From owner-freebsd-questions  Sat Aug 19 13:39:52 2000
Delivered-To: freebsd-questions@freebsd.org
Received: from mailhost01.reflexnet.net (mailhost01.reflexnet.net [64.6.192.82])
	by hub.freebsd.org (Postfix) with ESMTP id 1176937B424
	for <freebsd-questions@freebsd.org>; Sat, 19 Aug 2000 13:39:49 -0700 (PDT)
Received: from 149.211.6.64.reflexcom.com ([64.6.211.149]) by mailhost01.reflexnet.net  with Microsoft SMTPSVC(5.5.1877.197.19);
	 Sat, 19 Aug 2000 13:38:43 -0700
Received: (from cjc@localhost)
	by 149.211.6.64.reflexcom.com (8.9.3/8.9.3) id NAA11746;
	Sat, 19 Aug 2000 13:39:42 -0700 (PDT)
	(envelope-from cjc)
Date: Sat, 19 Aug 2000 13:39:37 -0700
From: "Crist J . Clark" <cjclark@reflexnet.net>
To: billmc@internetaddress.com
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: hardening my nat/firewall rules
Message-ID: <20000819133937.T28027@149.211.6.64.reflexcom.com>
Reply-To: cjclark@alum.mit.edu
References: <005201c009f3$27ca5bd0$6401a8c0@tp770z>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0i
In-Reply-To: <005201c009f3$27ca5bd0$6401a8c0@tp770z>; from billmcmilleon@home.com on Sat, Aug 19, 2000 at 10:35:43AM -0500
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On Sat, Aug 19, 2000 at 10:35:43AM -0500, Bill McMilleon wrote:
> I'd love to "harden" this ipfw ruleset up a bit --- any suggestions are
> welcome.
> I tried some of the newer keep-state stuff, but could never get it to work
> right.

My dynamic rules work fine. Here are my rules. The setup looks very
similar to yours,

  ############
  # Setup system for firewall service.
  #
  # 2000/01/03, cjc- Customized for cc942873-a.
  #
  # 2000/02/01, cjc- Modified for machine to do NAT. This is a gateway.
  #
  # 2000/07/29, cjc- Major changes for DHCP.
  
  # Suck in the configuration variables.
  if [ -f /etc/defaults/rc.conf ]; then
  	. /etc/defaults/rc.conf
  	source_rc_confs
  elif [ -f /etc/rc.conf ]; then
  	. /etc/rc.conf
  fi
  
  if [ "x$1" != "x" ]; then
  	firewall_type=$1
  fi
  
  ############
  # Info about local net numbers
  dhcpc_range="64.6.192.0/19"
  dhcps_range="${dhcpc_range}"
  net="192.168.64.0/24"
  iip="192.168.64.254"
  ibc="192.168.64.255"
  iif="de0"
  oip=`/sbin/ifconfig ${natd_interface} | /usr/bin/awk '/inet / { print $2 }'`
  oif=${natd_interface}
  obc=`/sbin/ifconfig ${natd_interface} | /usr/bin/awk '/inet / { print $6 }'`
  ############
  # Set quiet mode if requested
  if [ "x$firewall_quiet" = "xYES" ]; then
  	fwcmd="/sbin/ipfw -q"
  else
  	fwcmd="/sbin/ipfw"
  fi
  
  ############
  # Flush out the list before we begin.
  $fwcmd -f flush
  
  ############
  # Only in rare cases do you want to change these rules
  $fwcmd add 100 pass all from any to any via lo0
  $fwcmd add 200 deny log all from any to 127.0.0.0/8
  
  
  ############
  # Stop spoofing
  $fwcmd add deny log ip from ${oip} to not ${obc} recv ${oif}
  $fwcmd add deny log ip from ${iip} to not ${ibc} recv ${iif}
  
  ############
  # Let DHCP work
  $fwcmd add pass udp from ${dhcpc_range} 68 to ${dhcps_range} 67 out via ${oif}
  $fwcmd add pass udp from ${dhcps_range} 67 to ${dhcpc_range} 68 in  via ${oif}
  $fwcmd add pass udp from 0.0.0.0 68 to 255.255.255.255 67 out via ${oif}
  $fwcmd add pass udp from ${dhcps_range} 67 to 255.255.255.255 68 in  via ${oif}
  
  ############
  # Jump ahead with stuff destined for this machine
  $fwcmd add skipto 10000 ip from any to ${oip} in via ${oif}
  $fwcmd add skipto 10000 ip from any to ${obc} in via ${oif}
  
  ############
  # Block anything not meant for this machine
  $fwcmd add deny ip from any to any in via fxp0
  
  ############
  # These rules are required for using natd.  All packets are passed to
  # natd before they encounter your remaining rules.  The firewall rules
  # will then be run again on each packet after translation by natd,
  # minus any divert rules (see natd(8)).
  if [ "X${natd_enable}" = X"YES" -a "X${natd_interface}" != X"" ]; then
      $fwcmd 10000 add divert natd all from any to any via ${natd_interface}
  fi
  
  # Prototype setups.
  # Just keeping the 'open' for testing purposes
  if [ "${firewall_type}" = "open" -o "${firewall_type}" = "OPEN" ]; then
  
      $fwcmd add 65000 pass all from any to any
  
  else
  
      $fwcmd add check-state
  
      $fwcmd add pass tcp from ${oip} to any out via ${oif} keep-state
      $fwcmd add pass udp from ${oip} to any out via ${oif} keep-state
      $fwcmd add pass icmp from ${oip} to any out via ${oif} keep-state
      $fwcmd add pass icmp from any to any icmptypes 0,3,11
  
      $fwcmd add pass ip from ${net} to any in via ${iif} keep-state
      $fwcmd add pass ip from ${iip} to ${net} out via ${iif}
  
      $fwcmd add pass tcp from any to ${oip} 22 in via ${oif} keep-state
  
      ############
      # Drop NetBIOS noise
      $fwcmd add deny udp from any 137-138 to ${obc} 137-138 in via ${oif}
  
      $fwcmd add deny log tcp from any to any in via ${oif} setup
      $fwcmd add deny log udp from any to any in via ${oif}
  
      $fwcmd add deny log ip from any to any via ${iif}
  
  #    $fwcmd add deny log ip from any to any
  
  fi
  
  #End

-- 
Crist J. Clark                           cjclark@alum.mit.com


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message