Date: Wed, 9 Jan 2002 14:15:31 +0100 From: "Heimes, Rene" <rh@com-con.net> To: <freebsd-questions@freebsd.org> Subject: AW: firewalling with ipfw Message-ID: <F54B610C5BFDE546BBA2F6CC595ACC75084A0C@exchange2000>
next in thread | raw e-mail | index | archive | help
> >IP Filter also can't do it for you. Probably you should tell us your
> task,
> >because I can't understand really needs of such Firewall feature.
>
> OK, let=81s try...
> There is one half Class-C Network (out of 16 others....)
> There are a several groups of servers and workstations with different
> inbound/ outbound rulesets:
> - Webservers
> - Application Servers
> - Full Access Workstations
> - Restricted Access Workstations and finally
> - No Access Workstations
>
> Each group matches to non-coherent IP-Addresses.
>
> Right now, because i wrote each ruleset for almost every single ip,
> there is a 70k large rc.firewall file that affects system throughput
> heavily.
>
> That=81s my problem - understandable now? How can i make this file
> smaller? How can i aggregate rulesets and ip=81s???
>
1. Use "keep-state"
2. Use "skipto"
3. Use intermediate FreeBSD routers for IP Firewalling
4. Reorganize structure of your IP addresses space
5. Restrict access with hardware routers
>>>
hello andrey,
Well, there is nearly no way to perform points 3, 4 and 5, ?cause ip
addresses are in use for several customers with their own servers/
services and routers are of very restricted managability, etc....
(Buying Software Updates with Security Feature is also almost
impossible...)
I do not know how "keep-state" and "skipto" can solve my problems, so i
give you this sample ruleset:
****************
* HERE IT COMES *
****************
# Low Access Clients
${fwcmd} add deny log all from any to A.B.C.96=09
${fwcmd} add pass udp from A.B.C.96 to any 53=09
${fwcmd} add pass tcp from A.B.C.96 to www.bahn.de 80=09
${fwcmd} add pass tcp from A.B.C.96 to www.bahn.de 443=09
${fwcmd} add pass tcp from A.B.C.96 to www.spiegel.de 80=09
${fwcmd} add pass tcp from A.B.C.96 to www.spiegel.de 443=09
${fwcmd} add pass tcp from A.B.C.96 to www.gsn.de 80=09
${fwcmd} add pass tcp from A.B.C.96 to www.gsn.de 443
${fwcmd} add pass tcp from A.B.C.96 to any 119
${fwcmd} add pass tcp from A.B.C.96 to any 1494
${fwcmd} add pass udp from A.B.C.96 to any 1604
${fwcmd} add pass icmp from A.B.C.96 to any icmptypes 8
keep-state
${fwcmd} add pass icmp from any to A.B.C.96 icmptypes 0
keep-state
# Low Access Clients
${fwcmd} add deny log all from any to A.B.C.99=09
${fwcmd} add pass udp from A.B.C.99 to any 53=09
${fwcmd} add pass tcp from A.B.C.99 to www.bahn.de 80=09
${fwcmd} add pass tcp from A.B.C.99 to www.bahn.de 443=09
${fwcmd} add pass tcp from A.B.C.99 to www.spiegel.de 80=09
${fwcmd} add pass tcp from A.B.C.99 to www.spiegel.de 443=09
${fwcmd} add pass tcp from A.B.C.99 to www.gsn.de 80=09
${fwcmd} add pass tcp from A.B.C.99 to www.gsn.de 443
${fwcmd} add pass tcp from A.B.C.99 to any 119
${fwcmd} add pass tcp from A.B.C.99 to any 1494
${fwcmd} add pass udp from A.B.C.99 to any 1604
${fwcmd} add pass icmp from A.B.C.99 to any icmptypes 8
keep-state
${fwcmd} add pass icmp from any to A.B.C.99 icmptypes 0
keep-state
###################################################
${fwcmd} add pass tcp from any 20 to A.B.C.0/25
# Restricted Access Clients
${fwcmd} add deny log all from any to A.B.C.35=09
${fwcmd} add pass udp from A.B.C.35 to any 53
${fwcmd} add pass tcp from A.B.C.35 to any 20=09
${fwcmd} add pass tcp from A.B.C.35 to any 21=09
${fwcmd} add pass tcp from A.B.C.35 to any 80=09
${fwcmd} add pass tcp from A.B.C.35 to any 443=09
${fwcmd} add pass tcp from A.B.C.35 to any 119
${fwcmd} add pass tcp from A.B.C.35 to any 1494
${fwcmd} add pass udp from A.B.C.35 to any 1604
${fwcmd} add pass icmp from A.B.C.35 to any icmptypes 8
keep-state
${fwcmd} add pass icmp from any to A.B.C.35 icmptypes 0
keep-state
# Restricted Access Clients
${fwcmd} add deny log all from any to A.B.C.38=09
${fwcmd} add pass udp from A.B.C.38 to any 53
${fwcmd} add pass tcp from A.B.C.38 to any 20=09
${fwcmd} add pass tcp from A.B.C.38 to any 21=09
${fwcmd} add pass tcp from A.B.C.38 to any 80=09
${fwcmd} add pass tcp from A.B.C.38 to any 443=09
${fwcmd} add pass tcp from A.B.C.38 to any 119
${fwcmd} add pass tcp from A.B.C.38 to any 1494
${fwcmd} add pass udp from A.B.C.38 to any 1604
${fwcmd} add pass icmp from A.B.C.38 to any icmptypes 8
keep-state
${fwcmd} add pass icmp from any to A.B.C.38 icmptypes 0
keep-state
***************
* AND THAT?S IT *
***************
So you all can pitch into that piece - what can be improved here???
TIA,=20
Rene
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?F54B610C5BFDE546BBA2F6CC595ACC75084A0C>