From owner-freebsd-questions@FreeBSD.ORG  Mon Jul 10 22:38:53 2006
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 37AFE16A59C
	for <freebsd-questions@freebsd.org>;
	Mon, 10 Jul 2006 22:38:53 +0000 (UTC) (envelope-from user@dhp.com)
Received: from shell.dhp.com (shell.dhp.com [199.245.105.1])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B1D3643D46
	for <freebsd-questions@freebsd.org>;
	Mon, 10 Jul 2006 22:38:52 +0000 (GMT) (envelope-from user@dhp.com)
Received: by shell.dhp.com (Postfix, from userid 896)
	id AF0CE3132A; Mon, 10 Jul 2006 18:38:51 -0400 (EDT)
Date: Mon, 10 Jul 2006 18:38:51 -0400 (EDT)
From: Ensel Sharon <user@dhp.com>
To: freebsd-questions@freebsd.org
Message-ID: <Pine.LNX.4.21.0607101740470.12027-100000@shell.dhp.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Subject: Sanity-check for my (working) ipfw rules  please...
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Jul 2006 22:38:53 -0000


My individual hosts have a set of firewall rules on each of them that
looks like this:


/sbin/ipfw add 00010 allow ip from any to any via lo0
/sbin/ipfw add 00020 deny ip from any to 127.0.0.0/8
 
/sbin/ipfw add 00100 count ip from any to any via em0 in
/sbin/ipfw add 00100 count ip from any to any via em0 out

/sbin/ipfw add 01000 allow tcp from any to any established

/sbin/ipfw add 01010 deny tcp from any to any tcpflags syn tcpoptions !mss
/sbin/ipfw add 01011 deny icmp from any to any icmptypes
4,5,9,10,12,13,14,15,16,17,18
/sbin/ipfw add 01012 deny tcp from any to any tcpflags syn,fin
/sbin/ipfw add 01013 deny tcp from any to any tcpflags fin,psh,rst,urg

/sbin/ipfw add 02001 allow udp from 10.10.10.10 to any 53
/sbin/ipfw add 02002 allow udp from any 53 to 10.10.10.10
/sbin/ipfw add 02003 allow tcp from any to 10.10.10.10 21,22,80,443 setup
/sbin/ipfw add 02009 deny ip from any to 10.10.10.10


Easy.  Some standard loopback lines, count traffic on the interface, allow
established, block out obvious offedners (xmas tree, syn/fin, etc.) and
then open up the ports I need and block everything else.  Easy.  It works
great.

Two questions:  is it appropriate to have line 01000 above all of my
bad-behavior lines ?  That is, by allowing all established, is it possible
that some of those bad tcp packetrs could be let in before they hit my
bad-behavior block of ipfw rules ?  Or are all of those bad behaviors
inconsistent with being an established tcp session ?

Second, are there any other bad-behavior blocks I should put into my list?

Thanks!