Date: Fri, 17 May 2002 10:51:31 +0300 From: "Ivailo Tanusheff" <I.Tanusheff@procreditbank.com> To: "FreeBSD Security" <freebsd-security@FreeBSD.ORG> Subject: IPF Log Problem Message-ID: <00a301c1fd77$a886b2e0$cbf810ac@sof.procreditbank.bg> In-Reply-To: <3CE49903.349E247A@dolaninformation.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format.
------=_NextPart_000_00A4_01C1FD90.CDD3EAE0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Hi,
I'd set up a configuration as follows:
----<Internet>-----<Nat-ing modem>------<Firewall FreeBSD
Box>------<Privite network>
192.168.0.1 xl0 = 192.168.0.2
xl1 = 172.16.0.133
My ipf log confuses me with indicating some packets are blocked, but it
seems to me that they must be part of established connection, which keep
state statement is time out. But I'm not sure. Where may I read some
more information about logged tcp flags and can you help me fix my
configuration.
On the FreeBSD box I'm running IPF, IPNat, Squid.
My configuration is:
Ipf.rules:
# Default to block
#block in all
#Accounting rules
count in on xl0 from any to any
count out on xl0 from 172.16.248.132 to any
count out on xl0 from any to any
#Allow lo
pass in quick on lo0 all
pass out quick on lo0 all
#Block spoofed
#block in log quick on xl0 head 10
block in log quick on xl0 from 172.16.0.0/16 to any
block in log quick on xl0 from 127.0.0.0/8 to any
pass in quick on xl0 from any to 192.168.0.255
#Blocked ident
block return-rst in quick on xl0 proto tcp from any to any port = 113
#Allow icmp data
pass in quick on xl0 proto icmp from any to any icmp-type 0
pass in quick on xl0 proto icmp from any to any icmp-type 11
block in log quick on xl0 proto icmp from any to any
pass out quick on xl0 proto icmp from any to any keep state
#Allow xl0 traffic
pass in quick on xl0 proto tcp from any to 192.168.0.2/32 port =
22 flags S keep state keep frags
block in log quick on xl0 all
pass out quick on xl0 proto tcp from any to any keep state keep
frags
pass out quick on xl0 proto udp from any to any keep state
block out log quick on xl0 all
Ipnat.rules:
rdr xl1 0.0.0.0/0 port 80 -> 192.168.0.2 port
3128 tcp/udp
map xl0 172.16.0.0/16 -> 192.168.0.2/32
proxy port ftp ftp/tcp
map xl0 192.168.0.2/32 -> 192.168.0.2/32
proxy port ftp ftp/tcp
map xl0 172.16.0.0/16 -> 192.168.0.2/32
portmap tcp/udp auto
map xl0 172.16.0.0/16 -> 0/32
Part of my log:
16/05/2002 18:03:51.444189 xl0 @0:10 b 216.239.51.101,80 ->
192.168.0.2,2468 PR tcp len 20 60 -AS IN 16/05/2002 18:03:56.566281 xl0
@0:10 b 152.163.226.185,80 -> 192.168.0.2,2472 PR tcp len 20 44 -AS IN
16/05/2002 18:04:14.414834 xl0 @0:10 b 216.239.51.101,80 ->
192.168.0.2,2483 PR tcp len 20 60 -AS IN 16/05/2002 18:04:36.201219 xl0
@0:10 b 152.163.226.185,80 -> 192.168.0.2,2472 PR tcp len 20 40 -AF IN
16/05/2002 18:04:36.790868 xl0 @0:10 b 152.163.226.185,80 ->
192.168.0.2,2472 PR tcp len 20 40 -AF IN 16/05/2002 18:04:37.043020 xl0
@0:10 b 205.188.250.25,80 -> 192.168.0.2,2268 PR tcp len 20 40 -AF IN
16/05/2002 18:04:37.428832 3x xl0 @0:10 b 152.163.226.185,80 ->
192.168.0.2,2472 PR tcp len 20 40 -AF IN 16/05/2002 18:04:39.388519 xl0
@0:10 b 152.163.226.185,80 -> 192.168.0.2,2472 PR tcp len 20 40 -AF IN
16/05/2002 18:04:41.322101 xl0 @0:10 b 205.188.250.25,80 ->
192.168.0.2,2268 PR tcp len 20 40 -AF IN 16/05/2002 18:04:50.282449 xl0
@0:10 b 205.188.250.25,80 -> 192.168.0.2,2268 PR tcp len 20 40 -AF IN
16/05/2002 18:04:57.175856 xl0 @0:10 b 152.163.226.185,80 ->
192.168.0.2,2472 PR tcp len 20 40 -AF IN 16/05/2002 18:05:03.340217 xl0
@0:10 b 208.215.236.71,80 -> 192.168.0.2,2547 PR tcp len 20 40 -A IN
16/05/2002 18:06:42.233714 xl0 @0:10 b 205.188.248.89,80 ->
192.168.0.2,2631 PR tcp len 20 52 -A IN 16/05/2002 18:12:52.891653 xl0
@0:10 b 216.136.226.107,80 -> 192.168.0.2,2914 PR tcp len 20 40 -A IN
su-2.05a# uname -a
FreeBSD gate 4.6-PRERELEASE FreeBSD 4.6-PRERELEASE #1: Fri May 10
13:46:09 EEST 2002 root@gate:/usr/obj/usr/src/sys/MYKERNEL i386
Thanks in advantage,
Ivailo Tanusheff
System Administrator and Security Advisor
ProCredit Bank
------=_NextPart_000_00A4_01C1FD90.CDD3EAE0
Content-Type: text/x-vcard;
name="Ivailo Tanusheff.vcf"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="Ivailo Tanusheff.vcf"
BEGIN:VCARD
VERSION:2.1
N:Tanusheff;Ivailo
FN:Ivailo Tanusheff
ORG:ProCredit Bank
TITLE:System administrator and Security advisor
TEL;WORK;VOICE:+359 2 9217161
EMAIL;PREF;INTERNET:I.Tanusheff@prokreditbank.com
REV:20020510T125145Z
END:VCARD
------=_NextPart_000_00A4_01C1FD90.CDD3EAE0--
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?00a301c1fd77$a886b2e0$cbf810ac>