Last update 2011.06.12
RTA54iにPPPoEのせるてサーバ公開する場合はこんな感じです。
# For YAMAHA RTA54i Rev.4.04.03
# PPPoE NAPT 使わずサーバ公開
# ダイナミックファイルタバージョン
#
###### インターネット側設定
# Network ID = [NetworkID]
# CIDR = [CIDR]
# RouterのIPアドレス = [Router]
# DNS Server = [dns server]
# SMTP Server = [smtp server]
# POP3 Server = [pop3 server]
# IMAP Server = [imap server]
# HTTP Server = [http server]
# NTP Server = [ntp server]
# ドメイン名 = [domain name]
# Syslog Host = [syslog server]
# ルータのパスワード = [RouterPassword]
#
###### PPPoE設定
# PPPoE UserID = [PPPoE ID]
# PPPoE Password = [PPPoE PASSWORD]
#
#########################################################
# 環境
#########################################################
# デフォルトの DHCP を無効にする
dhcp service off
dhcp delete scope 1
# Password
login password
[RouterPassword]
[RouterPassword]
administrator password
[RouterPassword]
[RouterPassword]
# セキュリティクラス
security class 2 off off
# 表示カラム拡大
console columns 200
# スクロールノンストップ
console lines infinity
# ルータの IP アドレス
ip lan1 address [Router]/[CIDR]
# Syslog
syslog notice on
# syslog サーバが存在しない場合は無効にする
syslog host [syslog server]
# DNS
dns domain [domain name]
dns syslog resolv on
dns server [dns server]
# 時刻合わせスケジュール
schedule at */* *:15 * ntpdate [ntp server]
# PPPoE再接続スケジュール
schedule at startup 1 connect 1
schedule at */* *:00 1 connect 1
#########################################################
# 1-19 プライベート ループバック 自己空間 その他
#########################################################
# 送信元が自己アドレス空間
ip filter 1 reject [NetworkID]/[CIDR] * * * *
# 宛先が自己アドレス空間
ip filter 2 reject * [NetworkID]/[CIDR] * * *
# 送信元がプライベトー or ループバック
ip filter 3 reject 192.168.0.0/16 * * * *
ip filter 4 reject 172.16.0.0/12 * * * *
ip filter 5 reject 10.0.0.0/8 * * * *
ip filter 6 reject 127.0.0.0/24 * * * *
# 宛先がプライベトー or ループバック
ip filter 7 reject * 192.168.0.0/16 * * *
ip filter 8 reject * 172.16.0.0/12 * * *
ip filter 9 reject * 10.0.0.0/8 * * *
ip filter 10 reject * 127.0.0.0/24 * * *
#########################################################
# 20-29 スタティックフィルタ
#########################################################
ip filter 20 pass * [NetworkID]/[CIDR] icmp-error * *
ip filter 21 pass * [dns server] udp 53 *
# 特別に処理したいパケットがあればここに記述
#########################################################
# 30-49 セキュリティアップ
#########################################################
ip filter 30 reject * * tcp,udp * 1,7,11,15,31,41,43,58,67-70,79
ip filter 31 reject * * tcp,udp * 87,95,109,111,135,137-139,144,146,161-162,177
ip filter 32 reject * * tcp,udp * 220,445,512-515,517-518,520,531,540-541,555,568-569,666
ip filter 33 reject * * tcp,udp * 911,999,1001,1010-1012,1015,1024-1025,1042,1045,1090,1234
ip filter 34 reject * * tcp,udp * 1243,1433-1434,1477-1478,1492,1512,1600,1723,1755,1801,1807
ip filter 35 reject * * tcp,udp * 1981,1999-2005,2023,2049,2115,2140,2393-2394,2525,2565,2583
ip filter 36 reject * * tcp,udp * 2766,2773-2774,2801,3024,3129,3150,3268-3269,3389,3700,4092
ip filter 37 reject * * tcp,udp * 4567,5000-5001,5321,5400-5402,5555-5557,5569,5631-5632,5742,6000-6999,7000
ip filter 38 reject * * tcp,udp * 7215,7300-7301,7306-7308,7789,8080,9872-9875,9989,10067,10167,10520
ip filter 39 reject * * tcp,udp *
10607,11000,11111,11223,12076,12223,12345-12346,12361-12363,12631,13000
ip filter 40 reject * * tcp,udp * 16959,20034,21554,22222,23456,23476-23477,26274,27374,30100-30102,31337
ip filter 41 reject * * tcp,udp * 31785,31787-31789,31791-31792,40421-40423,40426,54283,54320-54321,60000
# 特別に処理したいパケットがあればここに記述
#########################################################
# 1000-1099 ダイナミックフィルタトリガ/スタティック(IN)
#########################################################
ip filter 1000 pass * [dns server] tcp,udp * domain
ip filter 1001 reject * [dns server] established * domain
ip filter 1002 pass * [smtp server] tcp,udp * smtp
ip filter 1003 reject * [smtp server] established * smtp
ip filter 1004 pass * [pop3 server] tcp,udp * pop3
ip filter 1005 reject * [pop3 server] established * pop3
ip filter 1006 pass * [http server] tcp,udp * www
ip filter 1007 reject * [http server] established * www
ip filter 1008 pass * [smtp server] tcp,udp * 113
ip filter 1009 reject * [smtp server] established * 113
ip filter 1010 pass * [imap server] tcp,udp * 143
ip filter 1011 reject * [imap server] established * 143
# 特別に処理したいパケットがあればここに記述
# ip filter 1012 pass * [hogehoge1 server] tcp,udp * 8181
# ip filter 1013 reject * [hogehoge1 server] established * 8181
# ip filter 1014 pass * [hogehoge2 server] tcp,udp * 8383
# ip filter 1015 reject * [hogehoge2 server] established * 8383
#########################################################
# 1100-1199 ダイナミックフィルタ定義(IN)
#########################################################
ip filter 1100 pass * * tcp,udp * 113
ip filter 1101 pass * * tcp,udp 113 *
ip filter 1102 pass * * tcp,udp * 143
ip filter 1103 pass * * tcp,udp 143 *
# 特別に処理したいパケットがあればここに記述
# ip filter 1104 pass * * tcp,udp * 8181
# ip filter 1105 pass * * tcp,udp 8181 *
# ip filter 1106 pass * * tcp,udp * 8383
# ip filter 1107 pass * * tcp,udp 8383 *
#########################################################
# 1200-1299 ダイナミックフィルタ実装(IN)
#########################################################
ip filter dynamic 1200 * [dns server] domain syslog=off
ip filter dynamic 1201 * [smtp server] smtp syslog=off
ip filter dynamic 1202 * [pop3 server] pop3 syslog=off
ip filter dynamic 1203 * [http server] www syslog=off
ip filter dynamic 1204 * [smtp server] filter 1008 in 1100 out 1101 syslog=off
ip filter dynamic 1205 * [imap server] filter 1010 in 1102 out 1103 syslog=off
# 特別に処理したいパケットがあればここに記述
# ip filter dynamic 1206 * [hogehoge1 server] filter 1012 in 1104 out 1105 syslog=off
# ip filter dynamic 1207 * [hogehoge2 server] filter 1014 in 1106 out 1107 syslog=off
#########################################################
# 2000-2099 ダイナミックフィルタトリガ/スタティック(OUT)
#########################################################
ip filter 2000 pass [NetworkID]/[CIDR] * tcp,udp * domain
ip filter 2001 pass [NetworkID]/[CIDR] * tcp,udp * smtp
ip filter 2002 pass [NetworkID]/[CIDR] * tcp,udp * pop3
ip filter 2003 pass [NetworkID]/[CIDR] * tcp,udp * www
ip filter 2004 pass [NetworkID]/[CIDR] * tcp,udp * ftp
ip filter 2005 pass [NetworkID]/[CIDR] * tcp,udp * telnet
ip filter 2006 pass [NetworkID]/[CIDR] * tcp,udp * 123
ip filter 2007 pass [NetworkID]/[CIDR] * tcp,udp * 143
# 特別に処理したいパケットがあればここに記述
# ip filter 2008 pass [NetworkID]/[CIDR] * tcp,udp * 8181
# ip filter 2009 pass [NetworkID]/[CIDR] * tcp,udp * 8383
# ip filter 2000 pass [NetworkID]/[CIDR] * tcp,udp * *
#########################################################
# 2100-2199 ダイナミックフィルタ定義(OUT)
#########################################################
ip filter 2100 pass * * tcp,udp * 123
ip filter 2101 pass * * tcp,udp 123 *
ip filter 2102 pass * * tcp,udp * 143
ip filter 2103 pass * * tcp,udp 143 *
# 特別に処理したいパケットがあればここに記述
# ip filter 2104 pass * * tcp,udp * 8181
# ip filter 2105 pass * * tcp,udp 8181 *
# ip filter 2106 pass * * tcp,udp * 8383
# ip filter 2107 pass * * tcp,udp 8383 *
# ip filter 2100 pass [NetworkID]/[CIDR] * tcp,udp * *
# ip filter 2101 pass * [NetworkID]/[CIDR] tcp,udp * *
#########################################################
# 2200-2299 ダイナミックフィルタ実装(OUT)
#########################################################
ip filter dynamic 2200 [NetworkID]/[CIDR] * domain syslog=off
ip filter dynamic 2201 [NetworkID]/[CIDR] * smtp syslog=off
ip filter dynamic 2202 [NetworkID]/[CIDR] * pop3 syslog=off
ip filter dynamic 2203 [NetworkID]/[CIDR] * www syslog=off
ip filter dynamic 2204 [NetworkID]/[CIDR] * ftp syslog=off
ip filter dynamic 2205 [NetworkID]/[CIDR] * telnet syslog=off
ip filter dynamic 2206 [NetworkID]/[CIDR] * filter 2006 in 2100 out 2101 syslog=off
ip filter dynamic 2207 [NetworkID]/[CIDR] * filter 2007 in 2102 out 2103 syslog=off
# 特別に処理したいパケットがあればここに記述
# ip filter dynamic 2208 [NetworkID]/[CIDR] * filter 2008 in 2104 out 2105 syslog=off
# ip filter dynamic 2209 [NetworkID]/[CIDR] * filter 2009 in 2106 out 2107 syslog=off
# ip filter dynamic 2200 [NetworkID]/[CIDR] * filter 2000 in 2100 out 2101
#########################################################
# その他
#########################################################
ip filter source-route on
ip filter directed-broadcast on
#########################################################
# インターネット接続
#########################################################
pp select 1
pppoe use lan2
pppoe auto connect on
pp auth accept chap pap
pp auth myname [PPPoE ID] [PPPoE PASSWORD]
# DNSサーバアドレスがキャリア側から取得出来る時は有効にしても良い
# ppp ipcp msext on
ppp lcp mru on 1454
ip pp mtu 1454
ppp ccp type none
# 侵入検知
ip pp intrusion detection in on reject=on
ip pp intrusion detection out on
# パケットフィルタリング実装
ip pp secure filter in 1 3 4 5 6 20 21 30 31 32 33 34 35 36 37 38 39 40 41 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 dynamic 1200 1201 1202 1203 1204 1205
ip pp secure filter out 2 7 8 9 10 30 31 32 33 34 35 36 37 38 39 40 41 2000 2001 2002 2003 2004 2005 2006 2007 dynamic 2200 2201
2202 2203 2204 2205 2206 2207
pp enable 1
ip route default gateway pp 1
#########################################################
# 保存と再起動
#########################################################
save
restart
Copyright © MURA All rights reserved.