关于ＳＵＳＥ１０防火墙的问题

zyangj

各位大侠：
　　本人一直在用红帽，可最近转用ＳＵＳＥ１０的时候，发现他的防火墙跟红帽有很大差别，导致我现在都不知怎么去设置这些规则，看了一些资料说，主要就是一个susefirewall2这个文件，要把里面二十来个参数填写正确就可以了，然后系统会自动根据参数产生规则，可我想自己手工来添加规则，如何来做啊？
　　并且我在红帽下面把规则写到.sh文件中了，可以批量执行，不行这个ＳＵＳＥ可不可以，请高手指教！
　　另外，不知哪个大侠有susefirewall2这个文档的中文资料啊？这些英文实在难懂啊，不知如何下手！

polox

/etc/sysconfig/csript/
下有个自定义的文件。修改后，修改稿SuSEfirewall2，将这个文件启用就可以了，好像是叫SuSEfirewall-custom

zyangj

多谢楼上的朋友，你让我的思想更进了一步，可还是不明了，这些东西该具体怎么改，我把内容贴出来，供大家来研究一下，我也不是很明白
fw_custom_before_antispoofing() {
    # these rules will be loaded before any anti spoofing rules will be
    # loaded. Effectively the only filter lists already effective are
    # 1) allow any traffic via the loopback interface, 2) allow DHCP stuff,
    # 3) allow SAMBA stuff [2 and 3 only if FW_SERVICE_... are set to "yes"]
    # You can use this hook to prevent logging of uninteresting broadcast
    # packets or to allow certain packet through the anti-spoofing mechanism.

#example: allow incoming multicast packets for any routing protocol
#iptables -A INPUT -j ACCEPT -d 224.0.0.0/24

   true
}

fw_custom_after_antispoofing() { # could also be named "before_port_splitting()"
    # these rules will be loaded after the anti-spoofing and icmp handling
    # but before any IP protocol or TCP/UDP port allow/protection rules
    # will be set.
    # You can use this hook to allow/deny certain IP protocols or TCP/UDP
    # ports before the SuSEfirewall2 generated rules are hit.

#example: always filter backorifice/netbus trojan connect requests and log them.
#for target in LOG DROP; do
#    for chain in input_ext input_dmz input_int forward_int forward_ext forward_dmz; do
#        iptables -A $chain -j $target -p tcp --dport 31337
#        iptables -A $chain -j $target -p udp --dport 31337
#        iptables -A $chain -j $target -p tcp --dport 12345:12346
#        iptables -A $chain -j $target -p udp --dport 12345:12346
#    done
#done

    true
}

fw_custom_before_port_handling() {
    # these rules will be loaded after the anti-spoofing and icmp handling
    # and after the input has been redirected to the input_XXX and
    # forward_XXX chains and some basic chain-specific anti-circumvention
    # rules have been set,
    # but before any IP protocol or TCP/UDP port allow/protection rules
    # will be set.
    # You can use this hook to allow/deny certain IP protocols or TCP/UDP
    # ports before the SuSEfirewall2 generated rules are hit.

    true
}

fw_custom_before_masq() { # could also be named "after_port_handling()"
    # these rules will be loaded after the IP protocol and TCP/UDP port
    # handling, but before any IP forwarding (routing), masquerading
    # will be done.
    # NOTE: reverse masquerading is before directly after
    #       fw_custom_before_port_handling !!!!
    # You can use this hook to ... hmmm ... I'm sure you'll find a use for
    # this ...

    true
}

fw_custom_before_denyall() { # could also be named "after_forwardmasq()"
    # these are the rules to be loaded after IP forwarding and masquerading
    # but before the logging and deny all section is set by SuSEfirewall2.
    # You can use this hook to prevent the logging of annoying packets.

#example: prevent logging of talk requests from anywhere
#for chain in input_ext input_dmz input_int forward_int forward_ext forward_dmz; do
#    iptables -A $chain -j DROP -p udp --dport 517:518
#done

    true
}

bigbighill

在yast控制中心设置不行码

polox

具体这些参数的中文资料，我这里也没有，是摸索着设置的。
我把自己定义的一些规则放在了第一节的后面：
#example: allow incoming multicast packets for any routing protocol
#iptables -A INPUT -j ACCEPT -d 224.0.0.0/24
iptables -A INPUT -p icmp -j DROP

上面是例子。

linuxahah

SUSE使用yast、yast2对所有东西进行管理。包括Firewall.

zyangj

感谢大伙的解答：
　　ＹＡＳＴ的配置只能按他上面规定的做，我还是喜欢用代码去解决问题。

　　要一个一个试的话，只能去慢慢看了，我下午把以前用的iptables.SH 文件，在ＳＵＳＥ上执行了一下，发现也可以改写，用iptables -vnL命令也可以看到防火墙的规则，但是这个时候打开ＹＡＳＴ的防火墙配置时，就提示目前有另一防火墙处于活动状态，要么启用SuSEfirewall2,删掉现有的，要有保持现用的，不启用SuSEfirewall2。

　　所以目前只有去慢慢试一些了，多谢大家！

Thruth

check this out
/etc/sysconfig/SuSEfirewall2

zyangj

楼上的意思是：运行这个SuSEfirewall2?

Thruth

..............
那是配置文件
里面说明的很清楚

http://susefaq.sourceforge.net/articles/firewall/fw_manual.html