interface Ethernet 0/0 ! Mosbach lokal ip address 129.143.204.13 255.255.255.252 description Ethernet zum RZ-Router no ip directed-broadcast ! wg. Hacker (denial of service) ip inspect FIWA in ! Ueberpruefung des IP-Verkehrs ip access-group 101 in ! Anti-Spoofing ip access-group 102 out ! zusaetzliches Welt-LAN-Filter wegen Servern no shutdown ! no access-list 101 access-list 101 permit tcp 129.143.204.12 0.0.0.3 any ! RZ-Router Anti-Spoofing access-list 101 permit udp 129.143.204.12 0.0.0.3 any ! RZ-Router Anti-Spoofing access-list 101 permit icmp 129.143.204.12 0.0.0.3 any ! RZ-Router Anti-Spoofing access-list 101 permit tcp 193.196.5.0 0.0.0.255 any ! Netz der BA-Mo Anti-Spoofing access-list 101 permit udp 193.196.5.0 0.0.0.255 any ! Netz der BA-Mo Anti-Spoofing access-list 101 permit icmp 193.196.5.0 0.0.0.255 any ! Netz der BA-Mo Anti-Spoofing access-list 101 deny ip any any ! ! Zulassen von gewissen Diensten auf die Server no access-list 102 ! access-list 102 permit tcp any any eq 22 ! SSH access-list 102 permit tcp any any eq 113 ! Ident access-list 102 permit tcp any any eq 487 ! SAFT ! permit tcp any gt 1023 host 193.196.5.107 eq 21 ! FTP-Commands (fuer PASV FTP) permit tcp any gt 1023 host 193.196.5.105 eq 21 ! FTP-Commands (fuer PASV FTP) ! access-list 102 permit tcp any host 193.196.5.107 eq 25 ! SMTP zulassen access-list 102 permit tcp any host 193.196.5.105 eq 25 ! SMTP zulassen ! access-list 102 permit tcp host 129.143.2.1 host 193.196.5.107 eq 53 ! DNS Zone-Transfer access-list 102 permit tcp host 129.206.100.126 host 193.196.5.107 eq 53 ! DNS Zone-Transfer access-list 102 permit tcp host 129.206.100.127 host 193.196.5.107 eq 53 ! DNS Zone-Transfer access-list 102 permit tcp host 129.143.2.1 host 193.196.5.105 eq 53 ! DNS Zone-Transfer access-list 102 permit tcp host 129.206.100.126 host 193.196.5.105 eq 53 ! DNS Zone-Transfer access-list 102 permit tcp host 129.206.100.127 host 193.196.5.105 eq 53 ! DNS Zone-Transfer
access-list 102 permit permit tcp any host 193.196.5.107 eq 80 ! WWW access-list 102 permit permit tcp any host 193.196.5.105 eq 80 ! WWW ! access-list 102 permit tcp any host 193.196.5.107 eq 119 ! nntp access-list 102 permit tcp any host 193.196.5.105 eq 119 ! nntp ! access-list 102 permit udp any host 193.196.5.107 eq 123 ! ntp access-list 102 permit udp any host 193.196.5.105 eq 123 ! ntp ! access-list 102 permit tcp any host 193.196.5.107 eq 389 ! ldap access-list 102 permit tcp any host 193.196.5.105 eq 389 ! ldap ! access-list 102 permit tcp any host 193.196.5.107 eq 443 ! https access-list 102 permit tcp any host 193.196.5.105 eq 443 ! https ! access-list 102 permit tcp any host 193.196.5.107 eq 993 ! Secure-IMAP access-list 102 permit tcp any host 193.196.5.105 eq 993 ! Secure-IMAP ! access-list 102 permit tcp any host 193.196.5.107 eq 995 ! Secure-POP3 access-list 102 permit tcp any host 193.196.5.105 eq 995 ! Secure-POP3 ! ! bei geringeren Sicherheitsanforderungen: ! access-list 102 permit tcp any host 193.196.5.107 eq 110 ! POP3 zulassen access-list 102 permit tcp any host 193.196.5.105 eq 110 ! POP3 zulassen access-list 102 permit udp any host 193.196.5.105 eq 53 ! DNS-Anfragen access-list 102 permit udp any host 193.196.5.107 eq 53 ! DNS-Anfragen ! ! access-list 102 permit icmp any host 193.196.5.107 administratively-prohibited access-list 102 permit icmp any host 193.196.5.107 echo access-list 102 permit icmp any host 193.196.5.107 echo-reply access-list 102 permit icmp any host 193.196.5.107 packet-too-big access-list 102 permit icmp any host 193.196.5.107 time-exceeded access-list 102 permit icmp any host 193.196.5.107 traceroute access-list 102 permit icmp any host 193.196.5.107 unreachable access-list 102 deny ip any any ! ip inspect name FIWA http java-list 50 ! JavaScript ablehnen nach ACL 50 ip inspect name FIWA realaudio timeout 3600 ip inspect name FIWA smtp timeout 3600 ip inspect name FIWA tftp timeout 30 ip inspect name FIWA ftp timeout 3600 ip inspect name FIWA udp timeout 15 ip inspect name FIWA tcp timeout 3600 ! no access-list 50 access-list 50 permit any log
评:虽然是很好.但是访问列表过多,一旦被DOS一攻可能路由器马上瘫痪…重启…所以我认为要在前面加多一台Router来做个TCP Intercept 来拦截DOS攻击.如下: 假如管理到个服务器群网络上192.168.111.0 & 192.168.112.0 内的目标主机的TCP连接请求.使用拦截模式,随机丢弃连接: access-list 123 permit tcp any 192.168.111.0 0.0.0.255 access-liat 123 permit tcp any 192.168.112..0 0.0.0.255 ip tcp intercept list 123 ip tcp intercept mode intercept ip tcp intercept drop-mode random
做好以后.两个Router在做个HSRP …….. |
