From owner-freebsd-security  Mon Dec 10  1:22:16 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mail.af-inet.net (cx793560-b.dt1.sdca.home.com [24.13.5.229])
	by hub.freebsd.org (Postfix) with ESMTP id 3CC7E37B419
	for <freebsd-security@FreeBSD.ORG>; Mon, 10 Dec 2001 01:22:14 -0800 (PST)
Received: from localhost (jaron@localhost)
	by mail.af-inet.net (8.11.4/8.11.4) with ESMTP id fBA9A5f32198;
	Mon, 10 Dec 2001 01:10:06 -0800 (PST)
Date: Mon, 10 Dec 2001 01:10:05 -0800 (PST)
From: Jaron Omega <jaron@af-inet.net>
To: Mike D <d01f1n@yahoo.com>
Cc: <freebsd-security@FreeBSD.ORG>
Subject: Re: ICMP from within only
In-Reply-To: <20011210075231.JFSH3849.mta06-svc.ntlworld.com@there>
Message-ID: <Pine.BSF.4.33.0112100100570.32121-100000@mail.af-inet.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Mon, 10 Dec 2001, Mike D wrote:

>Is it possible to define a rule that will allow through pings and
>traceroutes, but only the ones initiated from within the firewall?
>
>Thanks for any advice!

Yes via 'icmptypes' attribute.

fwcmd = /sbin/ipfw  <- FreeBSD's firewall.

Allows YOU to ping, and run traceroute.
$fwcmd add <number> allow icmp from any to <IP> via <device> icmptypes 0,3,11

Denies others to ping you.
$fwcmd add <number> deny icmp from any to <IP> via <device> icmptypes 0,8

Allows pinging etc, from your personal network.
$fwcmd add <number> allow icmp from <internal network> to <internal IP> via <device> icmptypes 0,8

Jaron Omega


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message