Date: Wed, 01 Aug 2001 22:52:26 -0400 From: Ted Sikora <tsikora@home.com> To: "freebsd-stable@FreeBSD.ORG" <freebsd-stable@FreeBSD.ORG> Subject: firewall ruleset questions Message-ID: <3B68C06A.131C4C67@home.com>
next in thread | raw e-mail | index | archive | help
I have stable on both cable and dsl. Each machine has 2 nic cards. I just setup up a firewall with the following rules. I just need http ftp ssh nfs(internal network) # Define the firewall command fwcmd="/sbin/ipfw" # Force a flushing of the current rules before we reload. $fwcmd -f flush # Divert all packets through the xl0 interface. $fwcmd add divert natd all from any to any via xl0 # Allow all data from my network cards and localhost. $fwcmd add allow ip from any to any via lo0 $fwcmd add allow ip from any to any via xl0 $fwcmd add allow ip from any to any via ed0 # Allow all connections that I initiate. $fwcmd add allow tcp from any to any out xmit xl0 setup # Once connections are made, allow them to stay open. $fwcmd add allow tcp from any to any via xl0 established # Everyone on the internet is allowed to connect to the following # services on the machine. $fwcmd add allow tcp from any to any 80 setup $fwcmd add allow tcp from any to any 20 setup $fwcmd add allow tcp from any to any 21 setup $fwcmd add allow tcp from any to any 22 setup # This sends a RESET to all ident packets. $fwcmd add reset log tcp from any to any 113 in recv xl0 # Allow outgoing DNS queries ONLY to the specified servers. # $fwcmd add allow udp from any to x.x.x.x 53 out xmit xl0 # Allow them back in with the answers... :) # $fwcmd add allow udp from x.x.x.x 53 to any in recv xl0 # Allow ICMP (for ping and traceroute to work). $fwcmd add 65435 allow icmp from any to any # Deny all the rest. $fwcmd add 65435 deny log ip from any to any Will this suffice or does it need tightening. Also do I need : # If you're using 'options BRIDGE' #${fwcmd} add 400 pass udp from 0.0.0.0 2054 to 0.0.0.0 with cable and dsl modems? Can I limit nat to one ip like 192.168.1.5? Will nat cause a problem with other machines on the internal network with their own net connection? -- Ted Sikora tsikora@ntplx.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3B68C06A.131C4C67>