markdown:
**1. ACCEPTANCE**
By using and/or visiting the Gaimoi.com – Vietnamese Adult Entertainment – Phim Sex, Phim Nguoi Lon, Phim Cap 3 website (collectively, including but not limited to all Content, Uploads and User Submissions available through Gaimoi.com, “Gaimoi.com “, the website) you agree to the terms and conditions contained herein and the terms and conditions of Gaimoi.com’s privacy policy incorporated herein, and all future amendments and modifications (collectively referred to as the “Agreement”). By entering, you agree to be bound by these terms and conditions. If you do not agree to be bound the terms and conditions contained herein, then do not use Gaimoi.com.
The terms and conditions of this Agreement are subject to change by Gaimoi.com at any time in its sole discretion and you agree be bound by all modifications, changes and/or revisions. If you do not accept to be bound by any and all modifications, changes and/or revisions of this agreement, you many not use Gaimoi.com.com.
The terms and conditions contained herein apply to all users of Gaimoi.com whether a ‘visitor’ or a ‘member’ and you are only authorized to use Gaimoi.com.com if you agree to abide by all applicable laws and be legally bound by the terms and conditions of this Agreement.
**2. DESCRIPTION OF SERVICES**
The Gaimoi.com website allows for uploading, sharing and general viewing various types of content allowing registered and unregistered users to share and view visual depictions of adult content, including sexually explicit images. In addition, Gaimoi.com contains video content, information and other materials posted/uploaded by users. Gaimoi.com allows its users to view the Content and Website subject to the terms and conditions of this Agreement.
The Gaimoi.com website may also contain certain links to third party websites which are in no way owned or controlled by Gaimoi.com. Gaimoi.com assumes no responsibility for the content, privacy policies, practices of any and all third party websites. Gaimoi.com cannot censor or edit the content of third party sites. You acknowledge that Gaimoi.com will not be liable for any and all liability arising for your use of any third-party website.
Gaimoi.com.com is for your personal use and shall not be used for any commercial endeavor except those specifically endorsed or approved by Gaimoi.com.com. Any illegal and/or unauthorized use of Gaimoi.com is prohibited including but not limited to collecting usernames and e-mail addresses for sending unsolicited emails or unauthorized framing or linking to the Gaimoi.com website is prohibited.
**3. ACCESS**
In order to use this website, you affirm that you are at least eighteen (18) year of age and/or over the age of majority in the jurisdiction you reside and from which you access the website where the age of majority is greater than eighteen (18) years of age. If you are under the age of 18 and/or under the age of majority in the jurisdiction you reside and from which you access the website, then you are not permitted to use the website.
**4. USER CONDUCT**
You acknowledge and agree that you shall be responsible for your own user submissions and the consequences of posting, uploading, publishing transmitting or other making them available on Gaimoi.com. You agree that you shall not (nor others using your account) post, upload, publish, transmit or make available in any way on Gaimoi.com content which is illegal, unlawful, harassing, harmful, threatening, tortuous, abusive, defamatory, obscene, libelous, invasive of one’s privacy including but not limited to personal information, hateful, racial. You also agree that you shall not post, upload, publish, transmit or make available in any way on Gaimoi.com software containing viruses or any other computer code, files, or programs designed to destroy, interrupt, limit the functionality of, or monitor, or persistently reside in or on any computer software or hardware or telecommunications equipment. You agree that you shall not (nor others using your account) post, upload, publish, transmit or make available in any way on Gaimoi.com content which is intentionally or unintentionally violating any applicable local, state, national, or international law, or any regulations or laws having the force of law where you reside and elsewhere, including but not limited to any laws or regulations relating to securities, privacy, and export control; engage in, promote, You agree that you shall not (nor others using your account) post, upload, publish, transmit or make available in any way on Gaimoi.com content depicting illegal activities, promote or depict physical harm or injury against any group or individual, or promote or depict any act of cruelty to animals; You agree not to use Gaimoi.com in any way that exposes Gaimoi.com to criminal or civil liability.
You agree that Gaimoi.com shall have the right to determine in its sole and unfettered discretion, what action shall be taken in the event of any discovered or reported violation of the terms and conditions contained herein.
**5. INTELLECTUAL PROPERTY**
The Content contained on the Gaimoi.com with the exception of User Submissions including but not limited to the text, software, scripts, graphics, music, videos, photos, sounds, interactive features and trademarks, service marks and logos contained therein, are owned by and/or licensed to Gaimoi.com, subject to copyright and other intellectual property rights under United States, Canada and foreign laws and international conventions. Content on the Website is provided to you AS IS for your information and personal use only and may not be used, copied, reproduced, distributed, transmitted, broadcast, displayed, sold, licensed, or otherwise exploited for any other purposes whatsoever without the prior written consent of the respective owners. Gaimoi.com reserves all rights not expressly granted in and to the Website and the Content. You agree to not engage in the use, copying, or distribution of any of the Content other than expressly permitted herein, including any use, copying, and/or distribution of User Submissions of third parties obtained through the Website for any commercial purposes. If you download or print a copy of the Content or personal use, you must retain all copyright and other proprietary notices contained therein. You agree not to disable, circumvent, or otherwise interfere with security related features of the Gaimoi.com or features that prevent or restrict use or copying of any Content or enforce limitations on use of the Gaimoi.com Website or the Content therein.
**6. USER SUBMISSIONS**
Gaimoi.com permits the submission of video and other communications and the hosting, sharing and publishing of such user submissions. You understand that whether or not such User Submissions are published and/or uploaded, Gaimoi.com does not guarantee any confidentiality with respect to any submissions.
Gaimoi.com allows/permits you to link to materials on the Website for personal, non-commercial purposes only.
You shall be solely responsible for any and all of your own User Submissions and the consequences of posting, uploading and publishing them. Furthermore, with User Submissions, you affirm, represent and/or warrant that:
1. you own or retain the necessary licenses, rights, consents, and permissions to use and authorize Gaimoi.com to use all trademarks, copyrights, trade secrets, patents, or other proprietary rights in and to any and all User Submissions to enable inclusion and use of the User Submissions in the manner contemplated by the Website and these Terms of Service; and
2. you will not post, or allow anyone else to post, any material that depicts any person under the age of 18 years and you have inspected and are maintaining written documentation sufficient to confirm that all subjects of your submissions are, in fact, over the age of 18 years.
3. You have the written consent, release, and/or permission of each and every identifiable individual person in the User Submission to use the name or likeness of each and every such identifiable individual person to enable inclusion and use of the User Submissions in the manner contemplated by the Website and these Terms of Service. For clarity, you retain all of your ownership rights in your User Submissions. By submitting the User Submissions to Gaimoi.com, you hereby grant Gaimoi.com a worldwide, non-exclusive, royalty-free, sublicenseable and transferable license to use, reproduce, distribute, prepare derivative works of, display, and perform the User Submissions in connection with the Gaimoi.com Website and Gaimoi.com’s (and its successor’s) business, including without limitation for promoting and redistributing part or all of the Gaimoi.com Website (and derivative works thereof) in any media formats and through any media channels. You also hereby grant each user of the Gaimoi.com Website a non-exclusive license to access your User Submissions through the Website, and to use, reproduce, distribute, prepare derivative works of, display and perform such User Submissions as permitted through the functionality of the Website and under these Terms of Service. The foregoing license granted by you terminates once you remove or delete a User Submission from the Gaimoi.com Website.
In submitting material (video or other communication), you further agree that you shall not:
4. submit material that is copyrighted, protected by trade secret or otherwise subject to third party proprietary rights, including privacy and publicity rights, unless you are the owner of such rights or have permission from their rightful owner to post the material and to grant Gaimoi.com all of the license rights granted herein;
5. publish falsehoods or misrepresentations that could damage Gaimoi.com or any third party;
6. submit material that is obscene, illegal, unlawful, , defamatory, libelous, harassing, hateful, racially or ethnically offensive, or encourages conduct that would be considered a criminal offense, give rise to civil liability, violate any law, or is otherwise inappropriate;
7. post advertisements or solicitations of business;
8. Impersonate another person. Gaimoi.com does not endorse any User Submission or any opinion, recommendation, or advice expressed therein, and Gaimoi.com expressly disclaims any and all liability in connection with User Submissions. Gaimoi.com does not permit copyright infringing activities and infringement of intellectual property rights on its Website, and Gaimoi.com will remove all Content and User Submissions if properly notified that such Content or User Submission infringes on another’s intellectual property rights. Gaimoi.com reserves the right to remove Content and User Submissions without prior notice or delay. Gaimoi.com will also terminate a User’s access to its Website, if they are determined to be an infringer. While pornographic and adult content are accepted, Gaimoi.com also reserves the right to decide in its sole and unfettered discretion, whether Content or a User Submission is appropriate and complies with these Terms of Service for violations other than copyright infringement and violations of intellectual property law, such as, but not limited to, obscene or defamatory material, or excessive length. Gaimoi.com may remove such User Submissions and/or terminate a User’s access for uploading such material in violation of these Terms of Service at any time, without prior notice and at its sole discretion.
You understand and acknowledge that when using Gaimoi.com.com, you will be exposed to User Submissions from a variety of sources, and that Gaimoi.com is not responsible for the accuracy, usefulness, safety, or intellectual property rights of or relating to such User Submissions. You further understand and acknowledge that you may be exposed to User Submissions that are inaccurate, offensive, indecent, or objectionable, and you agree to waive, and hereby do waive, any legal or equitable rights or remedies you have or may have against Gaimoi.com with respect thereto, and agree to indemnify and hold Gaimoi.com, its Owners, affiliates, operators, and/or licensors, harmless to the fullest extent allowed by law regarding all matters related to your use of the website. You agree that Gaimoi.com may at its sole discretion have the right to refuse to publish, remove, or block access to any User Submission that is available via the Website or other Gaimoi.com network or services at any time, for any reason, or for no reason at all, with or without notice.
Gaimoi.com provides its website as a service to its users. However, Gaimoi.com assumes no responsibility whatsoever for monitoring the Gaimoi.com Services for inappropriate content or conduct. If at any time Gaimoi.com chooses, in its sole discretion, to monitor the Gaimoi.com Services, however, Gaimoi.com assumes no responsibility for the content, no obligation to modify or remove any inappropriate content, and no responsibility for the conduct of the User submitting any such content. Gaimoi.com may review and delete any User Submissions that, in its sole judgment, violates this Agreement or may be otherwise offensive or illegal, or violate the rights, harm, or threaten the safety of any User or person not associated with the Website (collectively “Inappropriate User Submissions”). You are solely responsible for the User Submissions that you make visible on the Website or to any third-party website via an embedded player provided by the Website or any other material or information that you transmit or share with other Users or unrelated third-parties via the Website.
**7. ACCOUNT TERMINATION POLICY**
1. A User’s access to theWebsite will be terminated if, under appropriate conditions, the User is determined to infringe repeatedly.
2. The Website reserves the right to decide whether Content or if a User’s Submission is appropriate and complies with these Terms and Conditions in regards to violations other than copyright infringement or privacy law, such as, but not limited to, hate crimes, pornography, obscene or defamatory material, or excessive length. Website may remove such User Submissions and/or terminate a User’s access for uploading such material in violation of these Terms and Conditions at any time, without prior notice and at its sole discretion.
**8. POLICY**
Gaimoi.com abides by a ZERO TOLERANCE policy relating to any illegal content. Child Pornography, bestiality, rape, torture, snuff, death and/or any other type of obscene and/or illegal material shall not be tolerated by Gaimoi.com. Gaimoi.com shall not condone child pornography and will cooperate with all governmental agencies that seek those who produce child pornography.
**9. FEES**
You acknowledge that Gaimoi.com reserves the right to charge for Gaimoi.com services and to change its fees from time to time in its discretion. Further more, in the event Gaimoi.com terminates your rights to use the website because of a breach of this Agreement, you shall not be entitled to the refund of any unused portion of subscription fees.
**10. WARRANTIES**
You represent and warrant that all of the information provided by you to Gaimoi.com to participate in the Gaimoi.com website is accurate and current and you have all necessary right, power, and authority to enter into this Agreement and to perform the acts required of you hereunder.
As a condition to using the Gaimoi.com, you must agree to the terms of Gaimoi.com’s privacy policy and its modifications. You acknowledge and agree that the technical processing and transmission of the Website, including your User Submissions, may involve transmissions over various networks; and changes to conform and adapt to technical requirements of connecting networks or devices. You further acknowledge and agree that other data collected and maintained by Gaimoi.com with regard to its users may be disclosed in accordance with the Gaimoi.com Privacy Policy.
**11. WARRANTY DISCLAIMER**
YOU AGREE THAT YOUR USE OF THE Gaimoi.com WEBSITE SHALL BE AT YOUR SOLE RISK. TO THE FULLEST EXTENT PERMITTED BY LAW, Gaimoi.com, ITS OFFICERS, DIRECTORS, EMPLOYEES, AND AGENTS DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, IN CONNECTION WITH THE WEBSITE AND YOUR USE THEREOF. Gaimoi.com MAKES NO WARRANTIES OR REPRESENTATIONS ABOUT THE ACCURACY OR COMPLETENESS OF THIS SITE’S CONTENT OR THE CONTENT OF ANY SITES LINKED TO THIS SITE AND ASSUMES NO LIABILITY OR RESPONSIBILITY FOR ANY
9. ERRORS, MISTAKES, OR INACCURACIES OF CONTENT,
10. PERSONAL INJURY OR PROPERTY DAMAGE, OF ANY NATURE WHATSOEVER, RESULTING FROM YOUR ACCESS TO AND USE OF OUR WEBSITE,
11. ANY UNAUTHORIZED ACCESS TO OR USE OF OUR SECURE SERVERS AND/OR ANY AND ALL PERSONAL INFORMATION AND/OR FINANCIAL INFORMATION STORED THEREIN,
12. ANY INTERRUPTION OR CESSATION OF TRANSMISSION TO OR FROM OUR WEBSITE, IV) ANY BUGS, VIRUSES, TROJAN HORSES, OR THE LIKE WHICH MAY BE TRANSMITTED TO OR THROUGH OUR WEBSITE BY ANY THIRD PARTY, AND/OR
13. ANY ERRORS OR OMISSIONSIN ANY CONTENT OR FOR ANY LOSS OR DAMAGE OF ANY KIND INCURRED AS A RESULT OF THE USE OF ANY CONTENT POSTED, EMAILED, TRANSMITTED, OR OTHERWISE MADE AVAILABLE VIA THE Gaimoi.com WEBSITE. Gaimoi.com DOES NOT WARRANT, ENDORSE, GUARANTEE, OR ASSUME RESPONSIBILITY FOR ANY PRODUCT OR SERVICE ADVERTISED OR OFFERED BY A THIRD PARTY THROUGH THE Gaimoi.com WEBSITE OR ANY HYPERLINKED WEBSITE OR FEATURED IN ANY BANNER OR OTHER ADVERTISING, AND Gaimoi.com WILL NOT BE A PARTY TO OR IN ANY WAY BE RESPONSIBLE FOR MONITORING ANY TRANSACTION BETWEEN YOU AND THIRD-PARTY PROVIDERS OF PRODUCTS OR SERVICES. AS WITH THE PURCHASE OF A PRODUCT OR SERVICE THROUGH ANY MEDIUM OR IN ANY ENVIRONMENT, YOU SHOULD USE YOUR BEST JUDGMENT AND EXERCISE CAUTION WHERE APPROPRIATE. THE FOREGOING LIMITATION OF LIABILITY SHALL APPLY TO THE FULLEST EXTENT PERMITTED BY LAW IN THE APPLICABLE JURISDICTION. YOU SPECIFICALLY ACKNOWLEDGE THAT Gaimoi.com SHALL NOT BE LIABLE FOR USER SUBMISSIONS OR THE DEFAMATORY, OFFENSIVE, OR ILLEGAL CONDUCT OF ANY THIRD PARTY AND THAT THE RISK OF HARM OR DAMAGE FROM THE FOREGOING RESTS ENTIRELY WITH YOU.
**12. LIMITATION OF LIABILITY**
IN NO EVENT SHALL Gaimoi.com, ITS OFFICERS, DIRECTORS, EMPLOYEES, OR AGENTS, BE LIABLE TO YOU FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES WHATSOEVER RESULTING FROM ANY
14. ERRORS, MISTAKES, OR INACCURACIES OF CONTENT,
15. PERSONAL INJURY OR PROPERTY DAMAGE, OF ANY NATURE WHATSOEVER, RESULTING FROM YOUR ACCESS TO AND USE OF OUR WEBSITE,
16. ANY UNAUTHORIZED ACCESS TO OR USE OF OUR SECURE SERVERS AND/OR ANY AND ALL PERSONAL INFORMATION AND/OR FINANCIAL INFORMATION STORED THEREIN,
17. ANY INTERRUPTION OR CESSATION OF TRANSMISSION TO OR FROM OUR WEBSITE,
18. ANY BUGS, VIRUSES, TROJAN HORSES, OR THE LIKE, WHICH MAY BE TRANSMITTED TO OR THROUGH OUR WEBSITE BY ANY THIRD PARTY, AND/OR
19. ANY ERRORS OR OMISSIONS IN ANY CONTENT OR FOR ANY LOSS OR DAMAGE OF ANY KIND INCURRED AS A RESULT OF YOUR USE OF ANY CONTENT POSTED, EMAILED, TRANSMITTED, OR OTHERWISE MADE AVAILABLE VIA THE Gaimoi.com WEBSITE, WHETHER BASED ON WARRANTY, CONTRACT, TORT, OR ANY OTHER LEGAL THEORY, AND WHETHER ORNOT THE COMPANY IS ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE FOREGOING LIMITATION OF LIABILITY SHALL APPLY TO THE FULLEST EXTENT PERMITTED BY LAW IN THE APPLICABLE JURISDICTION. YOU SPECIFICALLY ACKNOWLEDGE THAT Gaimoi.com SHALL NOT BE LIABLE FOR USER SUBMISSIONS OR THE DEFAMATORY, OFFENSIVE, OR ILLEGAL CONDUCT OF ANY THIRD PARTY AND THAT THE RISK OF HARM OR DAMAGE FROM THE FOREGOING RESTS ENTIRELY WITH YOU.
**13. INDEMNITY**
You agree to defend, indemnify and hold harmless Gaimoi.com, its parent corporation, officers, directors, employees and agents, from and against any and all claims, damages, obligations, losses, liabilities, costs or debt, and expenses (including but not limited to attorney’s fees) arising from:
20. your use of and access to the Gaimoi.com Website;
21. your violation of any term of these Terms of Service;
22. your violation of any third party right, including without limitation any copyright, property, or privacy right; or
23. Any claim that one of your User Submissions caused damage to a third party. This defense and indemnification obligation will survive these Terms of Service and your use of the Gaimoi.com Website.
You affirm that you are either more than 18 years of age or an emancipated minor, or possess legal parental or guardian consent, and are fully able and competent to enter into the terms, conditions, obligations, affirmations, representations, and warranties set forth in these Terms of Service, and to abide by and comply with these Terms and Conditions contained herein.
**14. ASSIGNMENT**
The Terms and Conditions contained herein and any rights and licenses granted hereunder, may not be transferred or assigned by you, but may be assigned by Gaimoi.com without restriction.
If any term, clause or provision of the agreement is held invalid or unenforceable by a court of competent jurisdiction, such invalidity shall not affect the validity or operation of any term, clause or provision and such invalid term, clause or provision shall be deemed to be severed from this Agreement.
**15. JURISDICTION**
This Agreement shall be governed by and construed in accordance with the laws of the site operator’s country, without regard to conflicts of law principles. The sole and exclusive jurisdiction and venue for any action or proceeding arising out of or related to this Agreement shall be in an appropriate court located in the appropriate jurisdiction. You hereby submit to the jurisdiction and venue of said Courts. You consent to service of process in any legal proceeding.


markdown:
**GIT – The purpose of this guide is to provide the reader with enough knowledge to configure FreeBSD with a basic NAT/Firewall setup, allowing you to share your internet connection between all your computers with only one IP address, and to protect your network from hackers.**
This is not intended to be an exhaustive guide, merely a reasonably in depth introduction to get you off on the right foot as painlessly as possible.
You will have to modify this guide somewhat to match your particular network configuration. Here are the settings I use for this guide:
xl0 – External (internet facing) interface. Change to suit your configuration.
xl1 – Internal (inside network) interface. Change to suit your configuration.
192.168.0.0/16 – Internal network address space/netmask. Change to suit your configuration.
0.0.0.0/32 – Generic internet address space/netmask. Leave this alone, unless you really know what you’re doing.
**Requirements**
FreeBSD installed and configured on a system with two (identical) NIC’s
You must rebuild your kernel with the following options, but do not reboot yet:
OPTIONS IPFILTER
OPTIONS IPDIVERT
OPTIONS PFIL_HOOKS (5.0 – 5.2.1)
**Configuration**
Section A – Configuring rc.conf
There are several options that you must insert into your /etc/rc.conf to tell your system at boot time to enable itself to route packets between interfaces, to load the ipnat and ipfilter software you compiled into your kernel, and where to find the rules for ipfilter and ipnat. Open up your /etc/rc.conf with your favorite editor and insert the following options:
#Enable routing packets between interfaces
gateway_enable=”YES”
#Bring up the ipfilter software
ipfilter_enable=”YES”
#Tell ipfilter where to get its rules
ipfilter_rules=”/etc/ipf.rules”
#Enable ipnat
ipnat_enable=”YES”
#Tell ipnat where to get its rules
ipnat_rules=”/etc/ipnat.rules”
**Section B – Configuring NAT (ipnat.rules)**
Now you must configure your rules for NAT (Network Address Translation). NAT allows many computers to access the Internet with only one IP address by mapping the internal IP addresses to the external address, sending the data out, and routing replies from the internet back to the internal system. All the work is done on the system running NAT. All you have to do on the client machine is set its default gateway to the internal IP of the system that you are setting up as a router/firewall.
The configuration file for the IPNAT software on your system will be /etc/ipnat.rules, as set above in /etc/rc.conf. The
[command](http://www.gocit.vn/bai-viet/tag/command/) syntax is pretty straightforward. For the purposes of this guide I will use a very simple ruleset. You can learn more advanced rules by reading the information linked to in the “Further Reading” section of this guide.
Below is a sample ipnat.conf file. Keep in mind that xl0 is my EXTERNAL (Internet Facing) interface, and that 192.168.1.0/16 is my internal subnet. You must change the xl0 and the 192.168.1.0/16 to match your hardware and network configuration. The first two lines handle
[FTP](http://www.gocit.vn/bai-viet/tag/ftp/) support, and must be in this precise order to allow [FTP](http://www.gocit.vn/bai-viet/tag/ftp/) to work properly. The third line will translate everything else.
map xl0 192.168.1.0/16 -> 0.0.0.0/32 proxy port ftp ftp/tcp
map xl0 192.168.1.0/16 -> 0.0.0.0/32 portmap tcp/udp 1025:65000
map xl0 192.168.1.0/16 -> 0.0.0.0/32
You can read the commands like this “Map, on the xl0 (external) interface, the network 192.168.1.0/16 to the network 0.0.0.0/32 (the internet) … etc”. As you read the additional material referenced below, you will learn more advanced techniques such as redirect (rdr), however, that is outside of the scope of this guide.
You may use the ipnat command to control the ipnat software, view active mappings and statistics after you have completed this guide and rebooted (however, do not reboot yet).
**Section C – Building your firewall ruleset (ipf.rules)**
Now, you must build the rules for your firewall. This will be responsible for blocking or passing data through your network. IPFILTER also handles the state table. If it accepts a packet, and the rule that accepts it tells the firewall to keep state, an entry will be placed into your systems state table. Keeping state is essential to keeping connections from your client computers to the outside world alive. Any connection kept open in the state table will bypass the entire firewall ruleset. Don’t worry, it will have to have been accepted to be placed in the state table in the first place.
So, open up /etc/ipf.rules in you editor of choice, and we shall jump in.
IPFILTER rules are pretty easy to understand. They are pretty much in plain english, and make sense if you have half a clue about what your doing.
The first rules I will show you will handle keeping connection state.
pass out quick on xl0 proto tcp all keep state
pass out quick on xl0 proto udp all keep state
pass out quick on xl0 proto icmp all keep state
What these rules do are pass out packets on the xl0 (which is my external interface, change it to match yours) that use the specified protocols (tcp/udp/icmp) and keep state on those connections. If you are browsing a website on a computer behind your firewall, when the computer sends that packet out to the webserver being accessed, the state table will allow reply packets back in to computer you are browsing on.
The quick keyword means that if the packet matches the rule, it stops comparing the packet against the rest of the rules. Without the quick keyword, IPFILTER will continue to compare the packet against the remaining rules, with the last one matching being the one that counts. If the packet didn’t match the first rule, it would be compared against the next one in sequence. If the packet happens to be a udp packet passing out on the xl0 interface, it would match the second rule, and that rule would be applied without comparing against the next rule(s).
Unless you happen to know better, these three rules are rather essential as they are, and should (must) be at the beginning of your ipf.rules.
Next, you will want to block packets coming in from the Internet from address ranges they shouldn’t be coming from. Address ranges they shouldn’t be coming from are those that are non-routable (set aside for networks not on the net). People could use spoofed packets from these ranges to DoS your machine. Some, but not all of these ranges are: 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 127.0.0.0/8, and 192.0.2.0/24.
An example rule blocking one of these addresses is:
block in quick on xl0 from 192.168.0.0/16 to any
This rule blocks (quick) any packets coming in on xl0 from the 192.168.0.0/16 range to any address. Get in the habit of using any in your rules instead of specific IP addresses, unless you only want to block or pass something to/from a specific address. You will most likely want to add rules like this for each of the address ranges above. If a packet comes in from your external (Internet facing) interface, and is from one of those address ranges, it will be dropped and IPFILTER will move on to the next packet.
Now, if your the system you are setting up as a gateway/firewal is hosting services (http, ftp, etc) you will want to allow others on the Internet to access them. First you will need to know what port(s) and protocol the service uses and add a rule to pass those packets in.
Let’s say you are running apache to serve webpages. It uses port 80 and the tcp protocol. Therefore, the rule to let others access it will look like this:
pass in quick on xl0 proto tcp from any to any port = 80 #HTTP
Nothing very different from what we have seen before, with the exception of the port option and the # style comment. You are allowed to put comments in your ruleset provided you use the # before the comment. You will want to add rules like this for each service you operate.
You will now want to block anything that hasn’t matched any rules so far. Otherwise, IPFILTER will just pass these packets.
block in quick on xl0 all
Now that you have some idea how to use IPFILTER rules, heres an example /etc/ipf.rules file:
# Let clients behind the firewall send out to the internet, and replies to come back in by keeping state
pass out quick on xl0 proto tcp all keep state
pass out quick on xl0 proto udp all keep state
pass out quick on xl0 proto icmp all keep state
# Since nothing should be coming from these address ranges, block them
block in quick on xl0 from 192.168.0.0/16 to any
block in quick on xl0 from 172.16.0.0/12 to any
block in quick on xl0 from 10.0.0.0/8 to any
block in quick on xl0 from 127.0.0.0/8 to any
block in quick on xl0 from 192.0.2.0/24 to any
# Let’s let people access the services running on this system
pass in quick on xl0 proto tcp from any to any port 30000 >< 50000 flags S keep state #PASV FTP
pass in quick on xl0 proto tcp from any to any port = 21 #FTP
pass in quick on xl0 proto tcp from any to any port = 22 #SSH
pass in quick on xl0 proto tcp/udp from any to any port = 53 #DNS
pass in quick on xl0 proto tcp from any to any port = 80 #WWW
# Block everything else
block in quick on xl0 all
There were two things we have not discussed, yet are in this ruleset. The first is the pasv ftp one. It uses 30000 >< 50000 after the port keyword. Basically, this passes in anything on ports 30000-50000. This is essential to have proper passive FTP (the default one) access for all clients behind your network. Explaining why is outside the scope of this guide, but I will just say it’s because the FTP protocol sucks. Next, is the tcp/udp after the proto keyword on the DNS entry. DNS operates on both the udp and tcp protocols. You will need to have both of these open if you are hosting a DNS server. Using tcp/udp for the protocol will apply the rule to packets using either the tcp OR the udp protocol. Otherwise, you would have to have two rules to do the same thing, one for udp, and one for tcp.
Now that you have everything configured, reboot your system and things should work fairly well if you are good at following instructions.
A couple IPFILTER specific command line utilities are now in order. First, ipf is the control program for IPFILTER. It can do a lot, but the most important (in my opinion) is reloading the /etc/ipf.rules when you make a change. To do this, simply execute
# ipf -Fa -f /etc/ipf.rules
This will clear out the current ruleset in memory, and load the new one from the specified file. View the ipf manpages to see what else it can do. The next utility is ipfstat. This utility will show the number of dropped/passed packets, etc. It’s very useful for keeping track of how well your firewall is working.
## No Comment

WARC-Type: response

Content-Type: application/http; msgtype=response

WARC-Truncated: length

WARC-Identified-Payload-Type: text/html

Server: cloudflare-nginx

X-Content-Type-Options: nosniff

Connection: close

X-Frame-Options: SAMEORIGIN

Vary: Cookie

X-XSS-Protection: 1; mode=block

Link: <http://wp.me/p2nOvE-tv>; rel=shortlink

Content-Type: text/html; charset=UTF-8


markdown:
Nhiều bạn cho rằng học môn Văn khó, nhàm chán vậy lý do là do đâu ?
Xin các bạn trả lời và nhận xét vào bên dưới bài này cho chúng tôi vài câu hỏi?
Bạn thích học Môn Ngữ Văn Không ? Vì sao ?
Theo bạn dạy ngữ văn thế nào mới thích học ?
Các bạn có muốn học Ngữ Văn Kiểu Tin ko ? Chúng ta sẽ giao lưu nhé ?
Xin cảm ơn các bạn đã tham gia ....
Xin các bạn trả lời và nhận xét vào bên dưới bài này cho chúng tôi vài câu hỏi?
Bạn thích học Môn Ngữ Văn Không ? Vì sao ?
Theo bạn dạy ngữ văn thế nào mới thích học ?
Các bạn có muốn học Ngữ Văn Kiểu Tin ko ? Chúng ta sẽ giao lưu nhé ?
Xin cảm ơn các bạn đã tham gia ....
## 0 Nhận xét

WARC-Identified-Payload-Type: application/xhtml+xml

Server: GSE

Cache-Control: private, max-age=0


markdown: © 2007–2017 Look At Me. Интернет-сайт о креативных индустриях.Использование материалов Look At Me разрешено только с предварительного согласияправообладателей. Все права на картинки и тексты принадлежат их авторам.Сайт может содержать контент, не предназначенный для лиц младше 16 лет.

Server: nginx

Content-Type: text/html; charset=utf-8

Vary: Accept-Encoding

Set-Cookie: lam=BAh7B0kiD3Nlc3Npb25faWQGOgZFVEkiJTdlNTRiYjFiNGMwMjVlNmRlOWNlZjI5OWRlODZkMDI3BjsAVEkiEF9jc3JmX3Rva2VuBjsARkkiMUgwTDZVNXFwMU5MVkhwRmgvZU43dC9hZGdIUWJSV0IyUEI3OWVsQjFSZnM9BjsARg%3D%3D--3a137a55d64d8dffae68ff7c4460e365c899d5e6; domain=.lookatme.ru; path=/; expires=Thu, 02 Nov 2017 20:25:02 -0000; HttpOnly