配置comodo防火墙设置

知NAT付琪琪2016-02-22发表V7防火墙内部nat服务器配置外网的电脑能通过防火墙G1/0/1的ip和3389端口号访问内网100.
0.
0.
2的3389服务1先需要在命令行配置如下,可以实现web登入防火墙syssecurity-zonenameTrustimportinterfaceGigabitEthernet1/0/0interfaceGigabitEthernet1/0/0portlink-moderouteipaddress100.
0.
0.
1255.
255.
255.
0acladvanced3333rule0permitipzone-pairsecuritysourceTrustdestinationlocalpacket-filter3333zone-pairsecuritysourcelocaldestinationTrustpacket-filter3333local-useradminclassmanagepasswordhashadminservice-typetelnetterminalhttphttpsauthorization-attributeuser-rolelevel-3authorization-attributeuser-rolenetwork-adminiphttpenableiphttpsenable配置后,电脑连接G1/0/0,电脑配置100.
0.
0.
2ip地址.
使用web的用户名和密码为adminadmin登入防火墙2配置内网接口的dhcp2配置外网接口3外网接G1/0/1口加入安全域4配置trust到trust的互访5nat动态地址转换6配置去外网的静态默认路由7dns配置,开启dns服务器和dns代理8配置nat内部服务器四配置测试结果外网电脑(192.
168.
16.
1)能通过192.
168.
16.
233:3389远程到内部pc机100.
0.
0.
21V7防火墙的菜单和V5差别很大,新增的菜单基本都是标示符+2要用的接口都要加入安全域,而且也要配置同级安全域的互访,同一安全域内报文过滤的缺省动作为deny.
3基本配置要点:nat动态地址转换,静态默认路由,dns服务器器,nat内部服务器4内网电脑的网关要指向防火墙的内网接口5内部服务器配置和V5的差别比较大,根据实际情况选择好映射方式六命令行配置dhcpserverip-poolqq1gateway-list100.
0.
0.
1network100.
0.
0.
0mask255.
255.
255.
0interfaceGigabitEthernet1/0/0portlink-moderouteipaddress100.
0.
0.
1255.
255.
255.
0interfaceGigabitEthernet1/0/1portlink-moderouteipaddress192.
168.
16.
233255.
255.
255.
0natoutbound2000natserverprotocoltcpglobalcurrent-interface3389inside100.
0.
0.
23389security-zonenameTrustimportinterfaceGigabitEthernet1/0/0importinterfaceGigabitEthernet1/0/1zone-pairsecuritysourceTrustdestinationlocalpacket-filter3333zone-pairsecuritysourcelocaldestinationTrustpacket-filter3333security-zoneintra-zonedefaultpermitzone-pairsecuritysourceTrustdestinationTrustobject-policyapplyipTrust-Trustiproute-static0.
0.
0.
00192.
168.
16.
254aclbasic2000rule5permitsource100.
0.
0.
00.
0.
0.
255loggingcountingacladvanced3333rule0permitiplocal-useradminclassmanagepasswordhashadminservice-typetelnetterminalhttphttpsauthorization-attributeuser-rolelevel-3authorization-attributeuser-rolenetwork-adminiphttpenableiphttpsenable