Date: Tue, 19 Jun 2001 13:56:25 +0400 From: "Nickolay A. Kritsky" <nkritsky@internethelp.ru> To: "default013 - subscriptions" <default013subscriptions@hotmail.com>, <freebsd-security@FreeBSD.ORG> Subject: Re: IPFW newbie Message-ID: <02f101c0f8a6$1fad6210$0600a8c0@ibmka.internethelp.ru>
next in thread | raw e-mail | index | archive | help
The easiest way is: #echo 'firewall_enable="YES"' >>/etc/rc.conf #echo 'firewall_type="OPEN"' >>/etc/rc.conf after installing new kernel this will result in following set of rules (this is testted on 4.2, but should not differ for other versions): #ipfw list 00100 allow ip from any to any via lo0 00200 deny ip from any to 127.0.0.0/8 65000 allow ip from any to any 65535 deny ip from any to any Now you can connect to your box via SSH and continue firewall setup. But WARNING! Learning ipfw without direct access to the server is, IMHO very unhealthy. IMHO, it sucks! I am IPFW newbie myself and had some sad experience with remote firewall setup ;-) . At least you must have remote reboot-knob, which does not relies on IP (like very very long broomstick mounted to RESET key :-) ). Good Luck! NKritsky - SysAdmin InternetHelp.Ru http://www.internethelp.ru e-mail: nkritsky@internethelp.ru -----Original Message----- From: default013 - subscriptions <default013subscriptions@hotmail.com> To: freebsd-security@FreeBSD.ORG <freebsd-security@FreeBSD.ORG> Date: 19 èþíÿ 2001 ã. 11:11 Subject: IPFW newbie >Hi, > >I'm about to compile IPFW into the kernel for the first time... and just had >a quick question... also, if anyone has any tips I would appreciate it. >(this is going to be used on a webserver that runs everything from apache to >shoutcast...) > >I am going to compile it in using this option: >options IPFIREWALL_VERBOSE_LIMIT=10 > >My question is, I connect to my box using an SSH session. The default for >IPFW is not to accept connections correct? So after my machine reboots with >these new rules in place, will I have to set the IPFW rules in place so that >I can once again open an SSH session to it again? Or how does that work... > >Thanks > >Jordan > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?02f101c0f8a6$1fad6210$0600a8c0>