From owner-freebsd-questions Sat Dec 1 17:51:27 2001 Delivered-To: freebsd-questions@freebsd.org Received: from pintail.mail.pas.earthlink.net (pintail.mail.pas.earthlink.net [207.217.120.122]) by hub.freebsd.org (Postfix) with ESMTP id 289C537B405 for ; Sat, 1 Dec 2001 17:51:21 -0800 (PST) Received: from dialup-209.245.132.68.dial1.sanjose1.level3.net ([209.245.132.68] helo=blossom.cjclark.org) by pintail.mail.pas.earthlink.net with esmtp (Exim 3.33 #1) id 16ALmq-0000Zx-00; Sat, 01 Dec 2001 17:51:20 -0800 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.3) id fB21pHp24885; Sat, 1 Dec 2001 17:51:17 -0800 (PST) (envelope-from cjc) Date: Sat, 1 Dec 2001 17:51:17 -0800 From: "Crist J . Clark" To: Thor Legvold Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Firewall rules (ipfw) Message-ID: <20011201175117.O13613@blossom.cjclark.org> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from tlegvold@hotmail.com on Sun, Dec 02, 2001 at 12:37:28AM +0000 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Sun, Dec 02, 2001 at 12:37:28AM +0000, Thor Legvold wrote: [snip] > I currently have the following: > > # Allow loopback iface, stop all 127 addresses > ${fwcmd} add 100 pass all from any to any via lo0 > ${fwcmd} add 200 deny all from any to 127.0.0.0/8 > > # Allow DHCP setup via cable0 > ${fwcmd} add allow log udp from any 67 to 0.0.0.0 68 out xmit cable0 > ${fwcmd} add allow log udp from 10.10.0.0/16 67 to 10.10.2.0/24 68 in via > cable0 These DHCP rules are a bit messed up. ITYM something more like, # Allow our initial discovery of a server ${fwcmd} add allow log udp from 0.0.0.0 68 to 255.255.255.255 67 out xmit cable0 # Allow a server's initial response ${fwcmd} add allow log udp from 10.10.0.0/16 67 to 255.255.255.255 68 in recv cable0 # Allow server to talk to us ${fwcmd} add allow log udp from 10.10.0.0/16 67 to 10.10.2.0/24 68 in via cable0 # Allow us to talk to server ${fwcmd} add allow log udp from 10.10.2.0/24 68 to 10.10.0.0/16 67 out via cable0 > # Allow GRE & PPTP control connection > ${fwcmd} add allow tcp from any to any 1723 in recv cable0 setup > ${fwcmd} add allow gre from any to any via cable0 Nothing here allows you to talk back on that TCP connection. > # Stop all other traffic via cable0 - only GRE/PPTP/DHCP allowed > ${fwcmd} add deny log all from any to any via cable0 Nothing else at all is going to go in or out? OK. > # NAT > ${fwcmd} add divert natd log all from any to any via tun0 OK. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message