From owner-freebsd-questions@FreeBSD.ORG Thu Apr 2 08:43:22 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 79AA3106566C for ; Thu, 2 Apr 2009 08:43:22 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) Received: from relay2.tomsk.ru (relay2.tomsk.ru [212.73.124.8]) by mx1.freebsd.org (Postfix) with ESMTP id C94A18FC19 for ; Thu, 2 Apr 2009 08:43:21 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) X-Virus-Scanned: by clamd daemon 0.93.1 for FreeBSD at relay2.tomsk.ru Received: from admin.sibptus.tomsk.ru (account sudakov@sibptus.tomsk.ru [212.73.125.240] verified) by relay2.tomsk.ru (CommuniGate Pro SMTP 5.1.13) with ESMTPSA id 12229782 for freebsd-questions@freebsd.org; Thu, 02 Apr 2009 15:43:20 +0700 Received: (from sudakov@localhost) by admin.sibptus.tomsk.ru (8.13.6/8.13.6/Submit) id n328hKGv040888 for freebsd-questions@freebsd.org; Thu, 2 Apr 2009 15:43:20 +0700 (OMSST) (envelope-from vas@mpeks.tomsk.su) X-Authentication-Warning: admin.sibptus.tomsk.ru: sudakov set sender to vas@mpeks.tomsk.su using -f Date: Thu, 2 Apr 2009 15:43:19 +0700 From: Victor Sudakov To: freebsd-questions@freebsd.org Message-ID: <20090402084319.GB40576@admin.sibptus.tomsk.ru> Mail-Followup-To: Victor Sudakov , freebsd-questions@freebsd.org References: <20090402055113.GA35989@admin.sibptus.tomsk.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.3i Organization: AO "Svyaztransneft", SibPTUS X-PGP-Key: http://vas.tomsk.ru/vas.asc Subject: Re: keep-state and divert X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Apr 2009 08:43:22 -0000 Michael Powell wrote: > > > > I have read some recommendations on combining a stateful firewall with > > divert, e.g. > > http://www.derkeiler.com/Mailing-Lists/FreeBSD-Security/2003-06/0078.html > > and http://nuclight.livejournal.com/124348.html (the latter is in > > Russian). > > > > Do I understand correctly that it is (mathematically?) impossible to > > use the two together without also using "skipto"? [dd] > > I haven't used ipfw for a very long time, and haven't kept current with any > changes. Below is an example (using kernel pppd) that I used to use a long > time ago. For example purposes only, extract what you need for your specific > configuration needs. I have looked at your ruleset. First you have: [dd] > $fwcmd add divert natd ip from any to me in via ppp0 > $fwcmd add divert natd ip from 10.10.0.0/8 to any out via ppp0 > $fwcmd add check-state > [dd] and only later you have your keep-state rules: > > $fwcmd add allow udp from any to any via ppp0 keep-state > $fwcmd add allow log icmp from any to any icmptypes 3,4 > > $fwcmd add allow tcp from any to me 80 via ppp0 keep-state > > $fwcmd add deny log tcp from any to any in recv ppp0 setup > $fwcmd add allow tcp from any to any out xmit ppp0 setup keep-state > $fwcmd add allow tcp from any to any via ppp0 established keep-state This means your dynamic rules will contain an already NAT-ted address, which is useless. With my example ruleset below, where would you put the keep-state option? 00100 divert 8668 ip from any to table(1) out via rl0 00200 deny log logamount 100 ip from 10.0.0.0/8 to any out via rl0 00300 deny log logamount 100 ip from 172.16.0.0/12 to any out via rl0 00400 deny log logamount 100 ip from 192.168.0.0/16 to any out via rl0 00500 divert 8668 ip from table(1) to any in via rl0 00600 check-state 00700 deny log logamount 100 ip from any to 10.0.0.0/8 in via rl0 00800 deny log logamount 100 ip from any to 172.16.0.0/12 in via rl0 00900 deny log logamount 100 ip from any to 192.168.0.0/16 in via rl0 65535 allow ip from any to any -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN sip:sudakov@sibptus.tomsk.ru