From owner-freebsd-security  Wed Feb 21  3:43:35 2001
Delivered-To: freebsd-security@freebsd.org
Received: from eastwood.aldigital.algroup.co.uk (eastwood.aldigital.algroup.co.uk [194.128.162.193])
	by hub.freebsd.org (Postfix) with ESMTP id 1DCD737B503
	for <freebsd-security@freebsd.org>; Wed, 21 Feb 2001 03:43:29 -0800 (PST)
	(envelope-from adam@algroup.co.uk)
Received: from algroup.co.uk ([193.195.56.225]) by eastwood.aldigital.algroup.co.uk (8.8.8/8.6.12) with ESMTP id LAA17919; Wed, 21 Feb 2001 11:43:09 GMT
Message-ID: <3A93A9CC.BC1D39FB@algroup.co.uk>
Date: Wed, 21 Feb 2001 11:43:08 +0000
From: Adam Laurie <adam@algroup.co.uk>
Organization: A.L. Group plc
X-Mailer: Mozilla 4.76 [en] (Win95; U)
X-Accept-Language: en
MIME-Version: 1.0
To: Nick Sayer <nsayer@quack.kfu.com>
Cc: freebsd-security@freebsd.org
Subject: Re: /etc/rc.firewall fixes
References: <200102202005.f1KK5kv83619@medusa.kfu.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Nick Sayer wrote:
> 
> I would like to suggest a new "simple" firewall configuration.
> 
> I recently put a security fix in the prototype /etc/rc.firewall
> stuff to close up a rather glaring security hole.
> 
> The old stuff did
> 
> pass udp from any 53 to ${oip}
> 
> which allows someone to communicate, for instance, with port 2049 so
> long as they bind their end to 53. The state keeping stuff is the
> correct solution.
> 
> My proposed "simple" firewall config goes something like this:
> 
> check-state
> pass udp from ${mynet} to any keep-state
> pass all from ${mynet} to any
> pass tcp from any to any established
> pass icmp from any to any
> 
> This simple set of rules represents a simple one-way set up. UDP is
> allowed to go out, and matching replies are allowed to come back in.
> TCP sessions are allowed to go out only.
> 
> By itself it is not a complete ruleset, but I think it is a better one
> than any of the examples we presently have. I haven't committed this
> because I wanted to start some discussion first and commit the resulting
> consensus.

while you're at it, all the variable definitions need to be moved out of
rc.firewall itself and into rc.conf. i would also like to see a "mobile"
section for ppp/dialup and will contribute mine if required... good luck
with getting a commit! :)

cheers,
Adam
--
Adam Laurie                   Tel: +44 (20) 8742 0755
A.L. Digital Ltd.             Fax: +44 (20) 8742 5995
Voysey House                  http://www.thebunker.net
Barley Mow Passage            http://www.aldigital.co.uk
London W4 4GB                 mailto:adam@algroup.co.uk
UNITED KINGDOM                PGP key on keyservers

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message