NHK 神の数式
https://www.youtube.com/watch?v=UeqhlXJSZM8
実は
これは東大の カブリ数物連携宇宙研究機構 のモットーです
https://ipmu.exblog.jp/
昔の英語 （thou = you）が読めないといけない
88288c44497d7022.b none swap sw
88288c44497d7022.a / ffs rw,wxallowed 1 1
88288c44497d7022.d /tmp ffs rw,nodev,nosuid 1 2
fff6bc9657f9ee1a.m /home ffs rw,wxallowed 1 1
Filesystem 512-blocks Used Avail Capacity Mounted on
/dev/sd1a 194420432 12440812 172258600 7% /
/dev/sd1d 16253756 8472 15432600 0% /tmp
/dev/sd0m 105959508 17512912 83148624 17% /home
Label editor (enter '?' for help at any prompt)
sd1> p
OpenBSD area: 133120-234441613; size: 234308493; free: 16
# size offset fstype [fsize bsize cpg]
a: 200737248 33704352 4.2BSD 2048 16384 12959 # /
b: 16783325 133120 swap # none
c: 250069680 0 unused
d: 16787904 16916448 4.2BSD 2048 16384 12960 # /tmp
i: 131072 2048 MSDOS
sd1> q
Label editor (enter '?' for help at any prompt)
sd0> p
OpenBSD area: 125042688-234440704; size: 109398016; free: 0
# size offset fstype [fsize bsize cpg]
c: 468862128 0 unused
i: 204800 2048 MSDOS
j: 32768 206848 unknown
k: 123480064 239616 MSDOS
l: 1323008 123719680 unknown
m: 109398016 125042688 4.2BSD 2048 16384 12960 # /home
sd0> q
今は 英語が読めて パソコンで文書が作成できて
EXCELなどで四則演算ができること ）
の
１４分から 反抗する権利のとりあげという
X-1) 次は、全く自信ないですが一応動いてるpf ルールです。 これでいいのかな？？？
openbsd:em0--wire--wifi router--wifi電波---mesh wifi->internet
# ifconfig
em0: flags=808843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,AUTOCONF4> mtu 1500
lladdr ac:e2:d3:0b:15:1b
index 1 priority 0 llprio 3
groups: egress
media: Ethernet autoselect (100baseTX full-duplex,rxpause,txpause)
status: active
inet 192.168.68.134 netmask 0xffffff00 broadcast 192.168.68.255
として
# ./comment-out.bat /etc/pf.conf
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \
172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 \
203.0.113.0/24 }
table <spammers> persist file "/etc/spammers"
set skip on lo
block return # block stateless traffic
pass # establish keep-state
block return in on ! lo0 proto tcp to port 6000:6010
block return out log proto {tcp udp} user _pbuild
pass in quick on egress from 192.168.68.0/24 to 192.168.68.0/24
pass out quick on egress from 192.168.68.0/24 to 192.168.68.0/24
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block in quick on egress from <spammers> to any
block return out quick on egress from any to <spammers>
これにて
# pfctl -sr
block return all
pass all flags S/SA
block return in on ! lo0 proto tcp from any to any port 6000:6010
block return out log proto tcp all user = 55
block return out log proto udp all user = 55
pass in quick on egress inet from 192.168.68.0/24 to 192.168.68.0/24 flags S/SA
pass out quick on egress inet from 192.168.68.0/24 to 192.168.68.0/24 flags S/SA
block drop in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block drop in quick on egress from <spammers> to any
block return out quick on egress from any to <spammers>
なお
e# head /etc/spammers
1.0.1.0/24
1.0.2.0/23
1.0.8.0/21
1.0.32.0/19
1.1.0.0/24
1.1.2.0/23
1.1.4.0/22
1.1.8.0/21
1.1.16.0/20
1.1.32.0/19
な感じ
動くにはうごくんだけど、 次も よいかな よくないかな わかんない無責任なのは
# ./comment-out.bat /etc/pf.conf
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \
172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 \
203.0.113.0/24 }
table <spammers> persist file "/etc/spammers"
set skip on lo
block in
block out
block return in on ! lo0 proto tcp to port 6000:6010
block return out log proto {tcp udp} user _pbuild
pass in quick on egress from 192.168.68.0/24 to 192.168.68.0/24
pass out quick on egress from 192.168.68.0/24 to 192.168.68.0/24
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block in quick on egress from <spammers> to any
block return out quick on egress from any to <spammers>
pass # establish keep-state
# pfctl -sr
block drop in all
block drop out all
block return in on ! lo0 proto tcp from any to any port 6000:6010
block return out log proto tcp all user = 55
block return out log proto udp all user = 55
pass in quick on egress inet from 192.168.68.0/24 to 192.168.68.0/24 flags S/SA
pass out quick on egress inet from 192.168.68.0/24 to 192.168.68.0/24 flags S/SA
block drop in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block drop in quick on egress from <spammers> to any
block return out quick on egress from any to <spammers>
pass all flags S/SA
なお
https://bsd.blog.ss-blog.jp/2019-11-07
によると
このpf、他のツールにはない面白い特徴を持っています。
それは、ポリシ評価がラストマッチング方式であるということです。
ラストマッチング方式というのは世間一般で使用されているファイアウォールや、ネットワーク機器のフィルタとは概念が異なり、
・マッチ処理は途中でヒットするものがあっても評価が終わらず、残りのマッチ処理が継続される
・マッチ処理で該当した「最後」のポリシが実行される
となります。
実際は、マッチ処理を途中で終わらせるquickオプションがあるため、自分たちがよく知っている直観的な記載をすることも可能です。
X-2) バックアップ
# UUIDを知るには
sysctl hw.disknames disk setup のFAQにある
例えば
$ sysctl hw.disknames
hw.disknames=sd0:02dfb4afd6e4e3bb,sd1:88288c44497d7022
X-3) wifi ルーターなるopenbsd
スマホ->ural0:openbsd:em0--192.168.11.0/24-->internet
https://www.openbsd.org/faq/pf/example1.html
に
wired = "em1"
wifi = "athn0"
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \
172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 \
203.0.113.0/24 }
set block-policy drop
set loginterface egress
set skip on lo0
match in all scrub (no-df random-id max-mss 1440)
match out on egress inet from !(egress:network) to any nat-to (egress:0)
antispoof quick for { egress $wired $wifi }
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block all
pass out quick inet
pass in on { $wired $wifi } inet
pass in on egress inet proto tcp from any to (egress) port { 80 443 } rdr-to 192.168.1.2
がありますので、これを元にしましたが、 いけてるかは？
で 使用は自己責任でお願いします
open# ./comment-out.bat /etc/pf.conf
wired = "em0"
wifi = "ural0"
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \
172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 224.0.0.0/3 \
192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 \
203.0.113.0/24 }
set block-policy drop
set loginterface egress
set skip on lo0
match in all scrub (no-df random-id max-mss 1440)
match out on egress inet from !(egress:network) to any nat-to (egress:0)
antispoof quick for { egress $wired $wifi }
pass in quick on egress from 192.168.11.0/24 to 192.168.11.0/24
pass out quick on egress from 192.168.11.0/24 to 192.168.11.0/24
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block in quick on egress from <spammers> to any
block return out quick on egress from any to <spammers>
block all
pass out quick inet
pass in on { $wired $wifi } inet
open# pfctl -sr
match in all scrub (no-df random-id max-mss 1440)
match out on egress inet from ! (egress:network) to any nat-to (egress:0) round-robin
block drop in quick on ! egress inet from 192.168.11.0/24 to any
block drop in quick inet from 192.168.11.4 to any
block drop in quick on ! em0 inet from 192.168.11.0/24 to any
pass in quick on egress inet from 192.168.11.0/24 to 192.168.11.0/24 flags S/SA
pass out quick on egress inet from 192.168.11.0/24 to 192.168.11.0/24 flags S/SA
block drop in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block drop in quick on egress from <spammers> to any
block return out quick on egress from any to <spammers>
block drop all
pass out quick inet all flags S/SA
pass in on em0 inet all flags S/SA
pass in on ural0 inet all flags S/SA
これで
# nmap -p 1-1024 localhost
Starting Nmap 7.91 ( https://nmap.org ) at 2022-06-14 07:52 JST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000028s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 1021 closed ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
631/tcp open ipp
linux マシンからは
# nmap -p 1-65535 192.168.11.4
Starting Nmap 7.92 ( https://nmap.org ) at 2022-06-14 10:06 JST
Nmap scan report for 192.168.11.4
Host is up (0.00029s latency).
Not shown: 65534 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
MAC Address: 00:......:35 (Fujitsu Technology Solutions GmbH)
Nmap done: 1 IP address (1 host up) scanned in 1328.87 seconds
ほかに
https://bsd.blog.ss-blog.jp/2019-11-07
https://blog.3qe.us/entry/2020/11/19/225758
