Date: Sat, 1 Dec 2001 17:51:17 -0800 From: "Crist J . Clark" <cjc@FreeBSD.ORG> To: Thor Legvold <tlegvold@hotmail.com> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Firewall rules (ipfw) Message-ID: <20011201175117.O13613@blossom.cjclark.org> In-Reply-To: <F1450nzlk81ZXfMIxcc0001d1dd@hotmail.com>; from tlegvold@hotmail.com on Sun, Dec 02, 2001 at 12:37:28AM %2B0000 References: <F1450nzlk81ZXfMIxcc0001d1dd@hotmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Dec 02, 2001 at 12:37:28AM +0000, Thor Legvold wrote:
[snip]
> I currently have the following:
>
> # Allow loopback iface, stop all 127 addresses
> ${fwcmd} add 100 pass all from any to any via lo0
> ${fwcmd} add 200 deny all from any to 127.0.0.0/8
>
> # Allow DHCP setup via cable0
> ${fwcmd} add allow log udp from any 67 to 0.0.0.0 68 out xmit cable0
> ${fwcmd} add allow log udp from 10.10.0.0/16 67 to 10.10.2.0/24 68 in via
> cable0
These DHCP rules are a bit messed up. ITYM something more like,
# Allow our initial discovery of a server
${fwcmd} add allow log udp from 0.0.0.0 68 to 255.255.255.255 67 out xmit cable0
# Allow a server's initial response
${fwcmd} add allow log udp from 10.10.0.0/16 67 to 255.255.255.255 68 in recv cable0
# Allow server to talk to us
${fwcmd} add allow log udp from 10.10.0.0/16 67 to 10.10.2.0/24 68 in via cable0
# Allow us to talk to server
${fwcmd} add allow log udp from 10.10.2.0/24 68 to 10.10.0.0/16 67 out via cable0
> # Allow GRE & PPTP control connection
> ${fwcmd} add allow tcp from any to any 1723 in recv cable0 setup
> ${fwcmd} add allow gre from any to any via cable0
Nothing here allows you to talk back on that TCP connection.
> # Stop all other traffic via cable0 - only GRE/PPTP/DHCP allowed
> ${fwcmd} add deny log all from any to any via cable0
Nothing else at all is going to go in or out? OK.
> # NAT
> ${fwcmd} add divert natd log all from any to any via tun0
OK.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011201175117.O13613>