Date: Fri, 26 Jun 2009 13:58:22 +0200 From: Dimitry Andric <dimitry@andric.com> To: Max Laier <max@love2party.net> Cc: freebsd-ipfw@freebsd.org, freebsd-current@freebsd.org, freebsd-pf@freebsd.org Subject: Re: pfsync rc script breaks pfsync on cloned interfaces Message-ID: <4A44B7DE.2090503@andric.com> In-Reply-To: <200906261104.07597.max@love2party.net> References: <E1MJoX9-000F3V-6z@clue.co.za> <4A444BC2.4010606@FreeBSD.org> <200906261104.07597.max@love2party.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2009-06-26 11:04, Max Laier wrote:
> I would like input about how a very simple "save default" setup could look
> like. A ruleset for pf or ipfw that allows most of the boot process to
> complete without opening the host to the outside world, yet. For extra
> points this ruleset is aware of the rc.conf variables and adjusts
> accordingly (e.g. opening access to sshd iff it is configured). In
> addition there might be *one or two* configuration variables for the early
> stage to open additional ports or to select a default interface. However,
> the fewer the better.
If you look at how OpenBSD implements their /etc/rc script, you will see
it first loads a simple PF ruleset, which allows ssh, dns, icmp echo and
(if applicable) IPv6 routing and neighbor advertisements.
Then it does the regular network setup (/etc/netstart), followed by
loading the full PF rules.
Relevant excerpt:
######################
if [ X"${pf}" != X"NO" ]; then
RULES="block all"
RULES="$RULES\npass on lo0"
RULES="$RULES\npass in proto tcp from any to any port 22 keep state"
RULES="$RULES\npass out proto { tcp, udp } from any to any port 53 keep state"
RULES="$RULES\npass out inet proto icmp all icmp-type echoreq keep state"
if ifconfig lo0 inet6 >/dev/null 2>&1; then
RULES="$RULES\npass out inet6 proto icmp6 all icmp6-type neighbrsol"
RULES="$RULES\npass in inet6 proto icmp6 all icmp6-type neighbradv"
RULES="$RULES\npass out inet6 proto icmp6 all icmp6-type routersol"
RULES="$RULES\npass in inet6 proto icmp6 all icmp6-type routeradv"
fi
RULES="$RULES\npass proto carp keep state (no-sync)"
case `sysctl vfs.mounts.nfs 2>/dev/null` in
*[1-9]*)
# don't kill NFS
RULES="set reassemble yes no-df\n$RULES"
RULES="$RULES\npass in proto { tcp, udp } from any port { 111, 2049 } to any"
RULES="$RULES\npass out proto { tcp, udp } from any to any port { 111, 2049 }"
;;
esac
echo $RULES | pfctl -f -
pfctl -e
fi
# Fill net.inet.(tcp|udp).baddynamic lists from /etc/services
fill_baddynamic udp
fill_baddynamic tcp
sysctl_conf
# set hostname, turn on network
echo 'starting network'
ifconfig -g carp carpdemote 128
if [ -f /etc/resolv.conf.save ]; then
mv /etc/resolv.conf.save /etc/resolv.conf
touch /etc/resolv.conf
fi
. /etc/netstart
if [ X"${pf}" != X"NO" ]; then
if [ -f ${pf_rules} ]; then
pfctl -f ${pf_rules}
fi
# bring up pfsync after the working ruleset has been loaded
if [ -f /etc/hostname.pfsync0 ]; then
. /etc/netstart pfsync0
fi
fi
######################
Perhaps this approach can be molded into /etc/rc.d form? :)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4A44B7DE.2090503>