Date: Mon, 1 Oct 2001 20:01:21 -0400 From: "Ilya" <mail@krel.org> To: <security@FreeBSD.ORG> Subject: 2 questions about ipfw Message-ID: <006001c14ad5$5e5283c0$0100a8c0@ilya> References: <20010929223004.M70637@mh57.net> <20011001133249.D304@blossom.cjclark.org>
next in thread | previous in thread | raw e-mail | index | archive | help
I have a freebsd natd box with two interfaces (external ed0 and internal fxp0). I found a dynamic ipfw example by Peter Brezny, and it seems to work pretty good, except that nothing gets to rule number 2700. But if i move that rule before divert the whole lan looses connection to internet. And any place after that gets 0 hits. Any suggestions on how to make this ruleset more efficient/secure? thank you PS thank you Peter for providing your ruleset to public ipfw show|more 00100 7466 518126 allow ip from any to any via lo0 00200 0 0 deny log logamount 200 ip from any to 127.0.0.0/8 00300 0 0 deny log logamount 200 ip from 192.168.0.0/24 to any in recv ed0 00400 0 0 deny log logamount 200 ip from not 192.168.0.0/24 to any in recv fxp0 00500 0 0 deny log logamount 200 ip from 192.168.0.0/16 to any in recv ed0 00600 0 0 deny log logamount 200 ip from 172.16.0.0/12 to any in recv ed0 00700 0 0 deny log logamount 200 ip from 10.0.0.0/8 to any in recv ed0 00800 0 0 deny log logamount 200 ip from any to 192.168.0.0/16 in recv ed0 00900 0 0 deny log logamount 200 ip from any to 172.16.0.0/12 in recv ed0 01000 0 0 deny log logamount 200 ip from any to 10.0.0.0/8 in recv ed0 01100 0 0 deny log logamount 200 ip from 0.0.0.0/8 to any in recv ed0 01200 0 0 deny log logamount 200 ip from 169.254.0.0/16 to any in recv ed0 01300 0 0 deny log logamount 200 ip from 192.0.2.0/24 to any in recv ed0 01400 0 0 deny log logamount 200 ip from 224.0.0.0/4 to any in recv ed0 01500 0 0 deny log logamount 200 ip from 240.0.0.0/4 to any in recv ed0 01600 0 0 deny log logamount 200 ip from any to 0.0.0.0/8 in recv ed0 01700 0 0 deny log logamount 200 ip from any to 169.254.0.0/16 in recv ed0 01800 0 0 deny log logamount 200 ip from any to 192.0.2.0/24 in recv ed0 01900 0 0 deny log logamount 200 ip from any to 224.0.0.0/4 in recv ed0 02000 0 0 deny log logamount 200 ip from any to 240.0.0.0/4 in recv ed0 02100 427386 189325029 divert 8668 ip from any to any via ed0 02200 390818 343974531 allow tcp from any to any established 02300 34 1808 allow tcp from any to $myexternalip 22,80,443,25 setup 02400 3438 192784 allow log logamount 200 icmp from any to any icmptype 3,4,11,12 02500 1 58 allow udp from any 53 to $myexternalip 53 02600 55 3365 allow udp from any 1024-65535 to $myexternalip 02700 0 0 check-state 02800 177231 9731222 allow ip from $myexternalip to any keep-state out xmit ed0 02900 290474 27027605 allow ip from 192.168.0.0/24 to any keep-state via fxp0 65534 56 3788 deny log logamount 200 ip from any to any in recv ed0 65535 56 18207 allow ip from any to any To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?006001c14ad5$5e5283c0$0100a8c0>