Re: [問題] 加了firewall 有少部分網站上不去

看板Network作者 (zak)時間15年前 (2010/06/28 19:04), 編輯推噓4(4021)
留言25則, 3人參與, 最新討論串2/2 (看更多)
※ 引述《zaknafein (zak)》之銘言: : 今天在我電腦與ISP線路間加了一台 PIX 506 : 可以正常撥號上網,但是有些網站卻上不去! : 像是 fdzone, miroko 等等 : 我的 firewall access-list 完全沒有設, : (configuration除了pppoe, nat, global 其他都沒了) : 小弟做了個實驗, : 就是若不透過firewall,由我自己的主機撥號上網,這些網站又都OK... : 請問各位大德這會是怎樣的原因呢? Here is my configuration : PIX Version 6.2(2) nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted hostname pixfirewall fixup protocol ftp 21 fixup protocol http 80 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol ils 389 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol sip 5060 fixup protocol skinny 2000 names pager lines 24 interface ethernet0 auto interface ethernet1 auto mtu outside 1492 mtu inside 1500 ip address outside pppoe setroute ip address inside 192.168.1.254 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 conduit permit icmp any any timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si p 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable no sysopt route dnat telnet timeout 5 ssh timeout 5 vpdn group pppoex request dialout pppoe vpdn group pppoex localname ********* vpdn group pppex ppp authentication pap vpdn username ******** password ********* terminal width 80 Cryptochecksum:868498991857e158c5d602aa5917d066 : end -- ※ 發信站: 批踢踢實業坊(ptt.cc) ◆ From: 111.240.67.20

06/28 20:17, , 1F

06/28 20:17, , 2F
這邊要設定...要不然default會有一條deny的...
06/28 20:17, 2F

06/28 20:18, , 3F
記得inside 與 outside 都要設定...
06/28 20:18, 3F

06/28 21:51, , 4F
access-list atout permit ip any any
06/28 21:51, 4F

06/28 21:51, , 5F
access-list atin permit ip any any
06/28 21:51, 5F

06/28 21:51, , 6F
access-group atout in interface outside
06/28 21:51, 6F

06/28 21:52, , 7F
access-group atout in interface inside
06/28 21:52, 7F

06/28 21:52, , 8F
W兄指的是這樣嗎?
06/28 21:52, 8F

06/28 22:12, , 9F
恩 感覺是這樣 PDM 我忘記了 不過你看一下PDM會比較快
06/28 22:12, 9F

06/28 22:16, , 10F
我是用ASDM來跑的...因為我的是ASA的機器
06/28 22:16, 10F

06/28 22:20, , 11F
did not work ... 0rz 我只有一兩個網站不能上y
06/28 22:20, 11F

06/28 22:21, , 12F
雖然影響不大 但是找不出原因感覺很差XD
06/28 22:21, 12F

06/28 22:36, , 13F
你看一下nslookup 看狀況怎樣
06/28 22:36, 13F

06/28 22:36, , 14F
如果還不行 你把outside的MTU Size再改小一點
06/28 22:36, 14F

06/28 23:01, , 15F
Name: forum.fdzone.org
06/28 23:01, 15F

06/28 23:02, , 16F
Address: 58.177.149.87
06/28 23:02, 16F

06/28 23:02, , 17F
MTU size 調成1454 狀況一樣
06/28 23:02, 17F

06/28 23:48, , 18F
telnet forum.fdzone.org 80 看看
06/28 23:48, 18F

06/29 00:30, , 19F
MTU都改成 1500 有解嗎? = =
06/29 00:30, 19F

06/29 00:32, , 20F
我ASA預設in/out 都是 1500
06/29 00:32, 20F

06/29 06:59, , 21F
我的ASA的WAN是1492 目前是正常的耶....
06/29 06:59, 21F

06/29 07:01, , 22F
要不然原po相信我的話...私下連絡給我弄弄看...
06/29 07:01, 22F

06/29 07:01, , 23F
之前摸PIX的時候...是好久以前的事情了...XDDD
06/29 07:01, 23F

06/29 07:01, , 24F
當時摸的還是PIX 515 525 535 的Level... 也摸過520
06/29 07:01, 24F

06/29 07:58, , 25F
telnet xxx.xxx.xxx 80 ok .... XD 好古怪
06/29 07:58, 25F
文章代碼(AID): #1CA87LoA (Network)
文章代碼(AID): #1CA87LoA (Network)