Date: Tue, 19 Feb 2002 02:11:50 -0800 From: "Crist J. Clark" <crist.clark@attbi.com> To: ipfw@freebsd.org Subject: Make rc.firewall Agree with Docs and an rc.firewall6 Question Message-ID: <20020219021149.B48401@blossom.cjclark.org>
next in thread | raw e-mail | index | archive | help
I'm planning on making rc.firewall comply more closely to the literal meaning and spirit of the documentation in rc.conf(5) and in-line. The only change of note is no longer making the loopback rules unconditional. The "UNKNOWN" type documented in-line should not do _any_ configuration. When a user loads their own configuration file, rc.firewall should not uncoditionally load its loopback rules. Index: src/etc/rc.firewall =================================================================== RCS file: /export/ncvs/src/etc/rc.firewall,v retrieving revision 1.44 diff -u -r1.44 rc.firewall --- src/etc/rc.firewall 27 Dec 2001 05:40:09 -0000 1.44 +++ src/etc/rc.firewall 19 Feb 2002 09:05:50 -0000 @@ -76,6 +76,15 @@ # http://www.awlonline.com/product/0%2C2627%2C0201633574%2C00.html # +setup_loopback () { + ############ + # Only in rare cases do you want to change these rules + # + ${fwcmd} add 100 pass all from any to any via lo0 + ${fwcmd} add 200 deny all from any to 127.0.0.0/8 + ${fwcmd} add 300 deny ip from 127.0.0.0/8 to any +} + if [ -n "${1}" ]; then firewall_type="${1}" fi @@ -125,18 +134,12 @@ # # ${fwcmd} add 65000 pass all from any to any -############ -# Only in rare cases do you want to change these rules -# -${fwcmd} add 100 pass all from any to any via lo0 -${fwcmd} add 200 deny all from any to 127.0.0.0/8 -${fwcmd} add 300 deny ip from 127.0.0.0/8 to any - # Prototype setups. # case ${firewall_type} in [Oo][Pp][Ee][Nn]) + setup_loopback ${fwcmd} add 65000 pass all from any to any ;; @@ -151,6 +154,8 @@ mask="255.255.255.0" ip="192.0.2.1" + setup_loopback + # Allow any traffic to or from my own net. ${fwcmd} add pass all from ${ip} to ${net}:${mask} ${fwcmd} add pass all from ${net}:${mask} to ${ip} @@ -200,6 +205,8 @@ imask="255.255.255.240" iip="192.0.2.17" + setup_loopback + # Stop spoofing ${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif} ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif} @@ -281,6 +288,9 @@ # config file. ;; +[Cc][Ll][Oo][Ss][Ee][Dd]) + setup_loopback + ;; [Uu][Nn][Kk][Nn][Oo][Ww][Nn]) ;; *) I was going to make the same kind of changes in the rc.firewall6 script, but I am a bit confused by one of the rules, ############ # Only in rare cases do you want to change these rules # ${fw6cmd} add 100 pass all from any to any via lo0 # # ND # # DAD ${fw6cmd} add pass ipv6-icmp from ff02::/16 to :: ${fw6cmd} add pass ipv6-icmp from :: to ff02::/16 # RS, RA, NS, NA, redirect... ${fw6cmd} add pass ipv6-icmp from fe80::/10 to fe80::/10 ${fw6cmd} add pass ipv6-icmp from fe80::/10 to ff02::/16 I understand the first. I understand the last two (allow IPV6-ICMP from link-local unicast addresses to link-local unicast and multicast), and I understand the third (unspecified to link-local multicast). I don't understand the second. RFC2373 says, 2.5.2 The Unspecified Address The address 0:0:0:0:0:0:0:0 is called the unspecified address. ... The unspecified address must not be used as the destination address of IPv6 packets or in IPv6 Routing Headers. To my understanding, any packets matching that second rule are actually invalid. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020219021149.B48401>