sicurezza 837 K9
Inviato: gio 01 mag , 2008 10:23 am
ciao
dopo aver configurato il mio 837 sono riuscito ad aprire le porte x emule e bittorrent.mi rendo conto pero', anche leggendo altri 3d, che ho una configurazione minima e assai poco sicura.
facendo riferimento a http://www.ciscoforums.it/viewtopic.php ... ight=emule
potrei applicare le ACL suggerite alla mia configurazione?
visto che ho le configurazione funzionante,come faccio a ricaricarla, se combino casini con le ACL? devo riscrivere tutto riga x riga?
ancora grazie x la pazienza allego sh run
Router#sh run
Building configuration...
Current configuration : 1655 bytes
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
!
ip ids po max-events 100
no ftp-server write-enable
!
!
!
!
!
!
!
interface Ethernet0
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
hold-queue 100 out
!
interface Ethernet2
no ip address
shutdown
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
interface FastEthernet2
no ip address
duplex auto
speed auto
!
interface FastEthernet3
no ip address
duplex auto
speed auto
!
interface FastEthernet4
no ip address
duplex auto
speed auto
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
ppp chap hostname xxxxxxxx
ppp chap password 0 xxxxxxxxxx
ppp pap sent-username xxxxxxxxxxx password 0 xxxxxxxxx
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
no ip http secure-server
ip nat inside source list 1 interface Dialer0 overload
!
!
access-list 1 permit 192.168.1.0 0.0.0.255
dialer-list 1 protocol ip permit
ip nat inside source static tcp 192.168.1.3 6893 interface dialer0 6893
ip nat inside source static udp 192.168.1.3 36728 interface dialer0 36728
ip nat inside source static tcp 192.168.1.3 16401 interface dialer0 16401
!
control-plane
!
!
line con 0
no modem enable
transport preferred all
transport output all
line aux 0
transport preferred all
transport output all
line vty 0 4
exec-timeout 120 0
login
length 0
transport preferred all
transport input all
transport output all
!
scheduler max-task-time 5000
end
ciao ciao
dopo aver configurato il mio 837 sono riuscito ad aprire le porte x emule e bittorrent.mi rendo conto pero', anche leggendo altri 3d, che ho una configurazione minima e assai poco sicura.
facendo riferimento a http://www.ciscoforums.it/viewtopic.php ... ight=emule
potrei applicare le ACL suggerite alla mia configurazione?
visto che ho le configurazione funzionante,come faccio a ricaricarla, se combino casini con le ACL? devo riscrivere tutto riga x riga?
ancora grazie x la pazienza allego sh run
Router#sh run
Building configuration...
Current configuration : 1655 bytes
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
!
ip ids po max-events 100
no ftp-server write-enable
!
!
!
!
!
!
!
interface Ethernet0
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
hold-queue 100 out
!
interface Ethernet2
no ip address
shutdown
hold-queue 100 out
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
interface FastEthernet2
no ip address
duplex auto
speed auto
!
interface FastEthernet3
no ip address
duplex auto
speed auto
!
interface FastEthernet4
no ip address
duplex auto
speed auto
!
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
ppp chap hostname xxxxxxxx
ppp chap password 0 xxxxxxxxxx
ppp pap sent-username xxxxxxxxxxx password 0 xxxxxxxxx
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
!
ip http server
no ip http secure-server
ip nat inside source list 1 interface Dialer0 overload
!
!
access-list 1 permit 192.168.1.0 0.0.0.255
dialer-list 1 protocol ip permit
ip nat inside source static tcp 192.168.1.3 6893 interface dialer0 6893
ip nat inside source static udp 192.168.1.3 36728 interface dialer0 36728
ip nat inside source static tcp 192.168.1.3 16401 interface dialer0 16401
!
control-plane
!
!
line con 0
no modem enable
transport preferred all
transport output all
line aux 0
transport preferred all
transport output all
line vty 0 4
exec-timeout 120 0
login
length 0
transport preferred all
transport input all
transport output all
!
scheduler max-task-time 5000
end
ciao ciao
nessuno? ho detto fesserie? 
Bravo!!!