Date: Fri, 6 Jan 2006 16:05:14 +0200 From: Giorgos Keramidas <keramida@ceid.upatras.gr> To: Jacob S <stormspotter@6Texans.net> Cc: freebsd-questions@freebsd.org Subject: Re: Ipf problem Message-ID: <20060106140514.GC2217@flame.pc> In-Reply-To: <20060106001744.6aa1367d@jacob.6texans.net> References: <20060106001744.6aa1367d@jacob.6texans.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2006-01-06 00:17, Jacob S <stormspotter@6Texans.net> wrote:
> Hello list,
>
> I'm having a problem setting up ipf on a FreeBSD server and can't
> figure out where I'm going wrong. I copied my ipf.rules file from
> another server I have where ipf is working great. But after I
> customized the rules to this server it is filling /var/log/messages
> with lines like the following:
>
> Jan 4 15:15:21 pikeman ipmon[222]: 15:15:21.465822 2x em0 @0:33 b
> 198.32.64.12,53 -> 65.19.150.68,62097 PR udp len 20
> 314 IN Jan 4 15:15:21 pikeman ipmon[222]: 15:15:21.492578 em0 @0:33 b
> 216.200.145.35,25 -> 65.19.150.68,57210 PR tcp len 20 60 -AS IN Jan 4
> 15:15:21 pikeman ipmon[222]: 15:15:21.505821 em0 @0:33 b
> 205.188.156.249,25 -> 65.19.150.68,57209 PR tcp len 20 48 -AS IN
Your rules seem to be (numbered by running a script like the following
in your ipf.rules file):
echo 'incoming traffic rules:'
echo ''
grep '^[^#].* in ' ipf.rules | cat -n
echo ''
echo 'outgoing traffic rules:'
echo ''
grep '^[^#].* out ' ipf.rules | cat -n
+-------------------------------------------------------------------------
|incoming traffic rules:
|
| 1 pass in quick on lo0 all
| 2 block in quick on em0 from 192.168.0.0/16 to any #RFC 1918 private IP
| 3 block in quick on em0 from 172.16.0.0/12 to any #RFC 1918 private IP
| 4 block in quick on em0 from 10.0.0.0/8 to any #RFC 1918 private IP
| 5 block in quick on em0 from 127.0.0.0/8 to any #loopback
| 6 block in quick on em0 from 0.0.0.0/8 to any #loopback
| 7 block in quick on em0 from 169.254.0.0/16 to any #DHCP auto-config
| 8 block in quick on em0 from 192.0.2.0/24 to any #reserved for docs
| 9 block in quick on em0 from 204.152.64.0/23 to any #Sun cluster interconnect
| 10 block in quick on em0 from 224.0.0.0/3 to any #Class D & E multicast
| 11 block in quick on em0 all with frags
| 12 block in quick on em0 proto tcp all with short
| 13 block in quick on em0 all with opt lsrr
| 14 block in quick on em0 all with opt ssrr
| 15 block in log first quick on em0 proto tcp from any to any flags FUP
| 16 block in quick on em0 all with ipopts
| 17 block in quick on em0 proto tcp from any to any port = 113
| 18 block in log first quick on em0 proto tcp/udp from any to any port = 137
| 19 block in log first quick on em0 proto tcp/udp from any to any port = 138
| 20 block in log first quick on em0 proto tcp/udp from any to any port = 139
| 21 block in log first quick on em0 proto tcp/udp from any to any port = 81
| 22 pass in quick on em0 proto tcp from any to any port = 21 flags S keep state
| 23 pass in quick on em0 proto tcp from any to any port = 22 flags S keep state
| 24 pass in quick on em0 proto tcp from any to any port = 25 flags S keep state
| 25 pass in quick on em0 proto tcp from any to any port = 53 flags S keep state
| 26 pass in quick on em0 proto udp from any to any port = 53 keep state
| 27 pass in quick on em0 proto tcp from any to any port = 110 flags S keep state
| 28 pass in quick on em0 proto tcp from any to any port = 628 flags S keep state
| 29 pass in quick on em0 proto tcp from 65.19.150.66 to any flags S keep state
| 30 pass in quick on em0 proto udp from 65.19.150.66 to any keep state
| 31 pass in quick on em0 proto tcp from 66.252.129.164 to any flags S keep state
| 32 pass in quick on em0 proto tcp from 66.252.129.165 to any flags S keep state
| 33 block in log first quick on em0 all
|
|outgoing traffic rules:
|
| 1 pass out quick on lo0 all
| 2 pass out quick on em0 proto tcp from any to 65.19.150.66 port = 53 flags S keep state
| 3 pass out quick on em0 proto udp from any to 65.19.150.66 port = 53 keep state
| 4 pass out quick on em0 proto tcp from any to any port = 80 flags S keep state
| 5 pass out quick on em0 proto tcp from any to any port = 443 flags S keep state
| 6 pass out quick on em0 proto tcp from any to any port = 110 flags S keep state
| 7 pass out quick on em0 proto tcp from any to any port = 25 flags S keep state
| 8 pass out quick on em0 proto tcp from any to any port = 37 flags S keep state
| 9 pass out quick on em0 proto tcp from any to any port = 119 flags S keep state
| 10 pass out quick on em0 proto tcp from any to any port = 21 flags S keep state
| 11 pass out quick on em0 proto tcp from any to any port = 22 flags S keep state
| 12 pass out quick on em0 proto tcp from any to any port = 23 flags S keep state
| 13 pass out quick on em0 proto tcp from any to any port = 5999 flags S keep state
| 14 pass out quick on em0 proto icmp from any to any icmp-type 8 keep state
| 15 pass out quick on em0 proto tcp from any to any port = 43 flags S keep state
+-------------------------------------------------------------------------
The blocked packets fall through the chain of rules and end up in rule
0:33 (0 = incoming, 33 = block in log first quick on em0 all).
> The lines scroll by faster than I can read them, if I tail the logfile.
> The blocked packets in this case are coming from standard ports to
> non-standard ports. Doing a reverse lookup on the ips, it would seem
> that my server has initiated the transfer and the other servers are
> simply replying. (I deduce that from the blocked ips because they belong
> to hostnames that I would not expect to be flooding my server. Namely,
> the first ip is for l.root-servers.net.)
This seems to be an issue with the timeout of rule states. What do you
see if you run...
$ sysctl -a | fgrep ipf.
it should be something like:
net.inet.ipf.fr_minttl: 4
net.inet.ipf.fr_chksrc: 0
net.inet.ipf.fr_defaultauthage: 600
net.inet.ipf.fr_authused: 0
net.inet.ipf.fr_authsize: 32
net.inet.ipf.ipf_hostmap_sz: 2047
net.inet.ipf.ipf_rdrrules_sz: 127
net.inet.ipf.ipf_natrules_sz: 127
net.inet.ipf.ipf_nattable_sz: 2047
net.inet.ipf.fr_statemax: 4013
net.inet.ipf.fr_statesize: 5737
net.inet.ipf.fr_running: 1
net.inet.ipf.fr_ipfrttl: 120
net.inet.ipf.fr_defnatage: 1200
net.inet.ipf.fr_icmptimeout: 120
net.inet.ipf.fr_udpacktimeout: 24
net.inet.ipf.fr_udptimeout: 240
net.inet.ipf.fr_tcpclosed: 120
net.inet.ipf.fr_tcptimeout: 480
net.inet.ipf.fr_tcplastack: 480
net.inet.ipf.fr_tcpclosewait: 480
net.inet.ipf.fr_tcphalfclosed: 14400
net.inet.ipf.fr_tcpidletimeout: 864000
net.inet.ipf.fr_active: 0
net.inet.ipf.fr_pass: 134217730
net.inet.ipf.fr_flags: 0
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060106140514.GC2217>