ftp.tis.com/}.  
Ç§Íò¼Ç×¡¡Ã´ÓTISÏÂÔØÈí¼þáá£¬Ê×ÏÈÔÄ¶ÁREADME¡£TIS fwtk´æ·ÅÔÚËÅ·þÆ÷µÄÒ»¸öÒþ²ØÄ¿Â¼ÄÚ£¬ÐèÒª{\bfseries ·¢µç×ÓÓÊ¼þ¸øfwtk-request@tis.com} ²¢ÔÚÐÅÎÄÄÚÌîÈë{\bfseries SEND}²ÅÄÜµÃÖªÒþ²ØµÄÄ¿Â¼µÄÃû×Ö¡£SubjectÀ¸ÄÚ²»±ØÌîÈëÈÎºÎÄÚÈÝ¡£ÔÚ»Ø¸²µÄµç×ÓÓÊ¼þÄÚ»á¸æÖª´æ·ÅÈí¼þµÄÄ¿Â¼µÄÃû×Ö£¬ÓÐÐ§Ê±¼äÎª12Ð¡Ê±£¬µÃ¸Ï¿ìÏÂÔØ¡£
ÔÚ±àÐ´±¾ÎÄÊ±£¬FWTKµÄ×îÐÂ°æ±¾Îª2.0£¨beta£©¡£³ýÁË¼¸¸öÐ¡µØ·½Ö®Íâ£¬Õâ¸ö°æ±¾ÔÚ±à¼­Ê±Ã»ÓÐÎÊÌâ£¬ÔËÐÐÊ±Ò²Õý³££¬´Ë´¦¾ÍÒÔÕâÒ»°æ±¾ÎªÀý¡£ÈçÓÐ×îáá¶¨±¾Ê±£¬½«ÔÚÒÔááµÄHOWTOÖÐÔö¶©¡£
°²×°FWTKÊ±£¬Ê×ÏÈÔÚ /usr/srcÏÂ½¨Á¢fwtk-2.0Ä¿Â¼¡£½«FWTK£¨fwtk-2.0.tar.gz£©·ÅÔÚÕâ¸öÄ¿Â¼ÄÚ½âÑ¹£¨tar zxf fwtk-2.0.tar.gz£©¡£
FWTK²¢ÎÞ´úÀíSSLµÄÍøÂ·ÎÄ¼þ£¬Jean-Christophe TouvetÐ´ÁËÒ»Ð©¸½¼Ó×ÊÁÏ£¬¿É´Ó{\bfseries ftp://ftp.edelweb.fr/pub/contrib/fwtk/ssl-gw.tar.Z}È¡µÃ¡£
Eric WedelÐ´ÁËÐÞ¶©±¾£¬ÆäÖÐ°üÀ¨Ê¹ÓÃÍø¾°£¨Netscape£©µÄÐÂÎÅËÅ·þÆ÷¡£ÕâÌ×Èí¼þ¿É´ÓÏÂÁÐÍøÖ·È¡µÃ¡Ã{\bfseries ftp://mdi.meridian-data.com/pub/tis.fwtk/ssl-gw/ssl-gw2.tar.Z}
ÒÔÏÂÒÔEric WedelµÄ°æ±¾ÎªÀý¡£
Òª°²×°£¬Ö»ÒªÔÚ/usr/src/fwtk-2.0Ä¿Â¼ÄÚ½¨Á¢Ò»¸ö ssl-gwÄ¿Â¼£¬°ÑÎÄµµ·ÅÔÚÆäÖÐ¼´¿É¡£
ÔÚ°²×°Õâ¸öÍø¹ØÊ±£¬µÃÒª×÷Ð©¸Ä¶¯²ÅÄÜ½øÐÐ±à¼­¡£
Ê×ÏÈ¸Ä±ässl-gw.cµµ£¬ÆäÖÐÒÅÂ©ÁË±ØÒªµÄincludeµµ¡£
\begin{verbatim}
  #if defined(__linux)
  #include        <sys/ioctl.h>
  #endif
\end{verbatim}

Æä´Î£¬Ò²Ã»ÓÐMakefileµµ¡£²»·Á´ÓÆäËûÍø¹ØÄ¿Â¼¿½±´Ò»¸ö£¬È»áá½«Íø¹ØµÄÃû×Ö¸ÄÎªssl-gw¡£




\subsection{±à¼­TIS FWTK}

°æ±¾2.0µÄFWTK±ÈÒÔÍùÈÎºÎÒ»¸ö°æ±¾¶¼Ò×ÓÚ±à¼­¡£²»¹ýÔÚ±à¼­ÒÔÇ°»¹ÐèÒª¶ÔBETA°æ±¾×÷Ò»Ð©¸ü¶¯¡£Ï£ÍûÕâÐ©¸ü¶¯»á¼Ó¸½µ½×îáá¶¨±¾ÖÐ¡£
ÐÞ¸Ä·½·¨ÈçÏÂ¡ÃÊ×ÏÈ½øÈë/usr/src/fwtk/fwtkÄ¿Â¼£¬¿½±´Makefile.config.linuxµµ£¬ÒÔ´ËµµÌæ´úMakefile.configµµ¡£
{\bfseries ²»ÒªÔËÐÐFIXMAKE}¡£ËäÈ»ÔÚËµÃ÷ÖÐ½¨ÒéÖ´ÐÐÕâ¸ö³ÌÐò¡£µ«ÔËÐÐáá»áÆÆ»µÃ¿Ò»¸öÄ¿Â¼ÖÐµÄmakefile¡£
ÐÞ¸ÄfixmakeµÄ·½·¨ÊÇÔÚÃ¿Ò»¸öMakefileµÄsedÖ¸ÁîµÄincludeÐÐÖÐÌí¼Ó¡®.¡¯ºÍ"¡£°´ÏÂÀý¸ü¸Ä£¬±ã¿ÉÔËÐÐÎÞ°­¡£
\begin{verbatim}
  sed 's/^include[        ]*\([^  ].*\)/include \1/' $name .proto > $name 
\end{verbatim}

È»ááÐèÒª±à¼­Makefile.configµµ£¬µ«Ê×ÏÈµÃ×÷Á½ÏîÐÞ¸Ä¡£
Makefile.configµµÖÐµÄsourceÄ¿Â¼Ó¦¸ÄÎª½øÐÐ±à¼­µÄ/usr/src£¬Òò´ËFWTKSRCDIRÓ¦×÷ÏàÓ¦µÄ¸Ä±ä¡£
\begin{verbatim}
  FWTKSRCDIR=/usr/src/fwtk/fwtk
\end{verbatim}

ÓÐÐ©LinuxÏµÍ³Ê¹ÓÃgdbmÊý¾Ý¿â¡£Makefile.configÊ¹ÓÃdbm¡£ÀýÈç£¬RedHat 3.0.3¾ÍÊ¹ÓÃdbm£¬Òò´ËÐèÒª×÷³öÏàÓ¦¸ü¶¯¡£
\begin{verbatim}
  DBMLIB=-lgdbm
\end{verbatim}

×îááÐèÒª¸Äx-gw¡£BETA°æÄÚsocket.cÖÐµÄÏÂÁÐÊýÐÐ±ØÐèÉ¾³ý¡£
\begin{verbatim}
  #ifdef SCM_RIGHTS  /* 4.3BSD Reno and later */
                       + sizeof(un_name->sun_len) + 1
  #endif
\end{verbatim}

ÈçÔÚFWTKÔ´Ä¿Â¼ÖÐÌí¼Óssl-gw£¬ÔòÔÚMakefileµÄÄ¿Â¼µ¥ÖÐÒ²Òª¼ÓÉÏssl-gw¡£
\begin{verbatim}
  DIRS=   smap smapd netacl plug-gw ftp-gw tn-gw rlogin-gw http-gw x-gw ssl-gw
\end{verbatim}

Íê³ÉÉÏÊöÐÞ¸Äáá£¬ÔËÐÐ{\bfseries make}¡£




\subsection{°²×°TIS FWTK }

ÔËÐÐ{\bfseries make install}¡£
Ä¬ÈÏµÄ°²×°Ä¿Â¼ÊÇ/usr/local/etc¡£¿ÉÒÔ¸Äµ½¸ü¼Ó°²È«¿É¿¿µÄÄ¿Â¼½øÐÐ°²×°£¬µ«Ò²¿ÉÒÔ²»¸Ä£¬Ò²¿É½«ÆäÌØÈ¨¸ÄÎªchmod 700¡£
ÏÖÔÚ¿ªÊ¼Éè¶¨·À»ðÇ½¡£




\subsection{ÉèÖÃTIS FWTK}

ºÃ£¡ÏÂÃæ¾Í±È½ÏÓÐÈ¤ÁË£¡Éè¶¨µÄÏµÍ³ÒªÄÜµ÷ÓÃÕâÐ©ÐÂ¹¦ÄÜ£¬²¢½¨Á¢¹ÜÖÆ±í¹ÜÀíÕâÐ©¹¦ÄÜ¡£
ÒÔÏÂµÄËµÃ÷²¢²»ÊÇÎªÁËÒªÖØÐ´TIS FWTKµÄÊ¹ÓÃÊÖ²á£¬ÆäÄ¿µÄÖ»ÊÇÎªÁËÏÔÊ¾¿ÉÐÐµÄÉè¶¨¡¢¿ÉÄÜÓöµ½µÄÎÊÌâºÍ½â¾öµÄ°ì·¨¡£
ÓÐÈý¸öÎÄµµ×é³ÉÕâÐ©controls¡£

\begin{itemize}
\item /etc/services
\begin{itemize}
\item ¸æËßÏµÍ³Ëù¶¨¹¦ÄÜÔÚºÎ²ººÅ
\end{itemize}
\end{itemize}

\begin{itemize}
\item /etc/inetd.conf
\begin{itemize}
\item µ±·þÎñ²ºÓÐ¶¯×÷Ê±¸æËßinetdÆô¶¯ÄÇ¸ö³ÌÊ½
\end{itemize}
\end{itemize}

\begin{itemize}
\item /usr/local/etc/netperm-table
\begin{itemize}
\item ¸æËßFWTKÍ¬ÒâºÍ¾Ü¾øÀ´ÍùµÄÓÃ»§
\end{itemize}
\end{itemize}

ÒªFWTK·¢»Ó×÷ÓÃ£¬Ó¦³¹µ×±à¼­ÕâÐ©µµ°¸¡£±à¼­ÕâÐ©¹¦ÄÜµµ¶ø²»ÕýÈ·Éè¶¨ inetd.conf»ònetperm-table£¬¿ÉÄÜÊ¹ÏµÍ³ÍêÈ«ÎÞ·¨×÷ÓÃ¡£




\subsubsection{netperm-tableµµ}

Õâ¸öµµ¿ØÖÆºÎÈË¿ÉÒÔÊ¹ÓÃTIS FWTKµÄ¹¦ÄÜ¡£Ê×ÏÈÓ¦¸ÃÏëµ½·À»ðÇ½Á½±ßµÄÐèÇó¡£ÍøÂ·ÍâÃæµÄÓÃ»§ÔÚ½øÈëÍøÂ·Ö®Ç°Ó¦Ê×ÏÈ±íÃ÷Éí·Ý£¬µ«ÍøÂ·ÄÚ²¿µÄÓÃ»§Ôò¿ÉÖ±½ÓÍ¨¹ý¡£
ÔÚ±íÃ÷Éí·ÝÊ±£¬·À»ðÇ½Ê¹ÓÃÒ»¸ö³ÆÎª{\bfseries authsrv}µÄ³ÌÊ½£¬ÆäÖÐ´æÓÐÓÃ»§µÄIDºÍÃÜÂë¡£netperm-tableÖÐµÄauthentication²¿·Ö¿ØÖÆÕâÒ»Êý¾Ý¿â´æ·ÅºÎ´¦ºÍË­¿ÉÈ¡ÓÃ¡£
Òª²»ÈÃÈËÈ¡ÓÃÕâÒ»¹¦ÄÜ²¢²»ÈÝÒ×£¬ÔÚpremit-hostsÕâÒ»ÐÐÖÐÊ¹ÓÃ¡°*¡±£¬ÒÔÖÂÃ¿ÈË¶¼ÄÜÈ¡ÓÃÕâÒ»¹¦ÄÜ¡£ÕâÒ»ÐÐµÄÕýÈ·Éè¶¨Ó¦¸ÃÊÇ¡°{\ttfamily authsrv: premit-hosts localhost}¡±£¬µ«ËÆºõ²»Æð×÷ÓÃ¡£
\begin{verbatim}
  #
  # Proxy configuration table£º  ´úÀíËÅ·þÆ÷ÉèÖÃ±í
  #
  # Authentication server and client rules
  authsrv:      database /usr/local/etc/fw-authdb
  authsrv:      permit-hosts *
  authsrv:      badsleep 1200
  authsrv:      nobogus true
  # Client Applications using the Authentication server
  *:            authserver 127.0.0.1 114
\end{verbatim}

ÒªÆô¶¯Êý¾Ý¿â£¬ÒÔrootÔÚ/var/local/etcÄÚÔËÐÐ{\bfseries ./authsrv}£¬ÉèÁ¢¹ÜÀíÕßµÄÊ¹ÓÃ¼ÇÂ¼¡£Êµ¼Ê²Ù×÷ÈçÏÂ¡Ã
ÔÄ¶ÁFWTKÎÄµµÁË½âÈçºÎÌí¼ÓÓÃ»§ºÍÓÃ»§×é¡£
\begin{verbatim}
    #
    # authsrv
    authsrv# list
    authsrv# adduser admin "Auth DB admin"
    ok - user added initially disabled
    authsrv# ena admin
    enabled
    authsrv# proto admin pass
    changed
    authsrv# pass admin "plugh"
    Password changed.
    authsrv# superwiz admin
    set wizard
    authsrv# list
    Report for users in database
    user   group  longname           ok?    proto   last 
    ------ ------ ------------------ -----  ------  -----
    admin         Auth DB admin      ena    passw   never
    authsrv# display admin
    Report for user admin (Auth DB admin)
    Authentication protocol: password
    Flags: WIZARD
    authsrv# ^D
    EOT
    #
\end{verbatim}

TelnetµÄÍø¹Ø£¨tn-gw£©¿ØÖÆÖ±½ÓÁËµ±£¬Ó¦Ê×ÏÈÉè¶¨¡£
ÀýÈç£¬ÔÊÐíÔÚ±£»¤ÍøÂ·ÄÚµÄÓÃ»§²»±íÃ÷Éí·ÝÖ±½ÓÍ¨¹ý(permit-hosts 196.1.2.* -passok)¡£µ«ÆäËûÓÃ»§±ØÐèÌá¹©ÓÃ»§IDºÍÃÜÂë²Å¿ÉÊ¹ÓÃ´úÀíËÅ·þÆ÷(permit-hosts * -auth)¡£
´ËÍâ£¬ÓÐÒ»¸öÏµÍ³(196.1.2.202)Ò²¿ÉÖ±½ÓÊ¹ÓÃ·À»ðÇ½¡£ÕâÖ»ÒªÉè¶¨inetacl-in.telnetdµÄÄÚÈÝ¼´¿É¡£
TelnetµÄtimeoutÊ±¼äÓ¦¸Ã¶ÌÔÝ¡£
\begin{verbatim}
  # telnet gateway rules:
  tn-gw:                denial-msg      /usr/local/etc/tn-deny.txt
  tn-gw:                welcome-msg     /usr/local/etc/tn-welcome.txt
  tn-gw:                help-msg        /usr/local/etc/tn-help.txt
  tn-gw:                timeout 90
  tn-gw:                permit-hosts 196.1.2.* -passok -xok
  tn-gw:                permit-hosts * -auth
  # Only the Administrator can telnet directly to the Firewall via Port 24
  netacl-in.telnetd: permit-hosts 196.1.2.202 -exec /usr/sbin/in.telnetd
\end{verbatim}

r-commandÈçÍ¬telnetµÄÍ¬Ò»·½Ê½Éè¶¨¡£
\begin{verbatim}
  # rlogin gateway rules:
  rlogin-gw:    denial-msg      /usr/local/etc/rlogin-deny.txt
  rlogin-gw:    welcome-msg     /usr/local/etc/rlogin-welcome.txt
  rlogin-gw:    help-msg        /usr/local/etc/rlogin-help.txt
  rlogin-gw:    timeout 90
  rlogin-gw:    permit-hosts 196.1.2.* -passok -xok
  rlogin-gw:    permit-hosts * -auth -xok
  # Only the Administrator can telnet directly to the Firewall via Port
  netacl-rlogind: permit-hosts 196.1.2.202 -exec /usr/libexec/rlogind -a
\end{verbatim}

ÈÎºÎÈË¾ù²»µÃÖ±½Ó½øÈë·À»ðÇ½£¬ÆäÖÐ°üÀ¨FTP£¬Òò´Ë£¬²»Òª°ÑFTPËÅ·þÆ÷·ÅÔÚ·À»ðÇ½ÉÏ¡£
ÔÙÕß£¬permit-hostsÐÐÔÊÐí±£»¤ÍøÂ·ÄÚµÄÈÎºÎÈË×ÔÓÉ½øÈëÍø¼ÊÍøÂ·£¬ÆäËûÈËÔò±ØÐè±íÃ÷Éí·Ý¡£ÏÂÎÄ¸½ÉÏËÍµ½ºÍÊÕµ½µÄÃ¿·ÝÎÄµµµÄ¼ÇÂ¼£¨-log $\{$ retr stor $\}$£©¡£
FTPµÄtimeout¿ª¹Ø¿ØÖÆÔÚ¶àÉÙÊ±¼äááÍ£Ö¹ÊÔ½Ó£¬ÒÔ¼°ÔÚ¶àÉÙÊ±¼äÃ»ÓÐ¶¯×÷áá£¬·ÅÆúÊÔ½Ó¡£
\begin{verbatim}
  # ftp gateway rules:
  ftp-gw:               denial-msg      /usr/local/etc/ftp-deny.txt
  ftp-gw:               welcome-msg     /usr/local/etc/ftp-welcome.txt
  ftp-gw:               help-msg        /usr/local/etc/ftp-help.txt
  ftp-gw:               timeout 300
  ftp-gw:               permit-hosts 196.1.2.* -log { retr stor }
  ftp-gw:               permit-hosts * -authall -log { retr stor }
\end{verbatim}

Í¨¹ýWWW¡¢gopherºÍä¯ÀÀÆ÷½øÐÐµÄftpÓÉhttp-gw¿ØÖÆ¡£×îÉÏÃæµÄÁ½ÐÐ½¨Á¢Ò»¸öÄ¿Â¼£¬ÓÃÓÚ´¢´æ¾­ÓÉ·À»ðÇ½µÄftpºÍWWWÎÄ¼þ¡£ÔÚ±¾ÀýÖÐ£¬ÕâÐ©ÎÄ¼þÊôrootËùÓÐ£¬Òò´Ë·ÅÔÚÖ»ÓÐrootÄÜ¹»½øÈëµÄÄ¿Â¼ÄÚ¡£
WWWµÄÁ¬½ÓÓ¦¸Ã¶ÌÔÝ¡£Ëü¿ØÖÆÊ¹ÓÃÕßÔÚÁ¬½Ó²»Í¨Ê±µÄµÈ´ýÊ±¼ä¡£
\begin{verbatim}
  # www and gopher gateway rules:
  http-gw:      userid          root
  http-gw:      directory       /jail
  http-gw:      timeout 90
  http-gw:      default-httpd   www.afs.net
  http-gw:      hosts           196.1.2.* -log { read write ftp }
  http-gw:      deny-hosts      * 
\end{verbatim}

ssl-gwÊµ¼ÊÉÏÊÇÒ»¸öÈÎºÎÈË¶¼¿ÉÍ¨¹ýµÄÍø¹Ø¡£Ó¦µ±µ±ÐÄÉè¶¨¡£ÔÚ±¾ÀýÖÐ£¬ÈÎºÎ±£»¤ÍøÂ·ÖÐµÄÓÃ»§£¬³ý127.0.0.* ºÍ192.1.1.* Íâ£¬¾ù¿ÉÁ¬½ÓÍøÂ·ÍâµÄÈÎºÎËÅ·þÆ÷£¬²¢Ö»ÄÜÊ¹ÓÃ443ÖÁ563 ²ººÅ¡£443ÖÁ563²ººÅÒ»°ã³ÆÎªSSL²ººÅ¡£
\begin{verbatim}
  # ssl gateway rules:
  ssl-gw:   timeout 300
  ssl-gw:   hosts           196.1.2.* -dest { !127.0.0.* !192.1.1.* *:443:563 }
  ssl-gw:   deny-hosts      *
\end{verbatim}

ÏÂÃæµÄÀý×ÓËµÃ÷ÈçºÎÀûÓÃplug-gwÁ¬½Óµ½ÐÂÎÅËÅ·þÆ÷¡£ÔÚ±¾ÀýÖÐ£¬±£»¤ÍøÂ·ÄÚµÄÓÃ»§Ö»ÔÊÐíÁ¬½Óµ½Ò»¸öÏµÍ³£¬¼´Á¬½Óµ½ËüµÄÐÂÎÅ²º¡£
µÚ¶þÐÐÊ¹ÐÂÎÅËÅ·þÆ÷½«Æä×ÊÁÏËÍµ½±£»¤ÍøÂ·¡£
¶ÔÐÂÎÅËÅ·þÆ÷µÄtimeoutÊ±¼äÉè¶¨Ó¦¸Ã±È½Ï³¤£¬ÒòÎª¶àÊýÓÃ»§´ó¶¼Áª»úÔÄ¶ÁÐÂÎÅ¡£
\begin{verbatim}
 
  # NetNews Pluged gateway
  plug-gw:        timeout 3600
  plug-gw: port nntp 196.1.2.* -plug-to 199.5.175.22 -port nntp
  plug-gw: port nntp 199.5.175.22 -plug-to 196.1.2.* -port nntp
\end{verbatim}


FingerÍø¹ØµÄÉè¶¨ÖÁÎª¼òµ¥¡£±£»¤ÍøÂ·ÄÚµÄÓÃ»§Ö»ÒªÊ×ÏÈµÇÂ¼£¬¾Í¿ÉÊ¹ÓÃ·À»ðÇ½ÉÏµÄfinger³ÌÊ½¡£ÈÎºÎÆäËûÈË¾ÍÖ»ÊÕµ½Ò»¶Îmessage¡£
\begin{verbatim}
  # Enable finger service --------Éè¶¨finger¹¦ÄÜ
  netacl-fingerd: permit-hosts 196.1.2.* -exec /usr/libexec/fingerd
  netacl-fingerd: permit-hosts * -exec /bin/cat /usr/local/etc/finger.txt
\end{verbatim}

ÔÚÕâ·ÝHOWTOÖÐ£¬Ã»ÓÐÉè¶¨MailºÍX-windows¹¦ÄÜ¡£ÈçÈÎºÎÈËÓÐÕâ·½ÃæµÄÊµÀý£¬Çë·¢email¸øÎÒ¡£




\subsubsection{inetd.confµÄÉèÖÃµµ}

ÏÂÃæ¸½ÉÏ/etc/inetd.confµÄÈ«²¿ÎÄµµ¡£ËùÓÐ²»ÐèÒªµÄ¹¦ÄÜ¶¼ÓÃ\#·ûºÅ×¢Ïú¡£ÔÚÕâ·ÝÈ«²¿ÎÄµµÖÐÏÔÊ¾È¡ÏûÁËºÎÖÖ¹¦ÄÜ£¬ÒÔ¼°ÏÔÊ¾ÈçºÎÉè¶¨ÐÂµÄ·À»ðÇ½¹¦ÄÜ¡£
\begin{verbatim}
 
  #echo stream  tcp  nowait  root               internal 
  #echo dgram   udp  wait    root       internal
  #discard              stream  tcp  nowait  root       internal
  #discard              dgram   udp  wait    root       internal
  #daytime              stream  tcp  nowait  root       internal
  #daytime              dgram   udp  wait    root       internal
  #chargen              stream  tcp  nowait  root       internal
  #chargen              dgram   udp  wait    root       internal
  # FTP firewall gateway --------FTP·À»ðÇ½Íø¹Ø
  ftp-gw      stream  tcp  nowait.400  root  /usr/local/etc/ftp-gw  ftp-gw
  # Telnet firewall gateway------Telnet·À»ðÇ½Íø¹Ø
  telnet        stream  tcp  nowait      root  /usr/local/etc/tn-gw /usr/local/etc/tn-gw
  # local telnet services------ÓÃ»§µÄtelnet¹¦ÄÜ
  telnet-a    stream  tcp  nowait      root  /usr/local/etc/netacl in.telnetd
  # Gopher firewall gateway------Gopher·À»ðÇ½Íø¹Ø
  gopher        stream  tcp  nowait.400  root  /usr/local/etc/http-gw /usr/local/etc/http-gw 
  # WWW firewall gateway------WWW·À»ðÇ½Íø¹Ø
  http  stream  tcp  nowait.400  root  /usr/local/etc/http-gw /usr/local/etc/http-gw 
  # SSL firewall gateway------SSL·À»ðÇ½Íø¹Ø
  ssl-gw  stream  tcp     nowait  root /usr/local/etc/ssl-gw   ssl-gw
  # NetNews firewall proxy (using plug-gw)------NetNews·À»ðÇ½´úÀíËÅ·þÆ÷£¨Ê¹ÓÃplug-gw£©
  nntp    stream  tcp     nowait  root    /usr/local/etc/plug-gw plug-gw nntp
  #nntp stream  tcp     nowait  root    /usr/sbin/tcpd  in.nntpd
  # SMTP (email) firewall gateway------SMTP£¨email£©·À»ðÇ½Íø¹Ø
  #smtp stream  tcp     nowait  root    /usr/local/etc/smap smap
  #
  # Shell, login, exec and talk are BSD protocols------ Shell, login, exec and talk¾ùÊôBSDÐ­Òé
  #
  #shell        stream  tcp     nowait  root    /usr/sbin/tcpd  in.rshd
  #login        stream  tcp     nowait  root    /usr/sbin/tcpd  in.rlogind
  #exec stream  tcp     nowait  root    /usr/sbin/tcpd  in.rexecd
  #talk dgram   udp     wait    root    /usr/sbin/tcpd  in.talkd
  #ntalk        dgram   udp     wait    root    /usr/sbin/tcpd  in.ntalkd
  #dtalk        stream  tcp     waut    nobody  /usr/sbin/tcpd  in.dtalkd
  #
  # Pop and imap mail services et al------PopºÍimap mail¹¦ÄÜ
  #
  #pop-2   stream  tcp  nowait  root  /usr/sbin/tcpd    ipop2d
  #pop-3   stream  tcp  nowait  root  /usr/sbin/tcpd    ipop3d
  #imap    stream  tcp  nowait  root  /usr/sbin/tcpd    imapd
  #
  # The Internet UUCP service------Íø¼ÊÍøÂ·UUCP¹¦ÄÜ
  #
  #uucp    stream  tcp  nowait  uucp  /usr/sbin/tcpd  /usr/lib/uucp/uucico -l
  #
  # Tftp service is provided primarily for booting.  Most sites
  # run this only on machines acting as "boot servers." Do not uncomment
  # this unless you *need* it.  ----- Tftp¹¦ÄÜÖ÷ÒªÓÃÓÚÆô¶¯¡£Ò»°ãÖ»ÓÐ×÷Îª"bootËÅ·þÆ÷"Ê±²ÅÐèÒªtftp¡£Òò´Ë£¬²»ÒªÈ¡Ïû×¢Ïú£¨#£©·ûºÅ¡£
  #
  #tftp dgram   udp     wait    root    /usr/sbin/tcpd  in.tftpd
  #bootps       dgram   udp     wait    root    /usr/sbin/tcpd  bootpd
  #
  # Finger, systat and netstat give out user information which may be
  # valuable to potential "system crackers."  Many sites choose to disable 
  # some or all of these services to improve security.------ Finger, systat and netstat»áÏòº§¿ÍÌá¹©¿É¹óµÄ×ÊÁÏ¡£Ðí¶àÍøÕ¾È¡ÏûÒ»Ð©»òÈ«²¿¹¦ÄÜ£¬ÒÔÔö°²È«¡£
  #
  # cfinger is for GNU finger, which is currently not in use in RHS Linux
  # cfingerÊÇGNU finger£¬Ä¿Ç°ÔÚRHS LinuxÖÐ²¢²»Ê¹ÓÃ¡£
  #
  finger        stream  tcp  nowait  root   /usr/sbin/tcpd  in.fingerd
  #cfinger      stream  tcp  nowait  root   /usr/sbin/tcpd  in.cfingerd
  #systat       stream  tcp  nowait  guest  /usr/sbin/tcpd  /bin/ps -auwwx
  #netstat      stream  tcp  nowait  guest  /usr/sbin/tcpd  /bin/netstat -f inet
  #
  # Time service is used for clock syncronization.-----Ê±¼ä¹¦ÄÜÓÃÓÚÉè¶¨Ê±¼äµÄÍ¬²½¡£
  #
  #time stream  tcp  nowait  root  /usr/sbin/tcpd  in.timed
  #time dgram   udp  wait    root  /usr/sbin/tcpd  in.timed
  #
  # Authentication-----²éÑéÓÃ»§Éí·Ý
  #
  auth          stream  tcp  wait    root  /usr/sbin/tcpd  in.identd -w -t120
  authsrv       stream  tcp  nowait  root  /usr/local/etc/authsrv authsrv
  #
  # End of inetd.conf-----inetd.congÉèÖÃµµ½áÊø
\end{verbatim}





\subsubsection{/etc/servicesµµ}



µ±ÓÃ»§Á¬½Óµ½·À»ðÇ½Ê±£¬»á½Óµ½Ò»¸öÒÑÖªµÄ²º£¨Ð¡ÓÚ1024£©¡£ÀýÈç£¬telnet½Óµ½²º23¡£inetd deamon½Óµ½Á¬½ÓµÄ¶¯×÷£¬²é¿´/etc/servicesÉÏÕâÐ©¹¦ÄÜµÄÃû×Ö¡£È»áá£¬Ëü»áÆô¶¯/etc/inetd.confµµÖÐÕâ¸öÃû×ÖËùÖ¸¶¨µÄ³ÌÊ½¡£
ÓÐÊ±Ê¹ÓÃµÄ¹¦ÄÜ²¢²»ÔÚ/etc/servicesµµÖÐ¡£ÕâÐ©¹¦ÄÜ¿ÉÖ¸¶¨µ½ÈÎºÎÏëÖ¸¶¨µÄ²º¡£ÀýÈç£¬¹ÜÀíÔ±µÄtelnet²º£¨telnet-a£©¿ÉÉè¶¨µ½²º24£¬Ò²¿ÉÉè¶¨µ½²º2323£¬Ï¤Ìý×ð±ã¡£Èç¹û¹ÜÀíÔ±£¨Ö¸Äã±¾ÈË£©ÒªÖ±½ÓÁ¬½Óµ½·À»ðÇ½£¬ÔòÐètelnetµ½²º24¶ø·Ç²º23¡£Èç°´ÕÕÏÂÀýÉè¶¨netperm-table£¬ÔòÖ»ÄÜ´Ó±£»¤µÄÍøÂ·ÖÐµÄÒ»¸öÏµÍ³Éè¶¨¡£

\begin{verbatim}
 
  telnet-a         24/tcp
  ftp-gw          21/tcp           # this named changed
  auth            113/tcp   ident    # User Verification
  ssl-gw           443/tcp
\end{verbatim}







\section{SOCKS´úÀíËÅ·þÆ÷}


\subsection{Éè¶¨´úÀíËÅ·þÆ÷}

SOCKS´úÀíËÅ·þÆ÷¿É´Ó
{\bfseries ftp://sunsite.unc.edu/pub/Linux/system/Network/misc/socks-linux-
src.tgz}È¡µÃ¡£¸ÃµµÄÚÒ²ÓÐÒ»¸ö³ÆÎª{\tt\char`\"}socks-conf{\tt\char`\"}µÄÉèÖÃµµ¿É×÷²Î¿¼¡£¿É°Ñ¸Ãµµ½âÑ¹£¬È»áá¸ù¾ÝÆäÖÐµÄËµÃ÷Ê¹ÓÃ¸Ãµµ¡£µ«Ê¹ÓÃÊ±²¢²»¼òµ¥£¬Ó¦Ê×ÏÈÈ·¶¨MakefileµµÕýÈ·ÎÞÎó¡£
ÔÚ /etc/inetd.confÖÐÓ¦¸ÃÔöÌí´úÀíËÅ·þÆ÷¡£Òò´Ë£¬Ó¦¸ÃÔö¼ÓÒÔÏÂÒ»ÐÐ¡£
\begin{verbatim}
  socks  stream  tcp  nowait  nobody  /usr/local/etc/sockd  sockd
\end{verbatim}

ÕâÑùËÅ·þÆ÷²Å»áÔÚÐèÒªÊ±ÔËÐÐ¡£




\subsection{ÉèÖÃ´úÀíËÅ·þÆ÷}

SOCKSÐèÒªÁ½¸öÉèÖÃµµ½øÐÐÉè¶¨¡£Ò»¸öÉèÖÃµµÉè¶¨½øÈëÈ¡ÓÃµÄÈ¨ÏÞ£¬ÁíÒ»¸öÉèÖÃµµÉè¶¨Â·¾¶£¬ÒÔ±ãÕÒµ½ÊÊµ±µÄ´úÀíËÅ·þÆ÷¡£È¨ÏÞµµÓ¦ÔÚËÅ·þÆ÷ÉÏ£¬Â·¾¶µµÓ¦ÔÚÃ¿Ò»Ì¨UNIX»úÉÏ¡£DOS»úºÍMacintosh»ú¶¼»áÈ·¶¨×ÔÐÐµÄÂ·¾¶¡£




\subsubsection{È¨ÏÞµµ}

ÔÚsocks4.2£¨beta£©°æÖÐ£¬È¨ÏÞµµ³ÆÎª{\tt\char`\"}sockd.conf{\tt\char`\"}£¬Ó¦¸ÃÖ»ÓÐÁ½ÐÐ£¬Ò»ÐÐÔÊÐí£¨permit£©£¬Ò»ÐÐ¾Ü¾ø£¨deny£©¡£Ã¿ÐÐ¶¼ÓÐÈýÏîÉè¶¨£º
\begin{itemize}
\item Ê¶±ð±êÊ¾ÐÐ(permit/deny)
\item IPµØÖ·ÐÐ
\item ÐÞ¸ÄµØÖ·ÐÐ
\end{itemize}

Ê¶±ð±êÊ¾ÓÃÓÚpermit»òdeny¡£Ó¦¸ÃÓÐµ¥¶ÀµÄpermitÐÐºÍµ¥¶ÀµÄdenyÐÐ¡£
IPµØÖ·Ê¹ÓÃ±ê×¼µÄ4byte·½Ê½±íÊ¾£¬ÈçI.E. 192.168.2.0.¡£
ÐÞ¸ÄµØÖ·ÐÐÒ²ÊÇ±ê×¼µÄ4Î»Ôª IPµØÖ·£¬ÓÃÀ´×÷Îªnetmask¡£½«Õâ¸öµØÖ·Ïë³É32Î»ÔªµÄÊý×Ö¡£Èç¹ûÊÇ1£¬ÔòºË¶ÔµÄµØÖ·µÄÏàÓ¦Î»ÖÃÓ¦·ûºÏIPµØÖ·ÖÐÏàÓ¦µÄÎ»Ôª¡£ÀýÈç£¬´ËÐÐµÄµØÖ·Îª¡Ã
\begin{verbatim}
    permit 192.168.2.23  255.255.255.255
\end{verbatim}


ÔòÖ»ÔÊÐíÃ¿Ò»Î»ÔªÏà·ûµÄµØÖ·£¬¼´192.168.2.23¡£Èç¹ûµØÖ·Îª¡Ã
\begin{verbatim}
    permit 192.168.2.0  255.255.255.0
\end{verbatim}

Ôò»áÔÊÐí192.168.2.0ÖÁ192.168.2.255Ö®¼äµÄÃ¿Ò»¸öµØÖ·£¬¼´Õû¸öC¼¶µÄµØÖ·¡£²»µÃÓÐÏÂÁÐÕâÖÖµØÖ·³öÏÖ¡Ã
\begin{verbatim}
    permit 192.168.2.0  0.0.0.0
\end{verbatim}

Õâ»áÔÊÐíÃ¿Ò»µØÖ·Ê¹ÓÃ£¬²»ÂÛÆäµØÖ·ÎªºÎ¡£
Òò´Ë£¬ÔÊÐíÃ¿Ò»¸öÓ¦¸ÃÔÊÐíµÄµØÖ·£¬È»áá¾Ü¾øÆäÓàµØÖ·¡£ÈçÔÊÐí192.168.2.xxx·¶Î§ÖÐµÄÃ¿Ò»ÓÃ»§£¬¿ÉÓÃÏÂÁÐ·½Ê½±íÊ¾¡Ã
\begin{verbatim}
    permit 192.168.2.0  255.255.255.0
    deny 0.0.0.0  0.0.0.0
\end{verbatim}


×¢ÒâdenyÐÐÖÐµÄµÚÒ»¸ö{\tt\char`\"}0.0.0.0{\tt\char`\"}¡£ÓÉÓÚµØÖ·ÒÔ0.0.0.0ÐÞ¸Ä£¬Òò´ËIPÎªºÎ¶¼Ã»ÓÐÓ°Ïì¡£ÓÃ0×÷ÎªIPµØÖ·£¬ÒòÎª±ãÓÚ´ò×Ö¡£ 
ÌØ±ðµÄÓÃ»§¿ÉÒÔ¸øÓè»ò¾Ü¾øÊ¹ÓÃµÄÈ¨ÏÞ¡£Õâ¿ÉÍ¨¹ýidenµÄ²éÑéÀ´ÊµÏÖ¡£ÓÉÓÚ²»ÊÇËùÓÐÏµÍ³¶¼Ö§³Öiden£¬ÆäÖÐ°üÀ¨Trumpet Winsock£¬ËùÒÔ´Ë´¦²»Ô¤±¸¶à¼ÓËµÃ÷¡£ËæÍ¬socksÌá¹©µÄËµÃ÷ÒÔ¹»Ê¹ÓÃ¡£


\subsubsection{Â·¾¶µµ}

SOCKSÖÐµÄÂ·¾¶µµ³ÆÎª{\tt\char`\"}socks.conf{\tt\char`\"}£¬¼«Ò×ÓëÈ¨ÏÞµµ»ìÏý¡£
Â·¾¶µµÈÃSOCKSÓÃ»§ÖªµÀºÎÊ±ÓÃsocks£¬ºÎÊ±²»ÓÃ¡£ÀýÈç£¬ÔÚÊ¾¡õµÄÍøÂ·ÖÐ192.168.2.3²¢²»ÐèÒªÊ¹ÓÃsocksÓë192.168.2.1·À»ðÇ½¶Ô»°¡£Í¨¹ýEthernet£¬ËüÃÇÖ®¼äÓÐÖ±½ÓµÄÁ¬½Ó¡£ÓÖ127.0.0.1×Ô¶¯ÉèÎªloopback¡£Òò´ËÒ²²»ÐèÒªÓÃsocksÍ¬×Ô¼º¶Ô»°¡£ËüÓÐÈýÐÐÊäÈë¡Ã

\begin{itemize}
\item deny
\item direct
\item sockd
\end{itemize}

DenyÐÐ¸æËßsocksºÎÊ±¾Ü¾øÒ»ÏîÇëÇó¡£ÔÚ´ËÌíÈëµÄÄÚÈÝÍ¬sockd.confµÄÄÚÈÝÏàÍ¬£¬µØÖ·±êÊ¾ÐÐ¡¢IPµØÖ·ºÍÐÞ¸ÄµØÖ·ÐÐ¡£Ò»°ã¶øÑÔ£¬È¨ÏÞµµsockd.confÒ²Óë´ËÓÐ¹Ø£¬ÐÞ¸ÄµØÖ·²¿·ÖÔòÓÃ0.0.0.0¡£Èç¹û²»´òËãÁ¬µ½ÈÎºÎµØ·½£¬ÔÚ´Ë¿É×÷³öÐÞ¸Ä¡£

ÔÚdirectÐÐÏÂÁÐÈë²»Ê¹ÓÃsockµÄµØÖ·¡£ËùÓÐÕâÐ©µØÖ·¶¼¿ÉÖ±½ÓÁªÉÏÍøÂ·£¬ÎÞÐë¾­¹ý´úÀíËÅ·þÆ÷¡£ÔÚÕâÀïÓÖÓÐÈý¸öÎ»ÖÃÒªÌî¡Ãidentifier¡¢addressºÍmodifier¡£ÀýÈç¡Ã
\begin{verbatim}
    direct 192.168.2.0 255.255.255.0
\end{verbatim}


SockdÐÐ¸æËßµçÄÔÄÇÒ»¸öÓÃ»§µÄµçÄÔÉÏÓÐsocks server daemon¡£¸ÃÐÐÄÚÈÝÈçÏÂ¡Ã

\begin{verbatim}
  sockd @=<serverlist> <IP address> <modifier>
\end{verbatim}


×¢Òâ@= ÌîÈëµÄÄÚÈÝ¡£ÀûÓÃÕâÖÖ·½·¨¿ÉÒÔÌîÈëÒ»ÏµÁÐ´úÀíËÅ·þÆ÷µÄIPµØÖ·¡£ÔÚÕâÀïÖ»ÓÃÒ»¸ö´úÀíËÅ·þÆ÷µÄµØÖ·ÎªÀý¡£µ«¿ÉÒÔÁÐÉÏ¶à¸öËÅ·þÆ÷µÄµØÖ·£¬ÒÔ±ã¼Ó´óÈÝÁ¿£¬²¢µ±ÓÐËÅ·þÆ÷Ê§ÁéÊ±£¬ÓÐÆäËûµÄËÅ·þÆ÷¶¥Ìæ¡£

Éè¶¨IPµØÖ·ºÍmodifierÓòµÄ·½·¨ºÍÆäËûÀý×ÓÏàÍ¬¡£




\subsubsection{·À»ðÇ½ááµÄDNS
        ´Ó·À»ðÇ½ááÉè¶¨Domain Name ServiceÊÇ¼þ¼òµ¥²»¹ýµÄÊÂ¡£Ö»ÒªÔÚ×÷Îª·À»ðÇ½µÄµçÄÔÉÏÉè¶¨DNS¼´¿É¡£È»ááÔÚ·À»ðÇ½ááµÄµçÄÔÉÏÉè¶¨Ê¹ÓÃÕâ¸öDNS¡£}


\subsection{´úÀíËÅ·þÆ÷}


\subsubsection{Unix}

ÒªÊ¹Ó¦ÓÃ³ÌÐòÀûÓÃ´úÀíËÅ·þÆ÷£¬ÕâÐ©Ó¦ÓÃ³ÌÐòÐèÒª{\tt\char`\"}sockified{\tt\char`\"}¡£ÔÚÕâÀïÐèÒªÁ½¸ötelnet£¬Ò»¸ö½øÐÐÖ±½ÓÍ¨Ñ¶£¬Ò»¸öÍ¨¹ý´úÀíËÅ·þÆ÷½øÐÐÍ¨Ñ¶¡£SOCKSÈí¼þÖÐÓÐËµÃ÷sockÒ»¸ö³ÌÊ½µÄ·½·¨£¬Ò²¸½ÓÐ¼¸¸öÒÑ¾­sockºÃµÄ³ÌÊ½¡£Èç¹ûÒªÖ±½ÓÊ¹ÓÃsockºÃµÄ³ÌÊ½£¬SOCKSÈí¼þ»áÖ±½ÓÉè¶¨¡£Òò´Ë£¬Ó¦¸Ã½«±£»¤ÍøÂ·ÄÚµÄËùÓÐ³ÌÊ½¸ÄÃû£¬È»ááÔÙ¸ÄÓÃÒÑ¾­sockºÃµÄ³ÌÊ½¡£ÀýÈç£¬{\tt\char`\"}Finger{\tt\char`\"}±äÎª{\tt\char`\"}finger.orig{\tt\char`\"}£¬{\tt\char`\"}telnet{\tt\char`\"}±äÎª{\tt\char`\"}telnet.orig{\tt\char`\"}¡£       ±ØÐëÍ¨¹ýinclude/socks.hµµ¸æËßSOCKSÕâÖÖÉè¶¨¡£
ÓÐÐ©³ÌÊ½ÄÜ×ÔÐÐ´¦ÀíroutingºÍsockifyingµÄÎÊÌâ¡£Netscape¾ÍÊ¹ÆäÖÐÖ®Ò»¡£ÀýÈçÔÚNetscapeÏÂÒªÓÃÓÃ´úÀíËÅ·þÆ÷£¬Ö»ÒªÔÚProxiesÏÂSOCKÀ¸ÄÚÌîÈëËÅ·þÆ÷µÄµØÖ·¼´¿É£¨ÔÚ´ËÎª192.168.2.1£©¡£µ±È»£¬Ã¿ÖÖÓ¦ÓÃ³ÌÊ½¶¼µÃ×÷Ð©Ð¡±ä¶¯£¬²»ÂÛÆä´¦Àí´úÀíËÅ·þÆ÷µÄ·½·¨ÎªºÎ¡£




\subsubsection{Î¢ÈíÊÓ´°ÓëTrumpet Winsock}

Trumpet WinsockÖÐÓÐ×Ô´øµÄ´úÀíËÅ·þÆ÷¹¦ÄÜ¡£ÔÚ{\tt\char`\"}setup{\tt\char`\"}Ñ¡µ¥ÖÐÌîÈëËÅ·þÆ÷µÄIPµØÖ·ºÍËùÓÐÖ±½Ó¿ÉÁªµÄµçÄÔµÄµØÖ·¡£È»áá£¬Trumpet¾Í»á´¦ÀíËùÓÐÍâËÍµÄÊý¾Ý°ü¡£




\subsubsection{Ê¹´úÀíËÅ·þÆ÷ÅäºÏUDPÊý¾Ý°ü}

SOCKSÈí¼þÖ»´¦ÀíTCPÊý¾Ý°ü£¬¶ø²»´¦Àí     UDP¡£Õâ¶àÉÙ¼õÉÙÁËËüµÄÓÃ´¦£¬ÒòÎª£¬Ðí¶àÓÐÓÃµÄ³ÌÊ½£¬ÀýÈçtalkºÍArchie£¬¶¼ÀûÓÃUDP¡£ÓÐÒ»Ì×Èí¼þ£¬³ÆÎªUDPrelay£¬ÓÉTom FitzgeraldÉè¼Æ$<$fitz@wang.com$>$£¬Ö÷Òª×÷ÎªUDPÊý¾Ý°üµÄ´úÀíËÅ·þÆ÷Ê¹ÓÃ¡£²»¹ýÔÚ±àÐ´±¾ÎÄÊ±£¬ÕâÌ×Èí¼þ²»ÄÜÓÃÓÚLinux.


\subsection{´úÀíËÅ·þÆ÷µÄÈ±µã}

¹é¸ù½áµ×£¬´úÀíËÅ·þÆ÷ÊÇÒ»¸ö{\ttfamily °²È«×°ÖÃ}¡£ÔÚÓÐÏÞµÄIPµØÖ·µÄÇé¿öÏÂ£¬ÓÃËüÊ¹Ðí¶àÓÃ»§½øÈëÍø¼ÊÍøÂ·ÓÐÐí¶àÈ±µã¡£´úÀíËÅ·þÆ÷¿ÉÊ¹±£»¤ÍøÂ·ÄÚµÄÓÃ»§Áªµ½ÍøÂ·Ö®Íâ£¬µ«Ê¹ÍøÂ·Ö®ÍâµÄÓÃ»§ÍêÈ«ÎÞ·¨Í¬ÍøÂ·Ö®ÄÚµÄÓÃ»§ÁªÏµ¡£Õâ±íÊ¾ÎÞ·¨Í¬ÍøÂ·Ö®ÄÚµÄµçÄÔ½øÐÐtalk»òarchieÁªÍø£¬Ò²ÎÞ·¨·¢ËÍµç×ÓÓÊ¼þ¡£ÕâÐ©È±µã¿´À´²¢²»ÑÏÖØ£¬µ«ÊÇÈç¹û¡Ã
\begin{itemize}
\item ÄãÓÐÒ»·ÝÃ»ÓÐÍê³ÉµÄ±¨¸æÁôÔÚ±£»¤ÍøÂ··À»ðÇ½ÄÚµÄµçÄÔÉÏ¡£»Ø¼Òáá£¬ÄãÓÖÏë¿´¿´Õâ·Ý±¨¸æ¡£µ«ÊÇÃ»ÓÐ°ì·¨¡£ÒòÎªµçÄÔÔÚ·À»ðÇ½áá£¬ÎÞ·¨ÁªÍø¡£Èç¹ûÊ×ÏÈlogin {\ttfamily ·À»ðÇ½}£¬µ«ÓÉÓÚÃ¿Ò»¸öÈË¶¼¿É½øÈë´úÀíËÅ·þÆ÷£¬Òò´ËÄãÔÚÕâ¸öËÅ·þÆ÷ÉÏ²¢Ã»ÓÐ¸ö±ðÕÊ»§¡£


\item ÄãÅ®¶ùÈ¥ÁË´óÑ§¡£ÄãÏëÐ´·âµç×ÓÓÊ¼þ¸øËý¡£ÄãÏëÌ¸Ð©Ë½ÊÂ£¬Òò´Ë×îºÃÄÜ°Ñµç×ÓÓÊ¼þÖ±½Ó·Åµ½×Ô¼ºµÄµçÄÔÉÏ¡£Äãµ±È»ÐÅµÃ¹ýÄãµÄÏµÍ³¹ÜÀíÔ±£¬µ«Õâµ¹µ×Óë¹«ÎñÎÞ¹Ø£¬ÊÇ¸öÈËµÄÐÅ¼þ¡£


\item ²»ÄÜÊ¹ÓÃUDPÊÇ´úÀíËÅ·þÆ÷µÄÒ»¸ö´óÈ±ÏÝ¡£ÎÒÏë²»¾ÃÖ®áá¾Í»áÓÐUDPµÄ¹¦ÄÜ¡£
\end{itemize}


FTPÊÇ´úÀíËÅ·þÆ÷µÄÁíÒ»¸öÎÊÌâ¡£ÔÚÈ¡µÃ»òÊ¹ÓÃ{\ttfamily ls}Ê±£¬FTPËÅ·þÆ÷ÔÚ¿Í»§»úÉÏ´ò¿ªÒ»¸ösocket£¬²¢Í¨¹ýËü´«ËÍÐÅÏ¢¡£´úÀíËÅ·þÆ÷²»ÔÊÐí½øÐÐÕâÏî¹¤×÷£¬Òò´ËFTPÎÞ·¨Ê¹ÓÃ¡£
´ËÍâ£¬´úÀíËÅ·þÆ÷ÔËÐÐ»ºÂý¡£ÓÉÓÚÐèÒª¶îÍâ×ÊÔ´½Ï¶à£¬¼¸ºõÈÎºÎÆäËûÄÜ´ï³ÉÕâÏî×÷ÓÃµÄËÅ·þÆ÷¶¼Òª±ÈËü¿ì¡£
Ò»°ã¶øÑÔ£¬Èç¹ûÓÐIPµØÖ·ÁªÍø£¬¶øÓÖ²»±ØÌØ±ð¹ËÂÇ°²È«ÎÊÌâ£¬ÄÇ¾Í²»ÒªÊ¹ÓÃ·À»ðÇ½ºÍ£¨»ò£©´úÀíËÅ·þÆ÷¡£Èç¹ûÃ»ÓÐIPµØÖ·ÁªÍø£¬µ«Ò²²»¹ËÂÇ°²È«ÎÊÌâ£¬ÄÇ¾Í²»·ÁÊ¹ÓÃIPÄ£ÄâÆ÷£¬ÏóTerm£¬Slirp»òTIA¡£Term¿É´Ó{\ttfamily {\bfseries ftp://sunsite.unc.edu}}È¡µÃ£¬Slirp¿É´Ó{\ttfamily {\bfseries ftp://blitzen.canberra.edu.au/pub/slirp}}È¡µÃ£¬TIA¿É´Ómarketplace.comÈ¡µÃ¡£Ê¹ÓÃ´úÀíËÅ·þÆ÷µÄÀíÏëÍøÂ·ÊÇÓÐÐí¶àÓÃ»§ÐèÒªÁªÍø£¬ÄÇÖ»Òª×öÒ»´ÎÉè¶¨Ö®áá¾Í²»±ØÔÙ×öÌ«¶àÆäËûµÄ¹¤×÷¡£




\section{¸ß¼¶ÉèÖÃ}

ÔÚ½áÊø´ËÎÄÊ±£¬²»·ÁÔÙ¾ÙÒ»¸öÀý×Ó£¬À´ËµÃ÷ÉèÖÃµÄ·½·¨¡£Ç°ÃæµÄÀý×ÓÊÊºÏ¶àÊýÊ¹ÓÃÇé¿ö¡£ÏÂÃæÔÙÒÔÒ»¸ö¸ß¼¶ÉèÖÃÎªÀý£¬ÒÔ±ãÄÜËµÃ÷Ò»Ð©ÎÊÌâ¡£Èç¹ûÇ°ÃæµÄÀý×Ó²»ÄÜ½â´ðÄãµÄÎÊÌâ£¬»òÕß»¹ÏëÁË½â´úÀíËÅ·þÆ÷ºÍ·À»ðÇ½µÄÆäËûÌØÐÔ£¬Çë×¢ÒâÏÂÃæµÄÀý×Ó¡£




\subsection{×¢ÖØ°²È«µÄ´óÐÍÍøÂ·}

¼ÙÉèÒ»¸öÃñÍÅÊ×ÄÔÒªÉèÖÃÍøÂ·£¬ÆäÖÐ¹²ÓÐ50Ì¨µçÄÔºÍÓÐÒ»¸ö32¸öIPµØÖ·µÄ´Î¼¶Íø¡£ÓÉÓÚËæ´ÓµÄ¼¶±ð²»Í¬£¬ÃñÍÅÊ×ÄÔÏëÔÚÍøÂ·ÉÏÉèÖÃ²»Í¬¼¶±ðµÄÊ¹ÓÃÈ¨¡£Òò´Ë£¬ÍøÂ·µÄÒ»²¿·Ö²»ÄÜÓëÁíÒ»²¿·Ö»¥Í¨¡£
¸÷ÖÖ¼¶±ðÓÐ¡Ã

\begin{enumerate}
\item ÍâÎ§¡£ÕâÊÇÈËÈË¶¼¿Éµ½´ïµÄ²ãÃæ¡£ÕâÊÇÎüÒýÐÂ³ÉÔ±µÄ²ãÃæ¡£
\item {\bfseries ²¿¶ÓÈËÔ±}ÕâÒ»²ãÃæµÄÈËÎïÒÑ¾­³¬¹ýÍâÎ§¡£Õâ¸ö²ãÃæµÄÈË¿ÉÒÔÖªµÀÒ»Ð©¼ÆÄ±ºÍÖÆÔìÎäÆ÷µÄ·½·¨¡£
\item {\bfseries Íâ¼®¾üÍÅ}ÕâÊÇ{\itshape ÕæÕý\/}Íê³É¼Æ»®Ö®´¦¡£
\end{enumerate}





\subsubsection{ÍøÂ·µÄÉè¶¨}

IPºÅÂëµÄÉè¶¨·½·¨ÈçÏÂ¡Ã



\begin{itemize}
\item Ò»¸öµØÖ·Îª192.168.2.255£¬ÕâÊÇbroadcastµÄµØÖ·£¬²»¿ÉÊ¹ÓÃ¡£
\item 32 IPµØÖ·ÖÐ23¸öµØÖ··ÖÅä¸ø23Ì¨»úÆ÷£¬ÕâÐ©»úÆ÷¿ÉÍ¬Íø¼ÊÍøÂ·Áª½á¡£
\item Ò»¸öIPµØÖ·ÓÃÓÚÍøÂ·ÉÏµÄlinux»ú¡£
\item Ò»¸öIPµØÖ·ÓÃÓÚÍøÂ·ÉÏµÄÁíÒ»¸ölinux»ú¡£
\item Á½¸öIP \#'sÓÃÓÚrouter
\item Ê£ÏÂµÄËÄ¸öµØÖ·Ëæ±ã¶¨ËÄ¸öÃû×Ö£¬Ê¹ÈË×½Ãþ²»¶¨ÕæÕýµÄÓÃ»§¡£
\item ±£»¤ÍøÂ·µÄµØÖ·Îª192.168.2.xxx
\end{itemize}

ÕâÑù¾Í½¨Á¢ÁËÁ½¸ö²»Í¬µÄÍøÂ·¡£ÕâÁ½¸öÍøÂ·Í¨¹ýºìÍâÏßEthernetÁªÍø£¬Íâ½çÍêÈ«¿´²»µ½ËüÃÇµÄ´æÔÚ¡£ºìÍâÏßEthernetµÄ×÷ÓÃºÍÒ»°ãEthernetµÄ×÷ÓÃÏàÍ¬¡£
ÕâÁ½¸öÍøÂ·¸÷×ÔÁ¬µ½ÓÐIPµØÖ·ÔËÐÐlinuxµÄµçÄÔ¡£
Í¬Ê±ÓÐÒ»¸öÎÄµµËÅ·þÆ÷½ÓÁ¬µ½ÕâÁ½¸ö±£»¤ÍøÂ·£¬ÒòÎªÕ÷·þÊÀ½çµÄ¼Æ»®ÖÐÐèÒªÒ»Ð©ÑµÁ·¾«Á¼µÄ²¿¶Ó¡£ÎÄµµËÅ·þÆ÷ÖÐÓÐ²¿¶ÓÍøÂ·µÄIPµØÖ·192.168.2.17ºÍÍâ¼®¾üÍÅÍøÂ·µÄIPµØÖ·192.168.2.23¡£ÓÐ²»Í¬IPµØÖ·µÄÔ­ÒòÊÇÒòÎªÓÐ²»Í¬Ethernet¿¨µÄÔµ¹Ê¡£ÍøÂ·ÉÏIP ForwardingµÄ¹¦ÄÜ¹Ø±ÕÍ£ÓÃ¡£
Á½Ì¨Linux»úÉÏIP ForwardingµÄ¹¦ÄÜÒ²¶¼Í£ÓÃ¡£³ý·ÇÓÐÃ÷È·¹æ¶¨£¬·ñÔòrouter²»»á×ªËÍËÍÍù192.168.2.xxxµÄÊý¾Ý°ü£¬Òò´ËÍøÂ·ÎÞÓÉ½øÈë¡£¹Ø±ÕIP Forwarding¹¦ÄÜµÄÔ­ÒòÊÇ²¿¶ÓÍøÂ··¢³öµÄÊý¾Ý°ü²»ÈÃµ½´ïÍâ¼®¾üÍÅÍøÂ·£¬Íâ¼®¾üÍÅÍøÂ·µÄÊý¾Ý°üÒ²²»ÈÃµ½´ï²¿¶ÓÍøÂ·¡£
¿ÉÒÔÉè¶¨NFSËÅ·þÆ÷µÄÉèÖÃ£¬Ê¹Æä°Ñ²»Í¬ÎÄµµËÍÍù²»Í¬ÍøÂ·¡£ÕâÖÖ·½·¨ÆÄÎªºÃÓÃ£¬ÔÚsymblic linksÉÏ×ö·¬ÊÖ½Å¿ÉÊ¹ÎÄµµÈÃ´ó¼Ò¹²Ïí¡£ÀûÓÃÕâÖÖÉèÖÃºÍ¼ÓÒ»ÕÅethernet¿¨¿ÉÊ¹Ò»Ì¨ÎÄµµËÅ·þÆ÷ÓÃÓÚËùÓÐÈý¸öÍøÂ·¡£


\subsubsection{´úÀíËÅ·þÆ÷µÄÉèÖÃ}

ÓÉÓÚÈýÅúÈËÂí¶¼ÐèÒªÁË½âÍøÉÏµÄÇé¿ö£¬Òò´ËËûÃÇ¶¼ÐèÒªÉÏÍø¡£Íâ²¿ÍøÂ·Ö±½ÓÁ¬µ½Íø¼ÊÍøÂ·£¬Òò´ËÔÚ´úÀíËÅ·þÆ÷ÉÏ²»ÐèÒª×÷³öÈÎºÎ¸ü¶¯¡£Íâ¼®¾üÍÅÍøÂ·ºÍ²¿¶ÓÍøÂ·ÔÚ·À»ðÇ½Ö®áá£¬Òò´ËÐèÒªÔÚ´úÀíËÅ·þÆ÷ÉÏ×÷³öÒ»Ð©ÉèÖÃ¡£
Á½¸öÍøÂ·µÄÉèÖÃ·Ç³£ÀàËÆ¡£ËüÃÇÈÔ¾ÉÊ¹ÓÃ·ÖÅä¸øËüÃÇµÄIPµØÖ·¡£²»¹ýÔÚÕâÀïµÃÉè¶¨Ò»Ð©²ÎÊý¡£
\begin{enumerate}
\item ÈÎºÎÈË¶¼²»µÃÊ¹ÓÃÎÄµµËÅ·þÆ÷ÉÏÍø£¬·ñÔòÎÄµµËÅ·þÆ÷¿ÉÄÜ»áÔâµ½²¡¶¾»òÆäËû»µ¶«Î÷µÃÈëÇÖ¡£ÕâÖÖÎÊÌâÖÁÎªÑÏÖØ£¬Òò´Ë²»µÃÊ¹ÓÃÎÄµµËÅ·þÆ÷¡£
\item ²»ÈÃ²¿¶ÓÈËÔ±ÉÏÍø¡£ËûÃÇÕýÔÚ½ÓÊÜÑµÁ·£¬Èç¹ûÈÃËûÃÇÓµÓÐÕâÖÖ¼ìË÷×ÊÑ¶µÄÄÜÁ¦¿ÉÄÜ¶ÔËûÃÇÓÐº¦¡£
\end{enumerate}

Òò´Ë£¬ÔÚ²¿¶ÓÍøÂ·µÄlinux»úÉÏsockd.confµµÄÚÓ¦ÓÐÏÂÁÐÒ»ÐÐ¡Ã 
\begin{verbatim}
    deny 192.168.2.17  255.255.255.255
\end{verbatim}

²¢ÇÒÔÚÍâ¼®¾üÍÅ»úÄÚµÄÉè¶¨ÊÇ¡Ã
\begin{verbatim}
    deny 192.168.2.23  255.255.255.255
\end{verbatim}

Í¬Ê±£¬²¿¶ÓÍøÂ·µÄlinux»úÄÚÉè¶¨¡Ã
\begin{verbatim}
    deny 0.0.0.0  0.0.0.0 eq 80
\end{verbatim}


ÕâÐÐµÄÒâÒåÊÇ²»ÈÃÈÎºÎ»úÆ÷Ê¹ÓÃ²ººÅ80£¬¼Èhttp²º¡£²»¹ýÕâÐ©»úÆ÷ÈÔÈ»¿ÉÓÃËùÓÐÆäËû¹¦ÄÜ£¬Ö»ÊÇ²»ÈÃÉÏÍø¡£
È»ááÔÚÁ½Ì¨»úÆ÷µÄsockd.confµµÄÚ¶¼Ìí¼Ó¡Ã
\begin{verbatim}
    permit 192.168.2.0  255.255.255.0
\end{verbatim}

Ê¹ËùÓÐÔÚ192.168.2.xxxÍøÉÏµÄµçÄÔ¶¼Ê¹ÓÃÕâÌ¨´úÀíËÅ·þÆ÷£¬µ«²»ÈÃÊ¹ÓÃµÄµçÄÔ³ýÍâ£¨¼È´Ó²¿¶ÓÍøÂ·½øÈëÎÄµµËÅ·þÆ÷ºÍÍø¼ÊÍøÂ·£©¡£

²¿¶ÓÍøÂ·µÄsockd.confµµµÄÄÚÈÝÈçÏÂ¡Ã
\begin{verbatim}
    deny 192.168.2.17  255.255.255.255
    deny 0.0.0.0  0.0.0.0 eq 80
    permit 192.168.2.0  255.255.255.0
\end{verbatim}

Íâ¼®¾üÍÅÍøÂ·µÄsockd.confµµµÄÄÚÈÝÈçÏÂ¡Ã
\begin{verbatim}
    deny 192.168.2.23  255.255.255.255
    permit 192.168.2.0  255.255.255.0
\end{verbatim}


ÕâÑùµÄÅäÖÃÓ¦¸ÃÃ»ÓÐÎÊÌâ¡£Ã¿Ò»¸öÍøÂ·¶¼ÄÜµ¥¶À×÷Òµ£¬²¢ÓÐÊÊµ±µÄÏà»¥¹ØÏµ¡£ÈËÈË¶¼Ó¦¸ÃÐÄÂúÒâ×ã²Å¶Ô¡£
ÏÖÔÚ¾Í¿ÉÕ÷·þÊÀ½çÁË£¡



\end{document}
