Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 19 Nov 2001 23:58:44 -0500
From:      parv <parv_@yahoo.com>
To:        f-q <freebsd-questions@freebsd.org>
Subject:   need help cleaning ipf rules
Message-ID:  <20011119235844.A11191@moo.holy.cow>

next in thread | raw e-mail | index | archive | help
i think i may have some unnecessary rules, but i can't identify
them. if i "block in on tun0 from A to B", then would "block in 
on tun0 from B to A" be redundant?

following is the list...

block in from any to any
block in log on tun0 from any to any  head 200

block in log body quick from any to any with short
block in log body quick from any to any with ipopts
block in log quick from any to any with opt lsrr
block in log quick from any to any with opt ssrr
block in log quick from any to any with frags

block in log quick proto tcp from any to any flags FUP
block in log quick proto tcp from any to any flags SF/SFRA
block in log quick proto tcp from any to any flags SF/SF
block in log quick proto tcp from any to any flags SR/SR
block in log quick proto tcp from any to any flags /SFRA

# deleted rules to block attempts to connect to ssh, ftp, etc.
# which i have only for statistics, as the following will block
# those anyway
#
block in log body quick on tun0 from any to any port < 1025  group 200

# i start X with "-nolisten tcp" option, but still...
#
block in log body quick on tun0 from any to any port  5999 >< 6064  group 200

block in log body quick on tun0 from any to any port = 5432  group 200

#
# XXX  rules like these are what fattening my list; there are 15-20 
# XXX  "block in" like these for other offending addresses.
# XXX
# XXX  would these in any way be helpful to delay DoS attacks
# XXX  and zombie making attempts?
#
block in log body quick on tun0 from 61.133.109.130/8 to any  group 200
block in log body quick on tun0 from any to 61.133.109.130/8  group 200

block in log body quick on tun0 from 192.168.0.0/16 to any  group 200
block in log body quick on tun0 from any to 192.168.0.0/16  group 200
# same for 172.16.0.0/16, 10.0.0.0/8, and 127.0.0.0/16 addresses

block out from any to any
block out on tun0 from any to any  head 400

block out log body quick on tun0 from any to 192.168.0.0/16  group 400
block out log body quick on tun0 from 192.168.0.0/16 to any  group 400
# same for 172.16.0.0/16 and 127.0.0.0/16 addresses

pass out quick on tun0 proto udp from 10.0.0.1 to any port = 53 keep state  group 400
pass out log or-block quick on tun0 proto udp from 0.0.0.0 to any port 33433 >< 33465 keep state  group 400
pass out quick on tun0 proto tcp from 0.0.0.0 to any keep state  group 400
pass out quick on tun0 proto udp from 0.0.0.0 to any keep state  group 400
pass out log or-block quick on tun0 proto icmp from 0.0.0.0 to any icmp-type 8 keep state  group 400


...machine is stand alone laptop, having internet connection via
modem. i _need_ to be able to use ping and traceroute to outside
addresses, and not _want_ same to be done to me. freebsd version is 
4.4-stable-20011003.

any other insight will be much appreciated.  thanks much.


 - parv

ps: yes, i have gone thru' manpages & obfuscate.org's document.

-- 
 

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011119235844.A11191>