Date: Sat, 19 Aug 2000 13:39:37 -0700 From: "Crist J . Clark" <cjclark@reflexnet.net> To: billmc@internetaddress.com Cc: freebsd-questions@FreeBSD.ORG Subject: Re: hardening my nat/firewall rules Message-ID: <20000819133937.T28027@149.211.6.64.reflexcom.com> In-Reply-To: <005201c009f3$27ca5bd0$6401a8c0@tp770z>; from billmcmilleon@home.com on Sat, Aug 19, 2000 at 10:35:43AM -0500 References: <005201c009f3$27ca5bd0$6401a8c0@tp770z>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Aug 19, 2000 at 10:35:43AM -0500, Bill McMilleon wrote:
> I'd love to "harden" this ipfw ruleset up a bit --- any suggestions are
> welcome.
> I tried some of the newer keep-state stuff, but could never get it to work
> right.
My dynamic rules work fine. Here are my rules. The setup looks very
similar to yours,
############
# Setup system for firewall service.
#
# 2000/01/03, cjc- Customized for cc942873-a.
#
# 2000/02/01, cjc- Modified for machine to do NAT. This is a gateway.
#
# 2000/07/29, cjc- Major changes for DHCP.
# Suck in the configuration variables.
if [ -f /etc/defaults/rc.conf ]; then
. /etc/defaults/rc.conf
source_rc_confs
elif [ -f /etc/rc.conf ]; then
. /etc/rc.conf
fi
if [ "x$1" != "x" ]; then
firewall_type=$1
fi
############
# Info about local net numbers
dhcpc_range="64.6.192.0/19"
dhcps_range="${dhcpc_range}"
net="192.168.64.0/24"
iip="192.168.64.254"
ibc="192.168.64.255"
iif="de0"
oip=`/sbin/ifconfig ${natd_interface} | /usr/bin/awk '/inet / { print $2 }'`
oif=${natd_interface}
obc=`/sbin/ifconfig ${natd_interface} | /usr/bin/awk '/inet / { print $6 }'`
############
# Set quiet mode if requested
if [ "x$firewall_quiet" = "xYES" ]; then
fwcmd="/sbin/ipfw -q"
else
fwcmd="/sbin/ipfw"
fi
############
# Flush out the list before we begin.
$fwcmd -f flush
############
# Only in rare cases do you want to change these rules
$fwcmd add 100 pass all from any to any via lo0
$fwcmd add 200 deny log all from any to 127.0.0.0/8
############
# Stop spoofing
$fwcmd add deny log ip from ${oip} to not ${obc} recv ${oif}
$fwcmd add deny log ip from ${iip} to not ${ibc} recv ${iif}
############
# Let DHCP work
$fwcmd add pass udp from ${dhcpc_range} 68 to ${dhcps_range} 67 out via ${oif}
$fwcmd add pass udp from ${dhcps_range} 67 to ${dhcpc_range} 68 in via ${oif}
$fwcmd add pass udp from 0.0.0.0 68 to 255.255.255.255 67 out via ${oif}
$fwcmd add pass udp from ${dhcps_range} 67 to 255.255.255.255 68 in via ${oif}
############
# Jump ahead with stuff destined for this machine
$fwcmd add skipto 10000 ip from any to ${oip} in via ${oif}
$fwcmd add skipto 10000 ip from any to ${obc} in via ${oif}
############
# Block anything not meant for this machine
$fwcmd add deny ip from any to any in via fxp0
############
# These rules are required for using natd. All packets are passed to
# natd before they encounter your remaining rules. The firewall rules
# will then be run again on each packet after translation by natd,
# minus any divert rules (see natd(8)).
if [ "X${natd_enable}" = X"YES" -a "X${natd_interface}" != X"" ]; then
$fwcmd 10000 add divert natd all from any to any via ${natd_interface}
fi
# Prototype setups.
# Just keeping the 'open' for testing purposes
if [ "${firewall_type}" = "open" -o "${firewall_type}" = "OPEN" ]; then
$fwcmd add 65000 pass all from any to any
else
$fwcmd add check-state
$fwcmd add pass tcp from ${oip} to any out via ${oif} keep-state
$fwcmd add pass udp from ${oip} to any out via ${oif} keep-state
$fwcmd add pass icmp from ${oip} to any out via ${oif} keep-state
$fwcmd add pass icmp from any to any icmptypes 0,3,11
$fwcmd add pass ip from ${net} to any in via ${iif} keep-state
$fwcmd add pass ip from ${iip} to ${net} out via ${iif}
$fwcmd add pass tcp from any to ${oip} 22 in via ${oif} keep-state
############
# Drop NetBIOS noise
$fwcmd add deny udp from any 137-138 to ${obc} 137-138 in via ${oif}
$fwcmd add deny log tcp from any to any in via ${oif} setup
$fwcmd add deny log udp from any to any in via ${oif}
$fwcmd add deny log ip from any to any via ${iif}
# $fwcmd add deny log ip from any to any
fi
#End
--
Crist J. Clark cjclark@alum.mit.com
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000819133937.T28027>