Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 30 Jan 2003 16:20:01 -0600
From:      Redmond Militante <r-militante@northwestern.edu>
To:        freebsd-questions@freebsd.org
Subject:   new ipfw/nat ruleset for gateway
Message-ID:  <20030130222001.GA80656@darkpossum>

next in thread | raw e-mail | index | archive | help

--gKMricLos+KVdGMg
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

hi all

i have my test machine set up as a gateway box, with ipfw/natd configured o=
n it, set up to filter/redirect packets bound for a client on my internal n=
etwork.

external ip of my internal client is aliased to the outside nic of the gate=
way box

gateway machine's kernel has been recompiled with:

options IPFIREWALL
options IPDIVERT
options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPFIREWALL_VERBOSE



gateway's /etc/rc.conf looks like=20

defaultrouter=3D"129.x.x.1"
hostname=3D"hostname.com"
ifconfig_xl0=3D"inet 129.x.x.1 netmask 255.255.255.0"
#aliasing internal client's ip to the outside nic of gateway box
ifconfig_xl0_alias0=3D"inet 129.x.1.20 netmask 255.0.0.0"
#inside nic of gateway box
ifconfig_xl1=3D"inet 10.0.0.1 netmask 255.0.0.0"
gateway_enable=3D"YES"
firewall_enable=3D"YES"
#firewall_script=3D"/etc/rc.firewall"
firewall_type=3D"/etc/ipfw.rules"
natd_enable=3D"YES"
#natd interface is outside nic
natd_interface=3D"xl0"
#natd flags redirect any traffic bound for ip of www3 to internal ip of www3
natd_flags=3D"-redirect_address 10.0.0.2 129.x.x.20"
kern_securelevel_enable=3D"NO"
=2E........



internal client's /etc/rc.conf looks like

second machine's /etc/rc.conf:

defaultrouter=3D"10.0.0.1"
ifconfig_xl0=3D"inet 10.0.0.2 netmask 255.0.0.0"
=2E...............


looks like this setup is working. the internal client is a basic webserver/=
ftp server. i am able to ftp to it, ssh to it, view webpages that it serves=
 up, etc. with it hooked up to the internal nic of the gateway box.

i am now trying to come up with a good set of firewall rules on the gateway=
 box to filter out all unnecessary traffic to my internal network. the foll=
owing is my /etc/ipfw.rules on the gateway box.

-----------------------------snip------------------------------

# firewall_type=3D"/etc/ipfw.rules"
# enquirer ipfw.rules

# NAT
add 00100 divert 8668 ip from any to any via xl0

# loopback
add 00210 allow ip from any to any via lo0
add 00220 deny ip from any to 127.0.0.0/8
add 00230 deny ip from 127.0.0.0/8 to any

#allow tcp in for nfs shares
#add 00301 allow tcp from 129.x.x.x to any in via xl0
#add 00302 allow tcp from 129.x.x.x to any in via xl0

#allow tcp in for ftp,ssh, smtp, httpd
add 00303 allow tcp from any to any in 21,22,25,80,10000 via xl0

#deny rest of incoming tcp
add 00309 deny log tcp from any to any in established

#from man 8 ipfw: allow only outbound tcp connections i've created
add 00310 allow tcp from any to any out via xl0


#allow udp in for gateway for DNS
add 00300 allow udp from 10.0.0.0/24 to 129.105.49.1 53 via xl0

#allow udp in for nfs shares
#add 00401 allow udp from 129.x.x.x to any in recv xl0
#add 00402 allow udp from 129.x.x.x to any in recv xl0

#allow all udp out from machine
add 00404 allow udp from any to any out via xl0

#allow some icmp types (codes not supported)
##########allow path-mtu in both directions
add 00500 allow icmp from any to any icmptypes 3
##########allow source quench in and out
add 00501 allow icmp from any to any icmptypes 4
##########allow me to ping out and receive response back
add 00502 allow icmp from any to any icmptypes 8 out
add 00503 allow icmp from any to any icmptypes 0 in
##########allow me to run traceroute
add 00504 allow icmp from any to any icmptypes 11 in
add 00600 deny log ip from any to any

#--- end ipfw.rules ---#

-----------------------------snip------------------------------


any comments on how i could improve this set of ipfw rules to better secure=
 my internal client would be appreciated. thanks again

redmond

--gKMricLos+KVdGMg
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)

iD8DBQE+OaUQFNjun16SvHYRApvWAJ9Vy9QWoigMVfIy8L5Un8MVYU+lAgCgrjhr
AGEMqgzOCPDjkW2n/6aVJSU=
=IqJ6
-----END PGP SIGNATURE-----

--gKMricLos+KVdGMg--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030130222001.GA80656>