Date: Thu, 6 Jun 2002 19:36:58 -0400 From: "Joe & Fhe Barbish" <barbish@a1poweruser.com> To: "Brent Bailey" <misterb@bmyster.com> Cc: "FBSDQ" <questions@FreeBSD.ORG> Subject: RE: ipfw & advanced statefull rules help!! Message-ID: <MIEPLLIBMLEEABPDBIEGIEDDCCAA.barbish@a1poweruser.com> In-Reply-To: <25420.206.98.60.1.1023386837.squirrel@bmyster.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Advanced stateful rules and IPFW's built in divert natd function is very hard to get to function correctly for an LAN behind the firewall. I have stumbled into the solution to this problem after many months of testing. This solution has only been tested on FBSD version 4.5. All private LAN Nic interface devices must have keep-state on the rule so they get in sync with the keep-state dynamic table rules for the DSL or Cable internet connection interface. The order of private Lan rules before the public out & in rules, both which have to come after the divert natd rule is very important. See rule 500 below. Content of /etc/ipfw.rules.conf # These rules can be reloaded with out rebooting by issuing this command # sh /etc/ipfw.rules.conf /sbin/ipfw -q -f flush # Set rules command prefix # The -q option on the command is for quite mode. # Do not display rules as they load. Remove during development to see. cmd="/sbin/ipfw -q add" # Set defaults oif="rl0" # Nic card to DSL modem public internet connection odns1="241.250.241.250" # ISP's dns server IP address $cmd 00200 divert natd all from any to any via $oif ######## control section ############################################ # Start of IPFW advanced Stateful Filtering using "dynamic" rules. # The check-state statement behavior is to match bi-directional packet traffic # flow between source and destination using protocol/IP/port/sequence number. # Allow the packet through if it has previous been added to the # the "dynamic" rules table by an allow keep-state statement. $cmd 00400 check-state # Run all private LAN xl0 packet traffic through the dynamic rules # table so the IP address are in sync with Natd. You would have one rule like # this for each Nic card you have for private lans. $cmd 00500 allow all from any to any via xl0 keep-state # Deny all fragments coming in as bogus packets $cmd 00530 deny all from any to any frag in via $oif # Deny ACK packets that did not match the dynamic rule table $cmd 00540 deny tcp from any to any established in via $oif ######## outbound section ############################################ # Interrogate packets originating from behind the firewall, private net. # Upon a rule match, it's keep-state option will create a dynamic rule. # Allow out non-secure standard http function $cmd 00600 allow tcp from any to any 80 out via $oif setup keep-state # Allow out secure www function https over TLS SSL $cmd 00601 allow tcp from any to any 443 out via $oif setup keep-state # Allow out access to my ISP's Domain name server. $cmd 00610 allow tcp from any to $odns1 53 out via $oif setup keep-state $cmd 00611 allow udp from any to $odns1 53 out via $oif keep-state # Allow out send & get email function $cmd 00630 allow tcp from any to any 25,110 out via $oif setup keep-state # Allow out FBSD (make install & CVSUP) functions # Basically give user id [ROOT] "GOD" privileges. $cmd 00640 allow tcp from me to any out via $oif setup keep-state uid root ######## inbound section ############################################ # Interrogate packets originating from in front of the firewall, public net. # Allow in www http access to my apache server $cmd 00800 allow tcp from any to any 80 in via $oif setup keep-state limit src-addr 4 # Allow TCP FTP control channel in & data channel out $cmd 00810 allow tcp from any to me 21 in via $oif setup keep-state limit src-addr 4 $cmd 00811 allow tcp from any 20 to any 1024-49151 out via $oif setup keep limit src-addr 4 # Allow in ssh function $cmd 00820 allow log tcp from any to me 22 in via $oif setup keep-state limit src-addr 4 # Allow in Telnet $cmd 00830 allow tcp from any to me 23 in via $oif setup keep-state limit src-addr 4 This is just a sample from which you can build from. The main thing is it demonstrates how to code and organize your advanced stateful rules file to meet your stated needs. Joe -----Original Message----- From: owner-freebsd-questions@FreeBSD.ORG [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Brent Bailey Sent: Thursday, June 06, 2002 2:07 PM To: freebsd-questions@freebsd.org Subject: ipfw & advanced statefull rules help!! Im using FBSD 4.5 release with IPFW & natd over my commercial DSL (no pppoe) ..everything runs great ..however i have noticed alot of connection attempts to various UDP & TCP ports (non-services) Is ther a good howto on advanced statefull rulez for IPFW and natd... i do have machines behind the BSD box..and i dont want to totally kill all access to the internet for them ...however i would like to block everything that isnt needed and or intiated from the inside. Ive played with differrent examples of rules that others from this mailing list have presented...but all the rules i have tried kills all traffic to the internet from my internal network...theres got to be some happy medium any help is greatly appreciated,,, thank you again for your help Brent To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?MIEPLLIBMLEEABPDBIEGIEDDCCAA.barbish>