báo cáo Internet gateway với firewall open sources

MỤC LỤC
Internet Gateway với Firewall Open Sources Trang 1
CHƯƠNG 1. TỔNG QUAN
1.1. Tổng quan tường lửa

 !"#$%!& '&( )
*+"& ,#!-#!
.&/001234& &
+5,+6$#)124
".!7! )*+
&#!8/005*+!#$#19 !
& (':-;&<& 
*+"6& ($#(=')*+
>?@9A1@BC$#$#D4(
E',)!=& +F+)*+"D4
.+F+G & H+
$I1
#$++J=)(
 )*+".! )*+ +++.
K.8$-!#$#$-"&E
J=',&#!':-4&"L
'"L)&%DE1MH+
C"&%J3.+
N5*+>/OPAC$1@Q
J==<&#)5)&&
'RS).+F+&!<&#:
&Q1
2!&#.!"6!T
:U
• $V0$$%1
• !'%U+N)"'%+#1

Internet Gateway với Firewall Open Sources 2
• )&WHS1
• 9X.1
D#+Y#++$*W1ZG
#4TC$*& *+!#
C"&T)!Y.!4$%H.
 +$%4:.1[$.C
.SB +TG&$W
  +#$%H1
@4$.!C$U>P+0A\0]0"@^900"
?++^900P0_`)0/+01@34T
&!$L$Q +=
TC!#++')H1
1.1.1. Stac packet-ltering rewall
\0^a0( )*+$Q
0'0Y41";&(7
':.-G/\E"/\&;"W'%1
'!)H+CN:'R
)4N&%& 4&8$-)$-
!-"'b&'c'$%8G4!1
P+0a0& N0I&."
!&#IG+d>G+`!AYSeP/12434& 
$%&%)=N0#01
Internet Gateway với Firewall Open Sources 3
Hình 1: Packet-filter trong mô hình OSI
1.1.2. Applicaon-level rewal
`#IG+f'6& (+N)1\N)
#$#);F+48#!
&#!gF+)&E7&W&%D
E&%D&;&$T!-=!

Y.1G+f'7( 
!':-'%/00'R&)=*',
1`#+N)00&*+'%L'
#)&Ch"!&5)47+5;4',1
i48$-&W)"B& &
&N&%;4+F+4)&!
#$#)1
9!)I&HY!SX4
&&+& &&N&%G
+F+&!#$#1G+L'& N0
L"B!&#!G+L'>G+jA
YSeP/1
Hình 2: Tường lửa lớp ứng dụng
1.1.3. Circuit-level rewall
Internet Gateway với Firewall Open Sources 4
@^00'R&I!+-.,
'R*)1@B!&#!G+\->G+kAYSeP/1
Pe@iP>Pe@i0P@\V/\A'!^00
& +'H1^006& $&
+N)".':-"L+#
'Y !1@B+F+=8.)+
4':-C4& I&>&%DEV&;"
.+EV&;A1^003& N0
LYSC!&#.G
G+L'
Hình 3: Circuit-level firewall
1.1.4. Stateful inspecon rewall
!&!=$.
 !1lQE&%D&;"'
L'"E.".,4!

4GYR#01!4
H+#+!)*+#'R!&#4
m)T"Y&#0'nJ=':
!&#+F+1!
!&#CGLf'"& N0
Internet Gateway với Firewall Open Sources 5
L$"!&#IG+`!G+o*
>G+dpAYSeP/1
Hình 4:Stateful inspection firewall
1.2. Các mô hình triển khai tường lửa
@4$'!B& U#G+"
G+"$G+>6& (TG+A1iB
#G+& .#0&/00>=,
R!A1`S#G+,
;J=#HC$"B)
:& C$*.1
iBG+'#4$0q
0_0I-"+F+*+-#RO`r=
sN0&+G!$-1O`r& '&=
,.)Y'R$-4
)*+1
`#B$G+YT!,
!#$#/00J$I1`X
4)K(-=C&!)T)*+$H
 +.!',!)1`!R
& #RO`r19G+!L4
#G+!)+Q+;
Internet Gateway với Firewall Open Sources 6
J+L!+0)-Y)Y!RO`r>;'U
'$0"q0$00tA1`!L$=$^0'4X

 !#$#1iB)H")-L&#
+L!+CGB6!1
Hình 5: Mô hình tường lửa một lớp
Hình 6: Two-tier
Hình 7: Three-tier
1.3. Tổng quan pfSense
\_P00#':EI':-T&T
]00lPO& '#=#$%&%
)1@l00Pu*+':
vvqJwvvp1)-!&wvvp"+=+
H&T4J<EY(C;.G
++; ++L>$%'xp`ly?`A1
\_P00G:+0&<X #<T
+L& :&44+G8#&#
'<EIG1@RGLJ
!7"5G'R-+_P00& #&E
'#<'+8z1\_P00
)-HS+LH+-+R +; +
Internet Gateway với Firewall Open Sources 7
$%; +QJ;&#
HS*1
\-$+_P00!& $.w1{"*++
;JX !/\x1
1.4. Một số phương pháp triển khai thực tế
ZG;J!"+_P00& 'T
&;-:1oH+CG
,$%R!"X ,;JC$5
Z\2"lo\"|00"5$Q"}Pt
@LJ& '$EU
• UG;JN4@\V/\!7"

-+_P00& 'R#Q(
,. +++&#+5R!
D&%1
• $%&%)!|?2V9?2U&46#
0"+_P00X LJ&%)
\\s"lo\t+R +'+G
H+&-0RL
J1!9?2"+_P00X 
L~vw1{+F+5-•*4!
&%+5R!#$#1\_P004
X $Jdo$+=NCkvv1vvv4
V5)"S*)+_P004')#
$%qG+d>)-4-'!A1
• |00?0\1
• `)YZ\2VO2PVOM@\VP€0U+_P00& ;
 +-<EI)O2P
>+UVV)'1A"+'+>+UVVqqq1+'+1VA
Q+G6)YO2P=)Y
€0>*+4+5;A1
Internet Gateway với Firewall Open Sources 8
1.5. Các nền tảng phần cứng hỗ trợ
90@OU5-%.4'+_P00$Q
I&#<E+_P00':+-@O=
uPl1)-"+C++)& )'
'#.;J7&E% )*+:
1
@&=$%4B);>+0$0''00AU
&5)+C++& )'1\_P00& 
&=-$%);7X &)&Y;J
&<; +1)-"5-%B+_P00

X I&#TT&T>`^$A"S
*)$&Q$%,>MOO"PPOA4$%N4
KS&=1
; +>0$0''0'AU+_P00& &=-h@]4& 
'$%+L; +1)-'!
T,"-'-HS
'$#Gy?`.&,$*
S*1
Internet Gateway với Firewall Open Sources 9
CHƯƠNG 2. TRIỂN KHAI HỆ THỐNG PFSENSE
TRONG MÔI TRƯỜNG MẠNG DOANH NGHIỆP
2.1. Sơ đồ triển khai cơ bản
Hình 8: Sơ đồ hệ thống
   


{•w1{x~1v1v
Vwp
Z20v
>?$'A
\5R
!.
/00

{jw1{x1{v1v
Vwp
Z20~>M^
)A
\5R&=
)Y

q0$1
 
!
{v1v1v1vVwp
Z20{>M^
)A
\5R
!#$#1
2.2. Cài đặt pfSense
:@O&=\_00!q0$0qqq1+_00112
'R4'q'+-$&=+R +G
:!Oq'1M!+_P00&<X T
Internet Gateway với Firewall Open Sources 10
4Z`q0"'4; +:+!
'c'1
;'$-'G"B:&=+_P008*+
/Pe&<& &‚@O1@HS+L'$
EU"#$%"&''"()*+,(-+.(#
()"1
Hình 9: PfSense thông báo thông tin đăng nhập mặc định
2.3. Cấu hình pfSense cơ bản
!+)"B:HSLJC$
Y+_P00$Q'%|0$>|0$ou/A1:)
*+&%D/\.&<H+)+_P00Sj"
&J*+G=&%0U'"+q'U+_001
P&<&J*+"+_P007)-HS#
.C$+R +G.!'1
Internet Gateway với Firewall Open Sources 11
Hình 10: Cấu hình thông tin IP
!HS/\'!.G.|?2"

%-HS;N.G.|?2
'H+'%>/P\A&<H+1\_P00X '!
HS/\.|?2UOM@\VPV\\sV\\\1
@HS\_P00H+OM@\)0R!
9?21
@B:&J#'!R9?2G&%
D`?@CL!0/0_0ƒ?
Hình 11: Lựa chọn địa chỉ MAC tương ứng
Internet Gateway với Firewall Open Sources 12
+0"BHS/\"O2P'!
.GR!#$#1@BU +5-
%.'+_P00#)YOM@\S$K$#
'9?2+& HS&%D/\‚1
Hình 12: Thông tin mô tả card mạng
Hình 13: Địa chỉ IP được cấu hình tại card LAN
PHSC$"HBP0„?++)
0…1@)0P00ƒOM@\P00"(h
9?21
Hình 14: Cung cấp dãy IP mà pfSense cấp cho người dùng
Hình 15: Cung cấp DNS tại phía người dùng
Hình 16: Cung cấp Default gateway
PHS"!+;0:)-00
H+/\&)T1
Internet Gateway với Firewall Open Sources 13
Hình 17: Client đã được cấp IP từ pfSense
Hình 18: Kiểm tra kết nối mạng LAN
Hình 19: Kiểm tra kết nối Internet
Internet Gateway với Firewall Open Sources 14
Hình 20: Trạng thái cấp phát IP tại pfSense
2.4. Cấu hình tường lửa

2.4.1. Alias
?#+C++&=$;'#=T
/\V20qVuy9tQB+%-'c'&%
D!=$01
:)*+0ƒ?0&!G=D
1
Hình 21: Giao diện tạo alias
Hình 22: Alias Webserver1
+_P00X !$Q#'&%D/\& ,
8N":*+*':&#0&<
& HS1
Internet Gateway với Firewall Open Sources 15
Hình 23: URL Table Alias
Hình 24: Danh mục IP Trung Quốc
Hình 25: Alias danh mục website
2.4.2. NAT
20q?''0>2?A#C)&W/\& 
'#<"Q. /\+$.G
.!/001@C2?' '0#
':G)T',$'$'1
e$'2?'R)&W/\+0/\+$G
&;+F+);!#$#4.
/001/$'2?'R)&W/\8$-)
;#$#1
Internet Gateway với Firewall Open Sources 16
*/0/*/$ "1"2
!0ƒ2?ƒ(h\]q'":!
G#02?+F+);8/00)*+)
Yq0$RO`r1
Hình 26: NAT Webserver1 - DMZ

Internet Gateway với Firewall Open Sources 17
Hình 27: Truy cập máy chủ web từ Public IP
*/0/*/* )3&4"$5$
@HS2?0†0{U{& 'RN!{&%D/\+$
{/\+01
Hình 28: Cấu hình NAT Reflection 1:1
Internet Gateway với Firewall Open Sources 18
*/0/*/# 678"72
i'HS=&%2?e$'"+_P007
:&#!$2?+F+/\+0)*+
00/\+$1@HSb)$E
0+F+.Z\2&.")-%-
B!-0+R +G!!1
Hình 29: Automatic outbound NAT
[.G,!!+L!+)-HS,0
&#C&+R +GB!'+"4
(`e$'2?G&;R)$0
41
2.4.3. Rules
y0+C$.B+!
;!':-S@\V/\10HS=
&%Y+_P00"0+F+R!.G
")-)=+:')-
Internet Gateway với Firewall Open Sources 19
$*"5-%!R)$0+R
 +G;)*+!Y'+1
Hình 30: Rule mặc định được cấu hình tại card WAN
@BU +'2?+_q'S+_P00:
&#!0+R ++F+.8!|?2&R
O`r1

Hình 31: Rule được tạo tự động khi sử dụng NAT
@+C$Y0U
• ?U+_P004dR)(\Vl>Y)4
AVy0‡0>IyPT+;'RAg
• O$0'UK!&#Y0!
N4g
• @\V/\0U+_P00!&#G+-$/\p
/\xg
• \U+_P00+F+R)(L)T
',>@\"uO\"/@`\tAL&%)>eP\]"
/o`\Ag
• P0VO0>+AUD&%/\EV&;g
• 9U$*LJ0'n!&#Y0!1
2.4.4. Schedules
@LJ*+%+_P00+F+HS!
&#Y.#:&#$&<
& *+ˆ1lQ)".+_P007:&#&T
Da0q00*+%1
Internet Gateway với Firewall Open Sources 20
Hình 32: Giao diện lập lịch pfSense
@B:HSD+F+)*+q0$00Y
)&<& D&%P0'01!
0HS0":D&%$&<
& !G&41
Hình 33: Chỉ định thời gian biểu Working
Hình 34: Rule hoạt động khi thời gian biểu phù hợp
2.5. QoS
‰P+06& (}P>})_P00A& '
4T!'%!R!&#
Z/\"'0q"0t"N5)':}P

Internet Gateway với Firewall Open Sources 21
!'+(Q$&;W
&%'%&#-1
Z}P& '+_P00':-T?}
>?900}00A1?}& ; +'lPOu2/Š
QH+CN43E$J
&1[.GE',@\V/\=&%S4
& N0L:&>+C++]/]eA1
[)&WL:4& N"?}'*N
4':-L&#-1@*& ?}
'RC*+%4$E@l0'
}0>@l}A"\)^$0'00>\y/}AM0]
P00@0>M]P@A1
• @l}U@^$0'00!&#':D.
$J!.+J$J& 
'=W' & '0&C%
$"0$=$G;$Q
5)1@l}:+5L-48v
&j"44&#-C7& N
GG44&#-H+C1Z;'U
9&:;<.4"
:=&
>:?@A&'B
2<
8 dv‹
- wv‹
 w‹
 dv‹
C:D& {~‹
• \y/}UC\y/}':L&#-& 

L&#8v&{k"'%4%
-C7& NG1
• M]P@U*M0]P00@0& 
'Q$&.&T4I#LW
Internet Gateway với Firewall Open Sources 22
&%8!'%1o"$!!#.
&-&#q0$00S5)&
-$J'.&Œ{vvilV5)"
5)+0S$J7N.+#
HSŒwkilV01Z*) +
'R:#*+' k`l7& 
+_P00G!I.&#H+Q$&&Y$J
.1
@+-$+_P008w1v; +-CO)0"&5)
C& ';+a0q1`#;J!
7+_P00H+&'R+F+$J
&.GLG+jP)+0"/y@"•"t+_q^
_)'L'%+5!4L
G+j& !$I#CS1
@C(}P!G+j& :$.$G;U
• \5!4LG+jUS)& N
C4!?}=
O)0Q+5!4@\V/\1
• @)GE',U4&
& !G+d>&%DEV&;A7& 
+_P00)N!S+_q^_)'1
• !bLG+jUb)& 
+_P00&%‚*+4'!
01+Q!
VVV0V+"&5)+(

B++_P004N&%L!&#!
G+j1
Internet Gateway với Firewall Open Sources 23
Hình 35: Các tập tin lưu trữ các mẫu dữ liệu giao thức lớp ứng dụng
Hình 36: Mẫu dữ liệu giao thức lớp 7 chương trình Half-Life 2
• @D&%U4& R!
$Gd"S+_q^_)'7:Y)V
+F+4+#HS8'R1
Hình 37: Quy trình xử lý gói tin tại pfSense
@HS!+_P00
Internet Gateway với Firewall Open Sources 24
)*+0ƒ‰P+0ƒ(h|Ž'"
+_P00H+ˆ#.HS'R
B!$EUP09|"P0|
9"`9V|O0'0'1
Hình 38: Các cấu hình tham khảo do pfSense cung cấp
@B:({HSbC&E!P•[•
y/‘2iM?/P0|91
Hình 39: Số lượng card LAN
Hình 40: Nhập thông số băng thông cho phép Upload/Download
Internet Gateway với Firewall Open Sources 25