Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 10 Jun 2000 13:37:50 -0400 (EDT)
From:      Greg Hormann <ghormann@alumni.indiana.edu>
To:        security@freebsd.org
Subject:   Setting up simple firewall with ipfw
Message-ID:  <Pine.BSF.4.05.10006101131490.1436-100000@hormann.tzo.cc>

next in thread | raw e-mail | index | archive | help

I'm try to setup a simple little firewall for my stand alone FreeBSD-4.0 
box. Most of what I want seems to be working, but I'm having a few
problems I would appreciate some help with.  (I'm *extremely* new to
firewalls.)



1) This box obtains its internet address via dhcp.  Because of that, I've
been using "any to any via ed0".  This box is dual homed, and at some
point in time I'd like to use natd to make this box a gateway for my
internal network.  Is there a more secure way to set things up when using
dhcp?



2) I can't get logging working to help me trouble shoot my problems.
(IPFIREWALL_VERBOSE is in the kernel.)  -- It may  works, and I don't know
where to look for it.  Its not appear on the console, and after looking
and the man page, i still couldn't figure it out.

sysctl net.inet.ip.fw returns:

net.inet.ip.fw.enable: 1
net.inet.ip.fw.one_pass: 1
net.inet.ip.fw.debug: 1
net.inet.ip.fw.verbose: 1
net.inet.ip.fw.verbose_limit: 0
net.inet.ip.fw.dyn_buckets: 256
net.inet.ip.fw.curr_dyn_buckets: 256
net.inet.ip.fw.dyn_count: 0
net.inet.ip.fw.dyn_max: 1000
net.inet.ip.fw.dyn_ack_lifetime: 300
net.inet.ip.fw.dyn_syn_lifetime: 20
net.inet.ip.fw.dyn_fin_lifetime: 20
net.inet.ip.fw.dyn_rst_lifetime: 5
net.inet.ip.fw.dyn_short_lifetime: 5




3) I'm having trouble getting ftp/ssh traffic through my firewall. (I can
get out, but not in.)  When trying to ftp or ssh in, I receive "TCP/IP
Failure"

I currently have the following rules: (Remember, I'm using dhcp hence so
many "any to any"

00100 108  7771 allow tcp from any to any via ed0 established
00100 114 15516 allow ip from any to any via lo0
00200   1    44 allow tcp from any to any 25 via ed0
00200   0     0 deny ip from any to 127.0.0.0/8
00300   0     0 allow tcp from any to any 23 via ed0
00400   0     0 allow tcp from any to any 22 setup
00500   0     0 allow udp from any to any 22
00600   0     0 allow tcp from any 22 to any
00700   0     0 allow tcp from any to any 20 via ed0
00800   0     0 allow tcp from any to any 21 via ed0
00900   0     0 allow tcp from any to any 80 via ed0
01000   0     0 allow tcp from any to any 220 via ed0
01100   0     0 allow tcp from any to any 546
01200   0     0 allow udp from any to any 56
01300   4   176 allow tcp from any to any 110
01400   5   220 deny log tcp from any to any 1-1024 via ed0
65000  14  1701 allow ip from any to any
65535   6   672 deny ip from any to any


Thanks in advance,

Greg.





To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.05.10006101131490.1436-100000>