From owner-freebsd-security Wed May 9 9:47:19 2001 Delivered-To: freebsd-security@freebsd.org Received: from rafiu.psi-domain.co.uk (rafiu.psi-domain.co.uk [212.87.84.199]) by hub.freebsd.org (Postfix) with ESMTP id 9625337B424 for ; Wed, 9 May 2001 09:47:13 -0700 (PDT) (envelope-from heckfordj@psi-domain.co.uk) Received: from smtp.psi-domain.co.uk (mail.trident-uk.co.uk [195.166.16.10]) by rafiu.psi-domain.co.uk (Postfix) with SMTP id 2BCB1402EC6; Wed, 9 May 2001 17:42:31 +0100 (BST) Date: Wed, 9 May 2001 18:45:52 +0100 From: Jamie Heckford To: Michael Sharp Cc: freebsd-security@freebsd.org Subject: Re: Ip filtering with ipfw Message-ID: <20010509184552.E6456@storm.psi-domain.co.uk> Reply-To: heckfordj@psi-domain.co.uk References: <20010509160500.7232.cpmta@c000.sfo.cp.net> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit In-Reply-To: <20010509160500.7232.cpmta@c000.sfo.cp.net>; from msharp@medmail.com on Wed, May 09, 2001 at 17:05:00 +0100 X-Mailer: Balsa 1.1.1 Lines: 78 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Heres a few examples: ipfw -f flush ipfw add allow tcp from 199.163.7.34 to 192.168.1.3 113 in via xl0 ipfw add allow tcp from 192.168.1.0/24 to any ipfw add deny log ip from any to 192.168.1.0/24 in via xl0 Of course, this is NOT a ruleset you should use in practice, and wouldn't work very well! For more examples see /etc/rc.firewall. Jamie On 2001.05.09 17:05 Michael Sharp wrote: > I am very new to FreeBSD, and have some questions about ipfw > I compiled: options IPFIREWALL > into my kernel, and added: firewall_enable="YES" in /etc/rc.conf > on reboot, I see ipfiltering initializing and the default policy is to > deny. After reboot, I do: ipfw list and get this: > > 00100 allow ip from any to any via lo0 > 00200 deny ip from any to 127.0.0.0/8 > 00300 deny ip from 127.0.0.0/8 to any > 65000 allow ip from any to any > 65535 deny ip from any to any > > which I am assuming is the defaults. Now, to keep it simple, I have a > router between my internal machine ( 192.168.1.3 ) and the Internet and I > set the router to allow only port 113 in to 192.168.1.3 > > ifconfig reveals that my ethernet card is on x10 > > I added to ipfw: > > ipfw add allow tcp from 199.163.7.34 to 192.168.1.3 in via x10 > ipfw add deny all from any to 192.168.1.3 0-1023 in via x10 > > 199.163.7.34 is the ip of a DALnet IRC server that checks identd > My thinking here was I only wanted 199.163.7.34 to get a identd responce > on 113 and block all the others from getting a responce on 113. However, > all the OTHER DALnet servers are getting a responce from 113 ( not just > 199.163.7.34 ) and when I ran nmap from a friends box, it showed 113 > open. > > What am I missing? > > > > ------------------------------------------------------- > Get your free, secure email at http://www.medmail.com - > the e-mail service for the medical community > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > > -- Jamie Heckford Network Operations Manager Psi-Domain - Innovative Linux Solutions. Ask Us How. FreeBSD - The power to serve Join our mailing list and stay informed by emailing majordomo@psi-domain.co.uk with the line: subscribe collective ===================================== email: heckfordj@psi-domain.co.uk web: http://www.psi-domain.co.uk/ tel: +44 (0)1737 789 246 fax: +44 (0)1737 789 245 mobile: +44 (0)7866 724 224 ===================================== To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message