Date: Tue, 9 Sep 2014 17:48:19 -0700 (PDT) From: Don Lewis <truckman@FreeBSD.org> To: case@SDF.ORG Cc: freebsd-net@FreeBSD.org Subject: Re: Can I make this simple ipfw ruleset any more restrictive ? Message-ID: <201409100048.s8A0mJL9011252@gw.catspoiler.org> In-Reply-To: <Pine.NEB.4.64.1409092333450.17244@faeroes.freeshell.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 9 Sep, John Case wrote: > > I have a very simple firewall - it*blocks everything*, and the only > traffic that is allowed is for internal clients to make outbound > connections to tcp port 40. > > Also, internal clients can ping/traceroute. > > But that's it - no other connections in or out are allowed. I have this > ruleset and it is working perfectly: > > ipfw add 10 allow tcp from any to any established > ipfw add 20 allow icmp from any to any icmptypes 0,3,8,11 > ipfw add 30 allow udp from any to any 33433-33499 in via fxp1 > ipfw add 40 allow tcp from any to any 40 in via fxp1 > > (fxp1 is the internal interface, and so I allow the port 40 connections > and the udp for traceroute only for requests that come in from the > internal network) > > Is there anything I have screwed up here ? Any unintentional traffic that > I am letting through ? > > Is there any way to lock this down further, and make it even more strict ? I generally do something like that, but I also add anti-spoofing rules as well. Basically block any packets that have an inside source IP address that are received via the outside interface, and block any packets that don't have an inside IP source address that are received via the inside interface. The established keyword will let any TCP packets through that have either the ACK or RST flags set. That only blocks incoming connection attempts which have SYN without ACK. It would allow someone to scan your internal network by sending packets with ACK set and SYN not set and watching for RST packets being returned. I think you could avoid this with these two rules: ipfw add 10 check-state [...] ipfw add 40 allow tcp from any to any 40 in via fxp1 keep-state but I haven't actually done this.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201409100048.s8A0mJL9011252>