From owner-freebsd-questions Sun Jan 6 22: 8:10 2002 Delivered-To: freebsd-questions@freebsd.org Received: from web10003.mail.yahoo.com (web10003.mail.yahoo.com [216.136.130.39]) by hub.freebsd.org (Postfix) with SMTP id 7061637B41B for ; Sun, 6 Jan 2002 22:08:05 -0800 (PST) Message-ID: <20020107060805.58330.qmail@web10003.mail.yahoo.com> Received: from [209.219.51.7] by web10003.mail.yahoo.com via HTTP; Sun, 06 Jan 2002 22:08:05 PST Date: Sun, 6 Jan 2002 22:08:05 -0800 (PST) From: Tom Kersten Subject: IPF review & tips desired To: freebsd-questions@freebsd.org MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="0-1239714373-1010383685=:56698" Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG --0-1239714373-1010383685=:56698 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Hello all, This is my first attempt at a firewall for a box running FreeBSD 4.4. I have gone over the frequently mentioned tutorial at: http://www.schlacter.net:8500/public/FreeBSD-STABLE_and_IPFILTER.html and gone through a large portion of the how-to at: http://www.obfuscation.org/ipf/ipf-howto.txt and used some tidbits from each, but am looking for some experienced advice. For those of you who do not mind looking over this stuff, I would appreciate any tips you have for me. I have three questions concerning its current state: 1.) If I want to set up a webserver, what do I need to, if anything, change to allow people to access it? 2.) If I also want to allow ftp (via ssh) what do I need to change/add to it? 3.) How do I check/know if it is doing a good job of preventing unauthorized use of my machine (i.e.-if there are holes in the current rules)? I know it is probably pretty simple compared to some, but...like I said it is my first one....comments, tips, or recommendations on good sources of information (books, websites, etc) are welcome. I am not looking for an easy out, I just don't know anyone personally that can help me with this.... TIA, Thomas Here it is: __________________________________________________ Do You Yahoo!? Send FREE video emails in Yahoo! Mail! http://promo.yahoo.com/videomail/ --0-1239714373-1010383685=:56698 Content-Type: application/octet-stream; name="ipf.rules" Content-Transfer-Encoding: base64 Content-Description: ipf.rules Content-Disposition: attachment; filename="ipf.rules" IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBPdXRzaWRlIEludGVyZmFjZQojIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIwoKIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQojIFByZXZl bnQgc3Bvb2ZpbmcKIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCmJsb2NrIGluICAgICAg ICAgICBvbiBybDAKYmxvY2sgaW4gICAgIHF1aWNrIG9uIHJsMCBmcm9tIDE5 Mi4xNjguMC4wLzE2ICB0byBhbnkKYmxvY2sgaW4gICAgIHF1aWNrIG9uIHJs MCBmcm9tIDE3Mi4xNi4wLjAvMTIgICB0byBhbnkKYmxvY2sgaW4gICAgIHF1 aWNrIG9uIHJsMCBmcm9tIDEwLjAuMC4wLzggICAgICB0byBhbnkKYmxvY2sg aW4gICAgIHF1aWNrIG9uIHJsMCBmcm9tIDEyNy4wLjAuMC84ICAgICB0byBh bnkKYmxvY2sgaW4gICAgIHF1aWNrIG9uIHJsMCBmcm9tIDAuMC4wLjAvOCAg ICAgICB0byBhbnkKYmxvY2sgaW4gICAgIHF1aWNrIG9uIHJsMCBmcm9tIDE2 OS4yNTQuMC4wLzE2ICB0byBhbnkKYmxvY2sgaW4gICAgIHF1aWNrIG9uIHJs MCBmcm9tIDIwNC4xNTIuNjQuMC8yMyB0byBhbnkKYmxvY2sgaW4gICAgIHF1 aWNrIG9uIHJsMCBmcm9tIDIyNC4wLjAuMC8zICAgICB0byBhbnkKYmxvY2sg aW4gbG9nIHF1aWNrIG9uIHJsMCBmcm9tIG0ueS5pLnAvMzIgdG8gYW55CmJs b2NrIGluIGxvZyBxdWljayBvbiBybDAgZnJvbSBhbnkgbS55LmkucC8zMgoj LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLQojIEFsbG93IG91dCBhbGwgVENQLCBVRFAs IGFuZCBJQ01QIHRyYWZmaWMgJiBrZWVwIHN0YXRlIG9uIGl0CiMgc28gdGhh dCBpdCdzIGFsbG93ZWQgYmFjayBpbi4KIy0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0K cGFzcyAgaW4gIHF1aWNrIG9uIHR1bjAgcHJvdG8gdGNwIGZyb20gYW55IHRv IG0ueS5pLnAvMzIgcG9ydCA9IDgwIGZsYWdzIFMga2VlcCBzdGF0ZQpwYXNz ICBvdXQgcXVpY2sgb24gcmwwIHByb3RvIHVkcCBmcm9tIGFueSB0byBhbnkg a2VlcCBzdGF0ZQpwYXNzICBvdXQgcXVpY2sgb24gcmwwIHByb3RvIGljbXAg ZnJvbSBhbnkgdG8gYW55IGtlZXAgc3RhdGUKYmxvY2sgb3V0IHF1aWNrIG9u IHJsMCBhbGwKCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiMgQmxvY2sgYW5kIGxv ZyBhbGwgcmVtYWluaW5nIHRyYWZmaWMgY29taW5nIGludG8gdGhlIGZpcmV3 YWxsCiMgLSBCbG9jayBUQ1Agd2l0aCBhIFJTVCAodG8gbWFrZSBpdCBhcHBl YXIgYXMgaWYgdGhlIHNlcnZpY2UKIyBpc24ndCBsaXN0ZW5pbmcpCiMgLSBC bG9jayBVRFAgd2l0aCBhbiBJQ01QIFBvcnQgVW5yZWFjaGFibGUgKHRvIG1h a2UgaXQgYXBwZWFyCiMgYXMgaWYgdGhlIHNlcnZpY2UgaXNuJ3QgbGlzdGVu aW5nKQojIC0gQmxvY2sgYWxsIHJlbWFpbmluZyB0cmFmZmljIHRoZSBnb29k ICdvbCBmYXNoaW9uZWQgd2F5CiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCmJsb2Nr IHJldHVybi1yc3QgaW4gbG9nIHF1aWNrIG9uIHJsMCBwcm90byB0Y3AgZnJv bSBhbnkgdG8gYW55CmJsb2NrIHJldHVybi1pY21wLWFzLWRlc3QocG9ydC11 bnIpIGluIGxvZyBxdWljayBvbiBybDAgcHJvdG8gdWRwIGZyb20gYW55IHRv IGFueQpibG9jayBpbiBsb2cgcXVpY2sgb24gcmwwIGFsbCAKCgojIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIwojIExvb3BiYWNrIEludGVyZmFjZQojIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIwoKIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIyBBbGxvdyBldmVy eXRoaW5nIHRvL2Zyb20gbG9vcGJhY2sgaW50ZXJmYWNlIChwaW5nLCBldGMp CiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tCnBhc3MgaW4gcXVpY2sgb24gbG8wIGFs bApwYXNzIG91dCBxdWljayBvbiBsbzAgYWxsCg== --0-1239714373-1010383685=:56698-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message