Date: Thu, 8 Feb 2001 20:44:35 +0200 From: Nevermind <never@nevermind.kiev.ua> To: "Christian G.Charette" <chcharette@millic.com.ar> Cc: freebsd-security@FreeBSD.ORG, freebsd-questions@FreeBSD.ORG Subject: Re: ipfw Message-ID: <20010208204435.A4867@nevermind.kiev.ua> In-Reply-To: <01020814513000.00915@spod.mic_ar>; from chcharette@millic.com.ar on Thu, Feb 08, 2001 at 02:51:30PM -0300 References: <01020814513000.00915@spod.mic_ar>
next in thread | previous in thread | raw e-mail | index | archive | help
Hello, Christian G.Charette! On Thu, Feb 08, 2001 at 02:51:30PM -0300, you wrote: > Hi, Im a newbie in Unix and Im running a FreeBSD box with Apache, and > I want to build some Firewall but all the instructives I found are > about firewalling for gateways. All I need is an example of a rule > set or something like that. > What I want to do is block ICMP and only allow a couple of IPs make > telnet to the box. Cris, first you should include "options IPFIREWALL" (without quotes) into your custom kernel config. Then you should decide wether you want closed or opened firewall type. The differences are: closed firewall: everything that is not allowed is denied. opened firewall: everything that is not denied is allowed. If you need to restrict only telnet and icmp, you will need opened firewall, so, you will need following rules: ipfw add deny icmp from any to any ipfw add allow ip from first_box_ip to any 23 ipfw add allow ip from second_box_ip to any 23 ... ipfw add allow ip from any 23 to first_box_ip ipfw add allow ip from any 23 to second_box_ip ... ipfw add deny ip from any to any 23 ipfw add deny ip from any 23 to any ipfw add allow ip from any to any You need the last rule because default is that last rule in ruleset is deny ip from any to any. There is also another option to kernel which sets default to allow, but I don't have LINT here, so, let somebody other to tell it to you. Be aware that this ruleset is only good for home pc because it is not secure and "sdelan na kolenke"(russian, means that it was made in few seconds :>). Or, there is a second way of doing the same thing. Then you'll need closed firewall. I'm not very good at this though, because I'm too lazy to write all of these allowing rules. But I'm working on it on my home box. Maybe there is volounteers to answer Cris about closed firewall with detailed instructions? :) Anyways, it is question for -questions maillist, so I Cc:'ing it there. P.S. Forgive me my owful English. -- NEVE-RIPE To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010208204435.A4867>