NEC IX2015はNECプラットフォームズが製造するSOHO向けルーターです。FastEthernetながら豊富なACL機能・PPPoE対応・プロキシDNSなど実用的な機能が充実しており、自宅ラボや小規模オフィスに最適な1台です。今回はPPPoEでISP認証を行い、インターネット接続を確立した際の設定をまとめます。
環境・構成
- FE0/0.1：WAN（PPPoE接続・ISP認証）
- FE0/1.0：無線LAN側（192.168.11.0/24・DHCP配布）
- FE1/0.0：有線LAN側（192.168.1.0/24・DHCP配布）
設定のポイント
- PPPoE認証：FE0/0.1にencapsulation pppoeを設定しPPPプロファイルでISP認証します
- NAPT（IPマスカレード）：ip napt enableでLAN側全端末がWANのIPアドレスを共有します
- ACLフィルタリング：block_in・block_outで危険ポート（Telnet・NetBIOS・各種マルウェアポート等）をブロックします
- プロキシDNS：proxy-dns ip enableでルーター自身がDNSプロキシとして動作します
- NTP時刻同期：NICTのタイムサーバー（133.243.238.x）で自動時刻同期します
設定ファイル
以下は実際の設定ファイルです。パスワード類は伏字にしています。
hostname Router
timezone +09 00
!
!
!
!
!
!
ntp ip enable
ntp server 133.243.238.163
ntp server 133.243.238.164
ntp server 133.243.238.243
ntp server 133.243.238.244
ntp interval 3600
!
!
!
logging buffered 4096
logging subsystem all warn
logging timestamp datetime
!
!
ip route default FastEthernet0/0.1
ip dhcp enable
ip access-list all-block deny ip src any dest any
ip access-list all-pass permit ip src any dest any
ip access-list block_in deny tcp src any sport any dest any dport eq 21
ip access-list block_in deny tcp src any sport eq 21 dest any dport any
ip access-list block_in deny tcp src any sport any dest any dport eq 23
ip access-list block_in deny tcp src any sport eq 23 dest any dport any
ip access-list block_in deny tcp src any sport any dest any dport eq 1243
ip access-list block_in deny tcp src any sport eq 1243 dest any dport any
ip access-list block_in deny tcp src any sport any dest any dport eq 12345
ip access-list block_in deny tcp src any sport eq 12345 dest any dport any
ip access-list block_in deny tcp src any sport any dest any dport eq 27374
ip access-list block_in deny tcp src any sport eq 27374 dest any dport any
ip access-list block_in deny tcp src any sport any dest any dport eq 31785
ip access-list block_in deny tcp src any sport eq 31785 dest any dport any
ip access-list block_in deny udp src any sport any dest any dport eq 31789
ip access-list block_in deny udp src any sport eq 31789 dest any dport any
ip access-list block_in deny udp src any sport any dest any dport eq 31791
ip access-list block_in deny udp src any sport eq 31791 dest any dport any
ip access-list block_out deny tcp src any sport any dest any dport eq 135
ip access-list block_out deny tcp src any sport eq 135 dest any dport any
ip access-list block_out deny udp src any sport any dest any dport eq 135
ip access-list block_out deny udp src any sport eq 135 dest any dport any
ip access-list block_out deny tcp src any sport any dest any dport range 137 139
ip access-list block_out deny tcp src any sport range 137 139 dest any dport any
ip access-list block_out deny udp src any sport any dest any dport range 137 139
ip access-list block_out deny udp src any sport range 137 139 dest any dport any
ip access-list block_out deny tcp src any sport any dest any dport eq 445
ip access-list block_out deny tcp src any sport eq 445 dest any dport any
ip access-list block_out deny udp src any sport any dest any dport eq 445
ip access-list block_out deny udp src any sport eq 445 dest any dport any
ip access-list block_out deny tcp src any sport any dest any dport eq 2049
ip access-list block_out deny tcp src any sport eq 2049 dest any dport any
ip access-list block_out deny udp src any sport any dest any dport eq 2049
ip access-list block_out deny udp src any sport eq 2049 dest any dport any
ip access-list block_out deny tcp src any sport any dest any dport eq 1243
ip access-list block_out deny tcp src any sport eq 1243 dest any dport any
ip access-list block_out deny tcp src any sport any dest any dport eq 12345
ip access-list block_out deny tcp src any sport eq 12345 dest any dport any
ip access-list block_out deny tcp src any sport any dest any dport eq 27374
ip access-list block_out deny tcp src any sport eq 27374 dest any dport any
ip access-list block_out deny tcp src any sport any dest any dport eq 31785
ip access-list block_out deny tcp src any sport eq 31785 dest any dport any
ip access-list block_out deny udp src any sport any dest any dport eq 31789
ip access-list block_out deny udp src any sport eq 31789 dest any dport any
ip access-list block_out deny udp src any sport any dest any dport eq 31791
ip access-list block_out deny udp src any sport eq 31791 dest any dport any
ip access-list icmp permit icmp src any dest any
ip access-list local deny ip src 192.168.0.0/16 dest 192.168.11.0/24
ip access-list private deny ip src 0.0.0.0/8 dest any
ip access-list private deny ip src 10.0.0.0/8 dest any
ip access-list private deny ip src 127.0.0.0/8 dest any
ip access-list private deny ip src 169.254.0.0/16 dest any
ip access-list private deny ip src 172.16.0.0/12 dest any
ip access-list private deny ip src 192.168.0.0/16 dest any
ip access-list private deny ip src 224.0.0.0/4 dest any
ip access-list tcp-pass permit tcp src any sport any dest any dport any
ip access-list telnet permit ip src 192.168.11.0/24 dest any
ip access-list telnet deny ip src any dest any
ip access-list udp-pass permit udp src any sport any dest any dport any
ip access-list dynamic outside dns src any dest any
ip access-list dynamic outside ftp src any dest any
ip access-list dynamic outside http src any dest any
ip access-list dynamic outside sip src any dest any
ip access-list dynamic outside telnet src any dest any
ip access-list dynamic outside access tcp-pass
ip access-list dynamic outside access udp-pass
ip ufs-cache enable
!
!
!
!
!
!
!
dns cache enable
!
proxy-dns ip enable
proxy-dns interface FastEthernet0/0.1 priority 254
!
telnet-server ip enable
telnet-server ip access-list telnet
!
!
!
!
!
!
!
!
!
ppp profile internet
authentication myname ********
authentication password ******* *******
!
ip dhcp profile wlan
assignable-range 192.168.11.3 192.168.11.200
subnet-mask 255.255.255.0
default-gateway 192.168.11.1
dns-server 192.168.11.1
!
ip dhcp profile lan
assignable-range 192.168.1.2 192.168.1.200
subnet-mask 255.255.255.0
default-gateway 192.168.1.1
dns-server 192.168.1.1
!
device FastEthernet0/0
!
device FastEthernet0/1
!
device FastEthernet1/0
!
device BRI1/0
isdn switch-type hsd128k
!
interface FastEthernet0/0.0
no ip address
shutdown
!
interface FastEthernet0/1.0
description WirelessLAN
ip address 192.168.11.1/24
ip dhcp binding wlan
no shutdown
!
interface FastEthernet1/0.0
description LAN
ip address 192.168.1.1/24
ip dhcp binding lan
ip filter local 10 in
ip filter all-pass 65000 in
ip filter all-pass 65000 out
no shutdown
!
interface BRI1/0.0
encapsulation ppp
no auto-connect
no ip address
shutdown
!
interface FastEthernet0/0.1
description WAN
encapsulation pppoe
auto-connect
ppp binding internet
ip address ipcp
ip mtu 1492
ip tcp adjust-mss auto
ip napt enable
ip filter icmp 10 in
ip filter block_in 100 in
ip filter private 1000 in
ip filter all-block 65000 in
ip filter icmp 10 out
ip filter block_out 100 out
ip filter outside 1000 out
ip filter all-block 65000 out
no shutdown
!
interface Loopback0.0
no ip address
!
interface Null0.0
no ip address