Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 22 Jun 2015 04:25:41 +0000 (UTC)
From:      Julian Elischer <julian@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r284691 - head/etc
Message-ID:  <201506220425.t5M4PfpI099067@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: julian
Date: Mon Jun 22 04:25:41 2015
New Revision: 284691
URL: https://svnweb.freebsd.org/changeset/base/284691

Log:
  remove 16 rules and replace by 2 by using a table
  I've been doing this ever since there were tables
  coudl make more efficient by using "in recv"  and "out xmit" instead of via
  but I'll leave that.
  
  MFC after:	1 week

Modified:
  head/etc/rc.firewall

Modified: head/etc/rc.firewall
==============================================================================
--- head/etc/rc.firewall	Mon Jun 22 00:54:47 2015	(r284690)
+++ head/etc/rc.firewall	Mon Jun 22 04:25:41 2015	(r284691)
@@ -266,6 +266,7 @@ case ${firewall_type} in
 	#  firewall_simple_oif_ipv6:	Outside IPv6 network interface.
 	#  firewall_simple_onet_ipv6:	Outside IPv6 network prefix.
 	############
+	BAD_ADDR_TBL=13
 
 	# set these to your outside interface network
 	oif="$firewall_simple_oif"
@@ -290,19 +291,23 @@ case ${firewall_type} in
 		fi
 	fi
 
+	# define stuff we should never send out or receive in
 	# Stop RFC1918 nets on the outside interface
-	${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
-	${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
-	${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
+	${fwcmd} table ${BAD_ADDR_TBL} flush
+	${fwcmd} table ${BAD_ADDR_TBL} add 10.0.0.0/8
+	${fwcmd} table ${BAD_ADDR_TBL} add 172.16.0.0/12
+	${fwcmd} table ${BAD_ADDR_TBL} add 192.168.0.0/16
 
 	# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
 	# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
 	# on the outside interface
-	${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
-	${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
-	${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
-	${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
-	${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
+	${fwcmd} table ${BAD_ADDR_TBL} add 0.0.0.0/8
+	${fwcmd} table ${BAD_ADDR_TBL} add 169.254.0.0/16
+	${fwcmd} table ${BAD_ADDR_TBL} add 192.0.2.0/24
+	${fwcmd} table ${BAD_ADDR_TBL} add 224.0.0.0/4
+	${fwcmd} table ${BAD_ADDR_TBL} add 240.0.0.0/4
+
+	${fwcmd} add deny all from any to "table($BAD_ADDR_TBL)" via ${oif}
 
 	# Network Address Translation.  This rule is placed here deliberately
 	# so that it does not interfere with the surrounding address-checking
@@ -319,20 +324,7 @@ case ${firewall_type} in
 		;;
 	esac
 
-	# Stop RFC1918 nets on the outside interface
-	${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
-	${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
-	${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}
-
-	# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
-	# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
-	# on the outside interface
-	${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
-	${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
-	${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
-	${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
-	${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}
-
+	${fwcmd} add deny all from "table($BAD_ADDR_TBL)" to any via ${oif}
 	if [ -n "$inet6" ]; then
 		# Stop unique local unicast address on the outside interface
 		${fwcmd} add deny all from fc00::/7 to any via ${oif6}



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201506220425.t5M4PfpI099067>