Date: Fri, 14 Jun 2002 08:54:06 -0400 From: "Joe & Fhe Barbish" <barbish@a1poweruser.com> To: "Eeuy Oeieoei" <ilia@academy.urc.ac.ru> Cc: "FBSDQ" <questions@FreeBSD.ORG> Subject: RE: ipfw: outgoing connections only Message-ID: <MIEPLLIBMLEEABPDBIEGGELDCCAA.barbish@a1poweruser.com> In-Reply-To: <20020614173014.X42286-100000@sol.chel.skbkontur.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
Content of /etc/ipfw.rules.conf # These rules can be reloaded with out rebooting by issuing this command # sh /etc/ipfw.rules.conf /sbin/ipfw -q -f flush # Set rules command prefix # The -q option on the command is for quite mode. # Do not display rules as they load. Remove during development to see. cmd="/sbin/ipfw -q add" # Set defaults oif="rl0" # Nic card to modem public internet connection odns1="241.250.241.250" # ISP's dns server IP address $cmd 00200 divert natd all from any to any via $oif ######## control section ############################################ # Start of IPFW advanced Stateful Filtering using "dynamic" rules. # The check-state statement behavior is to match bi-directional packet traffic # flow between source and destination using protocol/IP/port/sequence number. # Allow the packet through if it has previous been added to the # the "dynamic" rules table by an allow keep-state statement. $cmd 00400 check-state # Run all private LAN xl0 packet traffic through the dynamic rules # table so the IP address are in sync with Natd. You would have one # rule like this for each Nic card you have for private lans. $cmd 00500 allow all from any to any via xl0 keep-state # Deny all fragments coming in as bogus packets $cmd 00530 deny all from any to any frag in via $oif # Deny ACK packets that did not match the dynamic rule table $cmd 00540 deny tcp from any to any established in via $oif ######## outbound section ############################################ # Interrogate packets originating from behind the firewall, private net. # Upon a rule match, it's keep-state option will create a dynamic rule. # Allow out non-secure standard http function $cmd 00600 allow tcp from any to any 80 out via $oif setup keep-state # Allow out secure www function https over TLS SSL $cmd 00601 allow tcp from any to any 443 out via $oif setup keep-state # Allow out access to my ISP's Domain name server. $cmd 00610 allow tcp from any to $odns1 53 out via $oif setup keep-state $cmd 00611 allow udp from any to $odns1 53 out via $oif keep-state # Allow out send & get email function $cmd 00630 allow tcp from any to any 25,110 out via $oif setup keep-state # Allow out FBSD (make install & CVSUP) functions # Basically give user id [ROOT] "GOD" privileges. $cmd 00640 allow tcp from me to any out via $oif setup keep-state uid root ######## inbound section ############################################ # Interrogate packets originating from in front of the firewall, public net. # Allow in www http access to my apache server $cmd 00800 allow tcp from any to any 80 in via $oif setup keep-state limit src-addr 4 # Allow TCP FTP control channel in & data channel out $cmd 00810 allow tcp from any to me 21 in via $oif setup keep-state limit src-addr 4 $cmd 00811 allow tcp from any 20 to any 1024-49151 out via $oif setup keep l imit src-addr 4 # Allow in ssh function $cmd 00820 allow log tcp from any to me 22 in via $oif setup keep-state limit src-addr 4 # Allow in Telnet $cmd 00830 allow tcp from any to me 23 in via $oif setup keep-state limit src-addr 4 This is just a sample from which you can build from. The main thing is it demonstrates how to code and organize your advanced stateful rules file. There is some command line wrap around happening in this email so be sure each $cmd is on a single line. Joe -----Original Message----- From: owner-freebsd-questions@FreeBSD.ORG [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Илья Шипицин Sent: Friday, June 14, 2002 7:34 AM To: questions@FreeBSD.ORG Subject: ipfw: outgoing connections only Dear Sirs, for example, I want to allow incoming tcp/udp connections to certain ports, i.e. tcp1..tcpN, udp1...udpN. And I want to allow any outgoing connection from that machine. I'm not sure about ipfw rules, any advice ? Regards, (Наилучшие пожелания) Ilia Chipitsine (Илья Шипицин) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?MIEPLLIBMLEEABPDBIEGGELDCCAA.barbish>