interface Ethernet 0/0 ! Mosbach lokal

　　ip address 129.143.204.13 255.255.255.252

　　description Ethernet zum RZ-Router

　　no ip directed-broadcast ! wg. Hacker (denial of service)

　　ip inspect FIWA in ! Ueberpruefung des IP-Verkehrs

　　ip access-group 101 in ! Anti-Spoofing

　　ip access-group 102 out ! zusaetzliches Welt-LAN-Filter wegen Servern

　　no shutdown

　　!

　　no access-list 101

　　access-list 101 permit tcp 129.143.204.12 0.0.0.3 any ! RZ-Router Anti-Spoofing

　　access-list 101 permit udp 129.143.204.12 0.0.0.3 any ! RZ-Router Anti-Spoofing

　　access-list 101 permit icmp 129.143.204.12 0.0.0.3 any ! RZ-Router Anti-Spoofing

　　access-list 101 permit tcp 193.196.5.0 0.0.0.255 any ! Netz der BA-Mo Anti-Spoofing

　　access-list 101 permit udp 193.196.5.0 0.0.0.255 any ! Netz der BA-Mo Anti-Spoofing

　　access-list 101 permit icmp 193.196.5.0 0.0.0.255 any ! Netz der BA-Mo Anti-Spoofing

　　access-list 101 deny ip any any

　　!

　　! Zulassen von gewissen Diensten auf die Server

　　no access-list 102

　　!

　　access-list 102 permit tcp any any eq 22 ! SSH

　　access-list 102 permit tcp any any eq 113 ! Ident

　　access-list 102 permit tcp any any eq 487 ! SAFT

　　!

　　permit tcp any gt 1023 host 193.196.5.107 eq 21 ! FTP-Commands (fuer PASV FTP)

　　permit tcp any gt 1023 host 193.196.5.105 eq 21 ! FTP-Commands (fuer PASV FTP)

　　!

　　access-list 102 permit tcp any host 193.196.5.107 eq 25 ! SMTP zulassen

　　access-list 102 permit tcp any host 193.196.5.105 eq 25 ! SMTP zulassen

　　!

　　access-list 102 permit tcp host 129.143.2.1 host 193.196.5.107 eq 53 ! DNS Zone-Transfer

　　access-list 102 permit tcp host 129.206.100.126 host 193.196.5.107 eq 53 ! DNS Zone-Transfer

　　access-list 102 permit tcp host 129.206.100.127 host 193.196.5.107 eq 53 ! DNS Zone-Transfer

　　access-list 102 permit tcp host 129.143.2.1 host 193.196.5.105 eq 53 ! DNS Zone-Transfer

　　access-list 102 permit tcp host 129.206.100.126 host 193.196.5.105 eq 53 ! DNS Zone-Transfer

　　access-list 102 permit tcp host 129.206.100.127 host 193.196.5.105 eq 53 ! DNS Zone-Transfer

　　access-list 102 permit permit tcp any host 193.196.5.107 eq 80 ! WWW

　　access-list 102 permit permit tcp any host 193.196.5.105 eq 80 ! WWW

　　!

　　access-list 102 permit tcp any host 193.196.5.107 eq 119 ! nntp

　　access-list 102 permit tcp any host 193.196.5.105 eq 119 ! nntp

　　!

　　access-list 102 permit udp any host 193.196.5.107 eq 123 ! ntp

　　access-list 102 permit udp any host 193.196.5.105 eq 123 ! ntp

　　!

　　access-list 102 permit tcp any host 193.196.5.107 eq 389 ! ldap

　　access-list 102 permit tcp any host 193.196.5.105 eq 389 ! ldap

　　!

　　access-list 102 permit tcp any host 193.196.5.107 eq 443 ! https

　　access-list 102 permit tcp any host 193.196.5.105 eq 443 ! https

　　!

　　access-list 102 permit tcp any host 193.196.5.107 eq 993 ! Secure-IMAP

　　access-list 102 permit tcp any host 193.196.5.105 eq 993 ! Secure-IMAP

　　!

　　access-list 102 permit tcp any host 193.196.5.107 eq 995 ! Secure-POP3

　　access-list 102 permit tcp any host 193.196.5.105 eq 995 ! Secure-POP3

　　!

　　! bei geringeren Sicherheitsanforderungen:

　　!

　　access-list 102 permit tcp any host 193.196.5.107 eq 110 ! POP3 zulassen

　　access-list 102 permit tcp any host 193.196.5.105 eq 110 ! POP3 zulassen

　　access-list 102 permit udp any host 193.196.5.105 eq 53 ! DNS-Anfragen

　　access-list 102 permit udp any host 193.196.5.107 eq 53 ! DNS-Anfragen

　　!

　　!

　　access-list 102 permit icmp any host 193.196.5.107 administratively-prohibited

　　access-list 102 permit icmp any host 193.196.5.107 echo

　　access-list 102 permit icmp any host 193.196.5.107 echo-reply

　　access-list 102 permit icmp any host 193.196.5.107 packet-too-big

　　access-list 102 permit icmp any host 193.196.5.107 time-exceeded

　　access-list 102 permit icmp any host 193.196.5.107 traceroute

　　access-list 102 permit icmp any host 193.196.5.107 unreachable

　　access-list 102 deny ip any any

　　!

　　ip inspect name FIWA http java-list 50 ! JavaScript ablehnen nach ACL 50

　　ip inspect name FIWA realaudio timeout 3600

　　ip inspect name FIWA smtp timeout 3600

　　ip inspect name FIWA tftp timeout 30

　　ip inspect name FIWA ftp timeout 3600

　　ip inspect name FIWA udp timeout 15

　　ip inspect name FIWA tcp timeout 3600

　　!

　　no access-list 50

　　access-list 50 permit any log

　　评:虽然是很好.但是访问列表过多,一旦被DOS一攻可能路由器马上瘫痪…重启…所以我认为要在前面加多一台Router来做个TCP Intercept 来拦截DOS攻击.如下:

　　假如管理到个服务器群网络上192.168.111.0 & 192.168.112.0 内的目标主机的TCP连接请求.使用拦截模式,随机丢弃连接:

　　access-list 123 permit tcp any 192.168.111.0 0.0.0.255

　　access-liat 123 permit tcp any 192.168.112..0 0.0.0.255

　　ip tcp intercept list 123

　　ip tcp intercept mode intercept

　　ip tcp intercept drop-mode random

　　做好以后.两个Router在做个HSRP ……..

　　这样还可以嘛…呵呵….