Date: Sun, 29 Mar 2020 21:29:54 +0200 (CEST) From: =?UTF-8?Q?Trond_Endrest=C3=B8l?= <trond.endrestol@ximalas.info> To: The Doctor <doctor@doctor.nl2k.ab.ca> Cc: freebsd-questions@freebsd.org Subject: Re: FreeBSD bridging security router Message-ID: <alpine.BSF.2.22.395.2003292114520.8527@enterprise.ximalas.info> In-Reply-To: <20200329183406.GB5418@doctor.nl2k.ab.ca> References: <20200329183406.GB5418@doctor.nl2k.ab.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 29 Mar 2020 12:34-0600, The Doctor via freebsd-questions wrote:
> Question is that I have the following set up
>
> 1) /etc/rc.conf
>
> hostname="border.nk.ca"
> ifconfig_bce0="inet 192.168.81.14 netmask 255.255.255.0 promisc "
> ifconfig_bce1="up media 100baseTX mediaopt full-duplex promisc "
> ifconfig_bce2="up promisc"
> ifconfig_bce3="up promisc"
> defaultrouter="192.168.81.2"
> hald_enable="YES"
> named_enable="YES"
> sshd_enable="YES"
> sshguard_enable="YES"
> moused_enable="YES"
> ntpdate_enable="YES"
> ntpd_enable="YES"
> gateway_enable="YES"
> ipv6_gateway_enable="YES"
Do you need IPv6? I don't see any IPv6 related config elsewhere.
> pf_enable="YES"
> clamav_clamd_enable="YES"
> clamd_enable="YES"
> squid_enable="YES"
> tcsd_enable="YES"
> tcsd_mode="emulator"
> tpmd_enable="YES"
> dbus_enable="YES"
> apache24_enable="yes"
> postgresql_enable="YES"
> firebird_enable="YES"
> firebird_mode="superserver"
> suricata_enable="YES"
> suricata_divertport="8000"
> cloned_interfaces="bridge0 tap0 tap1 tap2 tap3"
> ifconfig_bridge0="addm bce2 addm tap0 addm tap1 addm tap2 addm tap3 up"
> cloned_interfaces="bce0 bce1"
Are the two cloned_interfaces lines intentional? The second one
overrides the first one.
> ifconfig_bridge1="addm bce0 addm bce1 up"
> #firewall_enable="YES"
> #firewall_type="simple"
> #firewall_quiet="YES"
> #firewall_logging="YES"
> vm_enable="YES"
> vm_dir="/usr/vm/"
> vboxdrv_load="YES"
> xrdp_enable="YES"
> xrdp_sesman_enable="YES"
> saslauthd_enable="YES"
> openvassd_enable="YES"
> openvasmd_enable="YES"
> gsad_enable="YES"
> pflog_logfile="/var/log/pflog"
> # Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
> dumpdev="AUTO"
> redis_enable="YES"
> cbsd_workdir="/usr/vm"
> cbsdrsyncd_enable="YES"
> cbsdrsyncd_flags="--config=/usr/vm/etc/rsyncd.conf"
> cbsdd_enable="YES"
> rcshutdown_timeout="900"
>
> and
>
> 2) /etc/pf.conf
>
> ## Set your public interface ##
> ext_if="bce1"
> ##Internal bridge for virtually hosted machines
> int_if="bce0"
> bridge0="bridge0"
> ## Set your server public IP address ##
> int_if_ip="192.168.81.14"
> bridge0_ip="192.168.81.13"
> intnet = $int_if:network
> #Proxy for FTP
> proxy="127.0.0.1"
> proxyport="8021"
> #All virtal machines go here!
> win2019="192.168.81.18"
> kali="192.168.81.15"
> seconion="192.168.81.16"
> parrot="192.168.81.17"
> #In case you need a whole group
> vhosts =" { 192.168.81.16, 192.168.81.15,
> 192.168.81.17,192.168.81.18 }"
> ## Set and drop these IP ranges on public interface and any other troublemakers
> ##
>
> martians = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, \
> 10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, \
> 0.0.0.0/8, 240.0.0.0/4 }"
> ## Set http(80)/https (443) port here and other ports that need accessing ##
> webports = "{http, https,8443,119,561,110,143,993,995,20,21,23,25,464,465,587,53
> ,513,783,88,135,137,138,139,445,69,10000,20000,43,636,1024:5000,8000:8100,5900:5
> 999,49150:61000}"
> # Radius
> radiusports = "{1645,1646,1812,1813 }"
>
> ## enable these services ##
> int_tcp_services = "{domain, ntp, smtp,nntp, smtps,submission, www, https,20,88,
> ftp, ssh,110,139,137,138,135,143,636,993,995,443,445,464,561,636,783,389,7500,84
> 43,10000,20000,43,63,1024:5000,8000:8100,5900:5999,23,49150:61000}"
> int_udp_services = "{domain, ntp,69,88,137,138,139,445,464}"
> int_radius_services = "{1645,1646,1812,1813 }"
>
>
> ## Skip loop back interface - Skip all PF processing on interface bridge and vir
> tual hosts ##
> set skip on lo
> set skip on bridge0
> set skip on tap0
> set skip on tap1
> set skip on tap2
> set skip on tap3
>
>
> ## Sets the interface for which PF should gather statistics such as bytes in/out
> and packets passed/blocked ##
> set loginterface $ext_if
> set fingerprints "/etc/pf.os"
>
> # Deal with attacks based on incorrect handling of packet fragments
> scrub in all
>
> ################### TRANSLATION #############
>
> #### NAT and RDR start
> nat on $ext_if from $intnet to any -> ($ext_if)
> nat on $intnet from $bridge0 to any -> ($intnet)
> nat on $bridge0 from $kali to any -> ($bridge0)
> nat on $bridge0 from $win2019 to any -> ($bridge0)
> nat on $bridge0 from $kali to any -> ($bridge0)
>
> --se note for virtual machines you are passing the packects via the
This doesn't look like a proper comment.
> ## Virtual switch so treat as michine (tap) into switch (Bridge) into
> ## your macine acting as the host (exit)
>
> nat-anchor "ftp-proxy/*"
> rdr-anchor "ftp-proxy/*"
>
> # Redirect ftp traffic to proxy
> rdr pass proto tcp from any to any port ftp -> $proxy port $proxyport
>
>
> ## Set default policy ##
> block return in log all
> block out all
>
> # We need to have an anchor for ftp-proxy
> anchor "ftp-proxy/*"
> pass out proto tcp from $proxy to any port 20
> pass out proto tcp from $proxy to any port 21
> pass out on $int_if inet proto {tcp, udp} from $int_if to any port ftp:ftp-proxy
> pass in on egress proto tcp to port 21
> pass in on egress proto tcp to port 20
> pass in on egress proto tcp to port > 49151
> pass out quick on egress inet proto tcp from any to 192.168.81.1 flags S/SA
> pass out quick on egress inet proto tcp from any to 192.168.81.3 flags S/SA
>
> #set up virtual switch
>
> pass in quick on bridge0 all
> pass quick on tap0 all
> pass quick on tap1 all
> pass quick on tap2 all
> pass quick on tap3 all
>
> # Drop all Non-Routable Addresses
> block drop in quick on $int_if from $martians to any
> block drop out quick on $int_if from any to $martians
> block drop in quick on $vhosts from $martians to any
> block drop out quick on $vhosts from any to $martians
>
> ## Blocking spoofed packets
> antispoof quick for $int_if
> antispoof quick for $vhosts
>
> # Open SSH port which is listening on port 22 from VPN 139.xx.yy.zz Ip only
> # I do not allow or accept ssh traffic from ALL for security reasons
> #pass in quick on $ext_if inet proto tcp from 192.168.81.0/24 to $ext_if_ip port
> = ssh flags S/SA keep state label "USER_RULE: Allow SSH from 139.xxx.yyy.zzz"
> ## Use the following rule to enable ssh for ALL users from any IP address #
> ## pass in inet proto tcp to $ext_if port ssh
> ### [ OR ] ###
> pass in inet proto tcp to $int_if port 22
> pass in inet proto tcp to $vhosts port 22
>
>
> pass in inet proto tcp to $int_if port 36941
> pass in inet proto tcp to $vhosts port 36941
>
>
> # Allow Ping-Pong stuff. Be a good sysadmin
> icmp_types = "{ echoreq, unreach }"
> pass inet proto icmp all icmp-type $icmp_types keep state
> # allow out the default range for traceroute(8):
> pass out on $ext_if inet proto udp from any to any port 33433 >< 33626 keep stat
> e
> pass out on $int_if inet proto udp from any to any port 33433 >< 33626 keep stat
> e
> pass out on $vhosts inet proto udp from any to any port 33433 >< 33626 keep stat
> e
>
> # All access to our Nginx/Apache/Lighttpd Webserver and other ports
> pass proto tcp from any to $int_if port $webports
> pass proto udp from any to $int_if port $webports
> pass proto udp from any to $int_if port $radiusports
> pass proto tcp from any to $vhosts port $webports
> pass proto udp from any to $vhosts port $webports
>
> pass in on $int_if proto tcp from any to any port = 36941 keep state
> pass in on $vhosts proto tcp from any to any port = 36941 keep state
> pass in on $kali proto tcp from any to any port = 36941 keep state
>
> # Allow essential outgoing traffic
> pass out quick on $int_if proto tcp to any port $int_tcp_services
> pass out quick on $int_if proto udp to any port $int_udp_services
> pass out quick on $int_if proto udp to any port $int_radius_services
> pass out quick on $vhosts proto tcp to any port $int_tcp_services
> pass out quick on $vhosts proto udp to any port $int_udp_services
>
> #For radius make certain for older syatems port 1645 and current 1812
> pass in log quick on $int_if proto tcp from any to any port = 1645 flags S/SA ke
> ep state
> pass in log quick on $int_if proto udp from any to any port = 1645 keep state
> pass in log quick on $int_if proto tcp from any to any port = 1812 flags S/SA ke
> ep state
> pass in log quick on $int_if proto udp from any to any port = 1812 keep state
>
> pass in log quick on $int_if proto tcp from any to any port = 36941 flags S/SA k
> eep state
> pass in log quick on $int_if proto udp from any to any port = 36941 keep state
>
> pass in log quick on $vhosts proto tcp from any to any port = 36941 flags S/SA k
> eep state
>
> pass in log quick on $vhosts proto udp from any to any port = 36941 keep state
> pass out quick all flags S/SA keep state
>
> # Add custom rules below
> block quick from <bruteforce>
> pass quick proto { tcp, udp } from any to any port ssh \
> flags S/SA keep state \
> (max-src-conn 15, max-src-conn-rate 5/3, \
> overload <bruteforce> flush global)
> ## I wonder if sshguard works with pf.
>
> Well this is suppose to act as a server / firewall /router.
>
> The primary DNS does ping the outside world once bce1 is up
> but not resolve domain names.
>
> Anything in the configuration I forget?
What's the contents of /etc/resolv.conf?
--
Trond.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.BSF.2.22.395.2003292114520.8527>