Laravel + eBPF/XDP + Redis + MySQL + Nginx 实现防火墙和端口隐藏方案

最新推荐文章于 2025-05-15 21:08:14 发布

深山技术宅

最新推荐文章于 2025-05-15 21:08:14 发布

阅读量227

点赞数 8

文章标签： laravel redis mysql

本文链接：https://blog.csdn.net/jjj_web/article/details/147965529

版权

Laravel + eBPF/XDP + Redis + MySQL + Nginx 实现防火墙和端口隐藏方案

架构概述

这个方案结合了多种技术来实现高级防火墙和端口隐藏功能：

Laravel - 作为管理界面和控制中心
eBPF/XDP - 提供高性能网络数据包过滤和处理
Redis - 用于存储实时规则和会话状态
MySQL - 存储持久化配置和日志
Nginx - 作为Web服务器和反向代理

实现步骤

1. eBPF/XDP 层实现

// xdp_firewall.c - 基本的XDP防火墙实现
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>

SEC("xdp")
int xdp_firewall(struct xdp_md *ctx) {
    void *data_end = (void *)(long)ctx->data_end;
    void *data = (void *)(long)ctx->data;
    
    struct ethhdr *eth = data;
    if (eth + 1 > data_end) return XDP_PASS;
    
    if (eth->h_proto != htons(ETH_P_IP)) return XDP_PASS;
    
    struct iphdr *ip = data + sizeof(*eth);
    if (ip + 1 > data_end) return XDP_PASS;
    
    // 检查是否为TCP
    if (ip->protocol != IPPROTO_TCP) return XDP_PASS;
    
    struct tcphdr *tcp = (void *)ip + sizeof(*ip);
    if (tcp + 1 > data_end) return XDP_PASS;
    
    // 从Redis检查规则（伪代码）
    // if (redis_check_block(ip->saddr, tcp->dest)) {
    //     return XDP_DROP;
    // }
    
    // 端口隐藏逻辑 - 丢弃对隐藏端口的探测包
    // if (tcp->dest == htons(HIDDEN_PORT) && tcp->syn && !tcp->ack) {
    //     return XDP_DROP;
    // }
    
    return XDP_PASS;
}

2. Laravel 管理界面

// FirewallRuleController.php
namespace App\Http\Controllers;

use Illuminate\Http\Request;
use App\Models\FirewallRule;
use Illuminate\Support\Facades\Redis;

class FirewallRuleController extends Controller
{
    public function addRule(Request $request)
    {
        $validated = $request->validate([
            'source_ip' => 'required|ip',
            'destination_port' => 'required|integer',
            'action' => 'required|in:allow,block'
        ]);
        
        // 保存到MySQL
        $rule = FirewallRule::create($validated);
        
        // 同步到Redis供XDP程序快速访问
        Redis::hset('firewall_rules', 
            "{$validated['source_ip']}:{$validated['destination_port']}", 
            $validated['action']
        );
        
        return response()->json(['message' => 'Rule added successfully']);
    }
    
    public function togglePortVisibility(Request $request)
    {
        $port = $request->input('port');
        $hidden = $request->input('hidden');
        
        // 更新端口隐藏状态
        Redis::hset('hidden_ports', $port, $hidden ? '1' : '0');
        
        return response()->json(['message' => 'Port visibility updated']);
    }
}

3. Redis 数据结构设计

# 防火墙规则哈希表
HSET firewall_rules "192.168.1.100:22" "block"
HSET firewall_rules "10.0.0.0/8:3389" "allow"

# 隐藏端口集合
HSET hidden_ports 8080 1  # 端口8080被隐藏
HSET hidden_ports 22 0    # 端口22可见

4. Nginx 配置增强

# 隐藏服务器信息
server_tokens off;

# 非标准端口配置
server {
    listen 8080;
    server_name _;
    
    # 仅允许通过特定路径访问
    location /hidden-api {
        # 验证请求来源
        if ($remote_addr !~* "^(192\.168\.1\.100|10\.0\.0\.1)$") {
            return 444;
        }
        
        proxy_pass http://localhost:8000;
    }
    
    # 其他请求返回404
    location / {
        return 404;
    }
}

高级功能实现

1. 动态端口敲门 (Port Knocking)

// PortKnockingController.php
public function handleKnock(Request $request)
{
    $sequence = $request->input('sequence'); // 例如 "1001,2002,3003"
    $clientIp = $request->ip();
    
    // 验证敲门序列
    if ($this->validateKnockSequence($sequence)) {
        // 临时开放端口（30秒）
        Redis::setex("access:$clientIp", 30, '1');
        return response()->json(['status' => 'access granted']);
    }
    
    return response()->json(['status' => 'access denied'], 403);
}

2. 基于行为的自动阻断

// 分析日志并自动添加规则
public function analyzeAndBlock()
{
    $logEntries = Log::where('created_at', '>', now()->subMinutes(5))
        ->where('status', 403)
        ->groupBy('ip')
        ->havingRaw('COUNT(*) > 10')
        ->get();
    
    foreach ($logEntries as $entry) {
        $this->addBlockRule($entry->ip);
    }
}