From owner-freebsd-current Mon Apr 8 09:21:50 1996 Return-Path: owner-current Received: (from root@localhost) by freefall.freebsd.org (8.7.3/8.7.3) id JAA06967 for current-outgoing; Mon, 8 Apr 1996 09:21:50 -0700 (PDT) Received: from news1.gtn.com (news1.gtn.com [192.109.159.3]) by freefall.freebsd.org (8.7.3/8.7.3) with ESMTP id JAA06958 for ; Mon, 8 Apr 1996 09:21:45 -0700 (PDT) Received: (from uucp@localhost) by news1.gtn.com (8.7.2/8.7.2) id SAA23392 for current@freebsd.org; Mon, 8 Apr 1996 18:01:01 +0200 (MET DST) Received: from localhost (localhost [127.0.0.1]) by knobel.gun.de (8.7.5/8.7.3) with SMTP id RAA00458 for ; Mon, 8 Apr 1996 17:55:25 +0200 (MET DST) Date: Mon, 8 Apr 1996 17:55:24 +0200 (MET DST) From: Andreas Klemm To: current@freebsd.org Subject: rc.firewall has some syntax errors and sample config hangs machine Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-current@freebsd.org X-Loop: FreeBSD.org Precedence: bulk -----BEGIN PGP SIGNED MESSAGE----- Hi ! I tried to use the example firewall configuration from /etc/rc.firewall and had some serious problems. - - syntax errors in /etc/rc.firewall - - machine hangs during access to internet and simply reboots I compiled my kernel with both options: option IPFIREWALL option IPFIREWALL_VERBOSE My Ethernet / PPP configuration (on demand dialup ppp): ed0: flags=8843 mtu 1500 inet 149.237.250.1 netmask 0xffffff00 broadcast 149.237.250.255 ether 00:00:c0:25:fd:2d tun0: flags=8051 mtu 1500 inet 192.109.159.141 --> 192.109.159.13 netmask 0xffffff00 lo0: flags=8009 mtu 16384 inet 127.0.0.1 netmask 0xff000000 At the very beginning of my experiments I used the 1st example from /etc/rc.firewall : %------------------------------------------------------------------------- # problems or you just want to disallow some particular kinds of traffic # they you will want to change the default policy to open. # /sbin/ipfw add 65000 pass all from any to any ############ # Only in rare cases do you want to change this rule /sbin/ipfw add 1000 pass all from 127.0.0.1 to 127.0.0.1 ############ # This is a prototype setup that will protect your system somewhat against # people from outside your own network. # # To enable simply change "false" to "true" in the if line and set the # variables to your network parameters if false ; then # set these to your network and netmask and ip net="192.168.4.0" mask="255.255.255.0" ip="192.168.4.17" # Allow any traffic to or from my own net. /sbin/ipfw add pass all from ${ip} to ${net}:${mask} /sbin/ipfw add pass all from ${net}:${mask} to ${ip} [...and so on....] %------------------------------------------------------------------------- When I rebooted my machine and activated PPP over modem with the command ppp -auto ondemand I was completely unable to dial out to internet. When I tried to do a 'ping a@b.com' I only get 'unknown host' as message. Without the firewall configuration my machine should have dialed up to my ISP and ask his nameserver, because I use resolver services... resolv.conf: domain gun.de nameserver 192.109.159.1 After that I changed the configuration to allow everything, to see, if the ipfw and kernel stuff runs at all.. I used only those two lines in /etc/rc.firewall: /sbin/ipfw add 65000 pass all from any to any /sbin/ipfw add 1000 pass all from 127.0.0.1 to 127.0.0.1 With that configuration turned on, everything works fine again. Ok, so I know, that I have only a firewall configuration problem. With that configration I had no trouble so far... When trying out the 2nd example firewall configuration from /etc/rc.firewall I first noticed some syntax errors reported by ipfw... Here the complete log from sh -x rc.firewall: + /sbin/ipfw add 1000 pass all from 127.0.0.1 to 127.0.0.1 01000 allow all from 127.0.0.1 to 127.0.0.1 + false + true + oif=tun0 + onet=192.109.159.0 + omask=255.255.255.0 + oip=192.109.159.141 + iif=ed0 + inet=149.237.250.0 + imask=255.255.255.0 + iip=149.237.250.1 + /sbin/ipfw add deny all from 149.237.250.0:255.255.255.0 to any in via tun0 2 via /sbin/ipfw: ERROR - Unknown argument Usage: [... lots of usage messages deleted ...] + /sbin/ipfw add deny all from 192.109.159.0:255.255.255.0 to any in via ed0 2 via /sbin/ipfw: ERROR - Unknown argument Usage: [... lots of usage messages deleted ...] + /sbin/ipfw add deny all from 192.168.0.0:255.255.0.0 to any via tun0 00000 deny all from 192.168.0.0 to any via tun0 + /sbin/ipfw add deny all from 172.16.0.0:255.240.0.0 to any via tun0 00000 deny all from 172.16.0.0 to any via tun0 + /sbin/ipfw add deny all from 10.0.0.0:255.0.0.0 to any via tun0 00000 deny all from 10.0.0.0 to any via tun0 + /sbin/ipfw add deny tcp from any to any established 00000 deny tcp from any to any established + /sbin/ipfw add pass tcp from any to 192.109.159.141 25 setup 00000 allow tcp from any to 192.109.159.141 25 setup + /sbin/ipfw add pass tcp from any to 192.109.159.141 53 setup 00000 allow tcp from any to 192.109.159.141 53 setup + /sbin/ipfw add pass tcp from any to 192.109.159.141 80 setup 00000 allow tcp from any to 192.109.159.141 80 setup + /sbin/ipfw add deny log tcp from any to any in via tun0 setup 3 via /sbin/ipfw: ERROR - Unknown argument [... lots of usage messages deleted ...] + /sbin/ipfw add pass tcp from any to any setup 00000 allow tcp from any to any setup + /sbin/ipfw add pass udp from any 53 to 192.109.159.141 00000 allow udp from any 53 to 192.109.159.141 + /sbin/ipfw add pass udp from 192.109.159.141 to any 53 00000 allow udp from 192.109.159.141 to any 53 + /sbin/ipfw add pass udp from any 123 to 192.109.159.141 00000 allow udp from any 123 to 192.109.159.141 + /sbin/ipfw add pass udp from 192.109.159.141 to any 123 00000 allow udp from 192.109.159.141 to any 123 I could fix the error messages by simply removing the token "in" from the bogus command line. For example: Changed this: /sbin/ipfw add deny log tcp from any to any in via tun0 setup to that : /sbin/ipfw add deny log tcp from any to any via tun0 setup The above trace shows you, that I changed the IP Adresses (I hope) properly for the firewall configuration. I simply treat my dialup interface like an ethernet interface to the outside world. + oif=tun0 + onet=192.109.159.0 + omask=255.255.255.0 + oip=192.109.159.141 + iif=ed0 + inet=149.237.250.0 + imask=255.255.255.0 + iip=149.237.250.1 After making the 2nd example run, I tried to ping outside. My machine dialed up to my ISP's machine. So good so far. But I was unable to ping to a host outside, because permission for that were denied (the firewall config). After starting cached and trying to browse the WWW the machine simply hangs ... Not immediately ... about 1-2 minutes. This happened 2 times... And here what the messages file say to me : Apr 8 16:53:14 knobel /kernel: IP firewall initialized Apr 8 16:55:35 knobel /kernel: Connection attempt to UDP 192.109.159.141:1024 from 192.109.159.141:53 Apr 8 16:55:35 knobel /kernel: Connection attempt to UDP 192.109.159.141:1025 from 192.109.159.141:53 Apr 8 16:55:35 knobel /kernel: Connection attempt to UDP 192.109.159.141:1026 from 192.109.159.141:53 Apr 8 16:55:59 knobel /kernel: ipfw: 1800 Deny TCP 192.109.159.141:1025 192.109.159.3:23 Apr 8 16:56:37 knobel /kernel: ipfw: 1800 Deny TCP 192.109.159.141:1029 198.95.249.78:80 Apr 8 16:57:01 knobel /kernel: ipfw: 1800 Deny TCP 192.109.159.141:1050 194.77.8.1:80 Apr 8 17:01:36 knobel /kernel: panic: free: multiple frees ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Apr 8 17:01:36 knobel /kernel: Apr 8 17:01:36 knobel /kernel: syncing disks... FreeBSD 2.2-CURRENT #0: Mon Apr 8 15:38:06 MET DST 1996 [........ reboot ...........] One final wish ... Could someone please check the rc.firewall script, correct the errors and perhaps provide a better working example for a via Modem connected machine to an ISP ?! Things that should be possible (please correct me if I'm wrong) outgoing icmp (ping) outgoing telnet outgoing rlogin outgoing smtp messages (optional) outgoing uucp via tcp/ip outgoing www requests to www and proxy servers outgoing DNS queries incoming icmp (ping) incoming smtp messages (optional) incoming www queries to own WWW server incoming DNS queries Thanks !!! BTW: the firewall stuff is really cool, ... but it's horrible to understand each bit and byte ... One really fine working firewall example in rc.firewall would be fine... If you need someone to test a configuration ... here I am ... In the meantime I'll try to roll a working ony myself ... Andreas /// - -- andreas@knobel.gun.de /\/\___ Wiechers & Partner Datentechnik GmbH Andreas Klemm ___/\/\/ $$ Support Unix - aklemm@wup.de $$ pgp p-key http://www-swiss.ai.mit.edu/~bal/pks-toplev.html >>> powered by <<< ftp://sunsite.unc.edu/pub/Linux/system/Printing/aps-491.tgz >>> FreeBSD <<< -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMWk27fMLpmkD/U+FAQG7twP9FYd3b9kwooo90E3A/oANTfJSmpkr6etO XDyC44E8NOEgN+eS0THoHfiBdXETTHehW1mxiOEoFlA5x4ZnKZJuKsJ2peaCT1Np RLLGZlGq2+pGKjQp0A710AcWN8qaMnh+U7qcigSko6S9ccB2X3hiBcxj+cME8jI0 pCU6Di6+Cr4= =hveo -----END PGP SIGNATURE-----