Date: Tue, 2 Apr 2002 19:52:35 +0100 From: "G D McKee" <freebsd@gdmckee.com> To: "Freebsd-Questions@Freebsd. Org (E-mail)" <freebsd-questions@freebsd.org> Subject: Advice on IPFW Based Firewalls Message-ID: <00d901c1da77$8df4d240$c800a8c0@p1000>
next in thread | raw e-mail | index | archive | help
Hi I have been reading the FreeBSD Cheat Sheets and have noticed that the firewall script differs from the way the ipfw man page says to do it. I am referring to the section on statefull filtering. The demo file at http://people.freebsd.org/~keramida/files/ipfw.rules seems to do it the correct way - it there is such away? Is the old way wrong or is there a good reason for doing it the old way? Also - what is a sensible limit for limiting the max source address? The following it the bit in the man page I am referring to: A first and efficient way to limit access (not using dynamic rules) is the use of the following rules: ipfw add allow tcp from any to any established ipfw add allow tcp from net1 portlist1 to net2 portlist2 setup ipfw add allow tcp from net3 portlist3 to net3 portlist3 setup ... ipfw add deny tcp from any to any The first rule will be a quick match for normal TCP packets, but it will not match the initial SYN packet, which will be matched by the setup rules only for selected source/destination pairs. All other SYN packets will be rejected by the final deny rule. In order to protect a site from flood attacks involving fake TCP packets, it is safer to use dynamic rules: In order to protect a site from flood attacks involving fake TCP packets, it is safer to use dynamic rules: ipfw add check-state ipfw add deny tcp from any to any established ipfw add allow tcp from my-net to any setup keep-state This will let the firewall install dynamic rules only for those connec- tion which start with a regular SYN packet coming from the inside of our network. Dynamic rules are checked when encountering the first check-state or keep-state rule. A check-state rule should be usually placed near the beginning of the ruleset to minimize the amount of work scanning the ruleset. Your mileage may vary. To limit the number of connections a user can open you can use the fol- lowing type of rules: ipfw add allow tcp from my-net/24 to any setup limit src-addr 10 ipfw add allow tcp from any to me setup limit src-addr 4 Thanks in advance. Gordon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?00d901c1da77$8df4d240$c800a8c0>