커널 설정
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100
options IPDIVERT ---> natd 설정
options DUMMYNET ---> 대역폭 설정룰
options TCP_DROP_SYNFIN ---> 포트스캔 방지

-----------------------------------------------------------------------
rc.conf 수정
firewall설정 및 nat 설정함

firewall_enable="YES"
firewall_type="ipfw" ---> 자신의 방화벽룰 이름
firewall_script="/etc/ipfw" ---> 자신의 방화벽룰 설정파일
firewall_quiet="YES"
gateway_enable="YES" ---> 2개의 인터페이스간에 패킷을 허용
natd_enable="YES"
natd_interface="xl0" ---> 내측 인터페이스
natd_flags="-f /etc/natd.conf"
portmap_enable="NO"
tcp_drop_synfin="YES"

-----------------------------------------------------------------------
natd.conf룰
log no ---> yes 라면 /var/log/alias.log 에 기록되는
verbose no ---> 기동시에는 no
deny_incoming no ---> yes 이라면 외부로부터의 접속을 거부
log_denied yes ---> 거부한 패킷을 기록
log_facility security ---> 디폴트는 daemon
use_sockets yes ---> socket 을 사용해 NAT 의 실패를 회피
same_ports yes ---> 가능한 한 같은 포토 번호를 사용
unregistered_only yes


-----------------------------------------------------------------------
ipfw 방화벽룰

fwcmd="/sbin/ipfw -q"
fwcmd="/sbin/ipfw"
${fwcmd} -f flush

# 외부 네트웍
oif="랜카드"
onet="게이트웨이"
omask="넷마스크"
oip="자신의 ip"

# 내부 네트웍
iif="xl0"
inet="192.168.0.0/24"
imask="255.255.255.0"
iip="192.168.0.1"


-----------------------------------------------------------------------
# loopback
${fwcmd} add pass ip from 127.0.0.1 to 127.0.0.1 via lo0
${fwcmd} add pass ip from 127.0.0.1 to ${oip} via ${oif}
${fwcmd} add pass ip from ${oip} to 127.0.0.1 via lo0
${fwcmd} add pass tcp from ${oip} to ${iip} via xl0
${fwcmd} add pass tcp from ${iip} to ${oip} via ${oif}


-----------------------------------------------------------------------
# NAT 적용
${fwcmd} add divert natd all from any to any via ${natd_interface}

-----------------------------------------------------------------------
# 접속된 TCP 패킷을 허가
${fwcmd} add pass tcp from any to any established

-----------------------------------------------------------------------
# DNS IN
${fwcmd} add pass udp from 0.0.0.0 to ${oip} 53 keep-state

-----------------------------------------------------------------------
# SMTP 허용
${fwcmd} add pass tcp from any to ${oip} 25 keep-state setup
${fwcmd} add reset tcp from any to any 113 keep-state

-----------------------------------------------------------------------
# WWW
${fwcmd} add check-state
${fwcmd} add pass tcp from any to ${oip} 80 keep-state setup

80%의 트래픽만을 통과
${fwcmd} add prob 0.8 pass tcp from any to ${oip} 80 in
${fwcmd} add prob 0.8 pass tcp from ${oip} 80 to any out

-----------------------------------------------------------------------
# FTP
passive 모드작동 1024-2048포트로 무작위 접속
21번 포트를 통해서 데이터 전송

${fwcmd} add check-state
${fwcmd} add pass tcp from any to ${oip} 21 keep-state setup
${fwcmd} add pass tcp from any 1024-2048 to any 1024-2048 keep-state setup

동시접속 1명으로 제한
${fwcmd} add pass tcp from any to ${oip} 21 keep-state setup limit src-addr 1

50%의 트래픽허용/50KB의 업로드 속도제한
${fwcmd} add prob 0.5 pass tcp from any to ${oip} 21 in
${fwcmd} add pipe 3 tcp from any to ${oip} 21 in
${fwcmd} pipe 3 config bw 50 KBytes/s

50%의 트래픽허용/50KB의 다운로드 속도제한
${fwcmd} add prob 0.5 pass tcp from ${oip} 21 to any out
${fwcmd} add pipe 4 tcp from ${oip} 21 to any out
${fwcmd} pipe 4 config bw 50 KBytes/s

-----------------------------------------------------------------------
# ssh
${fwcmd} add check-state
${fwcmd} add pass tcp from any to ${oip} 22 keep-state
${fwcmd} add pass tcp from any to ${oip} 22 keep-state limit src-addr 2
${fwcmd} add pipe 5 tcp from any to me 22 in
${fwcmd} pipe 5 config bw 50 KBytes/s

-----------------------------------------------------------------------
# 그 이외의 외측으로부터의 TCP 접속을 거부 로그기록
${fwcmd} add deny log tcp from any to any in via ${oif} setup

-----------------------------------------------------------------------
# 상기 이외 안쪽으로부터 TCP 접속허가
${fwcmd} add pass tcp from any to any setup

-----------------------------------------------------------------------
# ping 응답만 허가
${fwcmd} add pass icmp from ${oip} to any out via ${oif} icmptypes 8
${fwcmd} add pass icmp from any to ${oip} in via ${oif} icmptypes 0

# 그 이외의 것 ICMP 파기 로그기록
${fwcmd} add deny log icmp from any to any


-----------------------------------------------------------------------
# DNS OUT
${fwcmd} add pass udp from ${oip} to 0.0.0.0 53 keep-state


# 모두 접속 거부
${fwcmd} add deny tcp from any to any