天融信防火墙命令

Helpmodechinesel区域权限：pfserviceaddnamewebui(gui/ping/telent)area区域名addressnameanyweb管理服务开启：systemhttpdstartweb界面权限添加：pfserviceaddnamewebuiarea区域名addressnameany添加网口ip：networkinterfaceeth16ipadd192.168.4.12mask255.255.255.0label0禁用网口：networkinterfaceeth16shutdown启用网口：networkinterfaceeth16noshutdown交换模式：networkinterfaceeth16switchport（noswitchport路由模式）区域设置：defineareaaddnameE1attribute网口accessoff（on）《off权限禁止，on权限允许》主机地址：definehostaddname主机名ipaddr192.1.1.1子网地址：definehostsubnetaddname名字ipaddr192.168.1.1mask25.255.255.0自定义服务：defineserviceaddname名称protocol6port端口号(6是tcp的协议码)vlan添加ip：networkinterfacevlan.0001ipadd192.168.1.1mask255.255.255.0label0web服务器外网访问1）设置E1区域#defineareaaddnameE1accessonattributeeth12）定义WEB服务器真实地址#definehostaddnameWEB_serveripaddr172.16.1.23)定义WEB服务器访问地址#definehostaddnameMAP_IPipaddr202.99.27.1994)定义服务端口#defineserviceaddnameWeb_portprotocol6port8080说明：“6”是TCP协议的协议码5)设置地址转换规则#natpolicyaddsrcareaE1orig_dstMAP_IPorig_servicehttptrans_dstWeb_servertrans_serviceWeb_port路由adlsADS拨号设置1）设置ADSL拨号参数#networkadslsetdeveth0usernameadsl1234passwd123456attributeadsl2）定义外网区域（adsl-a）#defineareaaddnameadsl-aattributeadslaccesson3）配置地址转换策略#natpolicyaddsrcareaarea_eth1dstareaadsl-atrans_srcadsl4）拨号#networkadslstart5）查看拨号连接情况#networkadslshowstatusSTATE:PHASE_RUNNINGRX_BYTES:815TX_BYTES:2021RX_PKTS:13TX_PKTS:42LOCALIP:168.22.100.3PEERIP:168.22.100.1ELAPS:586Dhcp配置1）配置Eth1口的IP地址#networkinterfaceeth1ipadd10.10.10.1mask255.255.255.0系统自动为物理接口eth1绑定属性“eth1”。2）添加区域对象，指定对区域对象的访问权限为允许访问，并将区域与属性eth1绑定。#defineareaaddnamearea_eth1accessonattributeeth13）开放该区域的DHCP服务#pfserviceaddnamedhcpareaarea_eth1addressnameany4)配置DHCP服务器首先要配置DHCP服务器的地址池#networkdhcpserveradd_subnetsubnet10.10.10.0submask255.255.255.0gateway10.10.10.1sub_start10.10.10.23sub_end10.10.10.33pri_dns202.106.0.20如果需要，DHCP服务器可以给指定MAC地址的主机绑定IP地址。#networkdhcpserveradd_hostnamebindmacaddr00:50:04:c3:b0:31ipaddr10.10.10.255)在eth1口启动DHCP服务器#networkdhcpserverstartoneth16)查看已分配的IP情况#networkdhcpshowbindedweb服务器外网访问1）设置E1区域#defineareaaddnameE1accessonattributeeth12）定义WEB服务器真实地址#definehostaddnameWEB_serveripaddr172.16.1.23)定义WEB服务器访问地址#definehostaddnameMAP_IPipaddr202.99.27.1994)定义服务端口#defineserviceaddnameWeb_portprotocol6port8080说明：“6，”是TCP协议的协议码5)设置地址转换规则#natpolicyaddsrcareaE1orig_dstMAP_IPorig_servicehttptrans_dstWeb_servertrans_serviceWeb_port目的地址转换：natpolicyaddsrcareaadslaorig_dstadslorig_serviceanyshare端口trans_dst营销系统主机natpolicyaddorig_srcanyorig_dstadslorig_serviceanyshare端口trans_dst营销系统主机区域源地址转换：natpolicyaddsrcareaarea_eth11dstareaadslatrans_srcadslenableyes访问控制firewallpolicyaddactionacceptsrcareaarea_eth12dstareaarea_eth11firewallpolicyaddactionacceptsrcanydstareaarea_eth11源地址转换1）定义区域对象#defineareaaddnamearea_eth1accessonattributeeth1#defineareaaddnamearea_eth0accessoffattributeeth02）定义内网地址对象#definesubnetaddname子网100.xipaddr192.168.100.0mask255.255.255.03）定义NAT地址#definehostaddnamenat-ipipaddr202.10.10.1mask255.255.255.0定义NAT地址池#definerangeaddnamenat-poolip1202.10.10.1ip2202.10.10.104）定义NAT地址转换规则转换为固定nat-ip#natpolicyadddstareaarea-eth1orig_src子网100.xtrans_srcnat-ipenableyes在地址池中动态选择转换后的IP#natpolicyadddstareaarea-eth1orig_src子网100.xtrans_srcnat-poolenableyes