Firewall, Configuring - Revision history

Jimbo at 22:09, 25 August 2012

2012-08-25T22:09:01Z

Show changes

173.88.199.104: Blanked the page

2012-08-13T18:47:46Z

Blanked the page

Show changes

173.88.199.104 at 18:32, 13 August 2012

2012-08-13T18:32:45Z

173.88.199.104 at 17:46, 13 August 2012

2012-08-13T17:46:48Z

Jimbo: Reverted edits by Ulizojypawa (Talk) to last revision by Jimbo

2010-11-15T01:12:30Z

Reverted edits by Ulizojypawa (Talk) to last revision by Jimbo

Ulizojypawa at 23:15, 14 November 2010

2010-11-14T23:15:25Z

Jimbo: revert vandalism / spammer probe

2008-09-04T14:18:46Z

revert vandalism / spammer probe

78.110.175.15 at 07:17, 4 September 2008

2008-09-04T07:17:39Z

79.196.96.61: /* Don't need NAT? don't rebuild the kernel! */

2007-08-21T18:57:21Z

Don't need NAT? don't rebuild the kernel!

Jimbo at 21:36, 21 June 2007

2007-06-21T21:36:00Z

@@ Line 1: / Line 1: @@
-==Don't need NAT? don't rebuild the kernel!==
+==Enable ipfw at boot time==
-The system will dynamically load the kernel module when the rc.conf statement firewall_enable="YES" is used. You do not need to compile IPFW into the FreeBSD kernel unless you want NAT function enabled. You'll still need a ruleset to deal with the traffic your machine gets, of course.
+The system will dynamically load the kernel module when the rc.conf statement firewall_enable="YES" is used. You'll need to define a ruleset to deal with how you want inbound and outbond traffic handled.
 == Sample [[ipfw]] firewall ruleset ==
-This ruleset sets up a firewall on a "bastion" server that both runs publicly accessible services and acts as a NAT-enabled firewall for a protected network running behind it.
+This ruleset sets up a firewall on a server that both runs publicly accessible services and acts as a NAT-enabled firewall for a protected network running behind it (LAN).
 '''ipfw''' rulesets are shell scripts that can be run directly from the command line (assuming you have an ipfw-enabled kernel loaded) - but remember, if you're running this on a [[default deny]] system, you will '''lose network connectivity''' on execution of the very first line of this script - meaning that you CANNOT run the script from a remote shell session, or it will stop running before it ever gets past '''deny all from any to any'''.
@@ Line 188: / Line 177: @@
 == Sample /etc/natd.conf ==
-Our bastion firewall/server will also need to handle NAT duties for the boxes it's protecting on the LAN side.  [[ /etc/natd.conf]] is the configuration file for natd, and will allow you to redirect ports from the public side to services on the LAN side, as well as handling standard NATting of connection requests from our protected network to the big bad Internet.  Here's a sample [[ /etc/natd.conf]].
+Our firewall/server will also need to handle NAT duties for the boxes it's protecting on the LAN side.  [[ /etc/natd.conf]] is the configuration file for natd, and will allow you to redirect ports from the public side to services on the LAN side, as well as handling standard NATting of connection requests from our protected network to the big bad Internet.  Here's a sample [[ /etc/natd.conf]].
 (Note that for redirection of services to work, you need matching entries in your IPFW ruleset after the NAT Divert rule to allow those services inbound access as well as entries in this [[ /etc/natd.conf]]!)
@@ Line 214: / Line 203: @@
 == Sample /usr/local/etc/dhcpd.conf file ==
-We're also going to want our bastion firewall/server to deliver DHCP leases to the computers on the protected network.  So after installing the dhcp daemon from the '''/usr/ports/net/isc-dhcp3''' port, you'll need to minimally configure it to actually deliver the leases to the clients.  Here's a sample  [[ /usr/local/etc/dhcpd.conf]] file:
+We're also going to want our firewall/server to deliver DHCP leases to the computers on the protected network.  So after installing the dhcp daemon from the '''/usr/ports/net/isc-dhcp3''' port, you'll need to minimally configure it to actually deliver the leases to the clients.  Here's a sample  [[ /usr/local/etc/dhcpd.conf]] file:
      # dhcpd.conf
@@ Line 247: / Line 236: @@
   # EOF

← Older revision		Revision as of 17:46, 13 August 2012
Line 263:		Line 263:
	http://www.daniweb.com/tutorials/2949.html for getting dhcpd running		http://www.daniweb.com/tutorials/2949.html for getting dhcpd running

−	~~[[Category:Common Tasks]]~~
−	~~[[Category:FreeBSD for Servers]]~~
	[[Category:Securing FreeBSD]]		[[Category:Securing FreeBSD]]
−	~~[[Category:Firewall]]~~

@@ Line 1: / Line 1: @@
->==Don't need NAT? don't rebuild the kernel!==
+==Don't need NAT? don't rebuild the kernel!==
-The system will dynamically load the kernel module when the rc.conf statement firewall_enable=&quot;YES&quot; is used. You do not need to compile IPFW into the FreeBSD kernel unless you want NAT function enabled. You'll still need a ruleset to deal with the traffic your machine gets, of course.
+The system will dynamically load the kernel module when the rc.conf statement firewall_enable="YES" is used. You do not need to compile IPFW into the FreeBSD kernel unless you want NAT function enabled. You'll still need a ruleset to deal with the traffic your machine gets, of course.
 == Building an [[ipfw]]-enabled kernel ==

@@ Line 1: / Line 1: @@
-==Don't need NAT? don't rebuild the kernel!==
+>==Don't need NAT? don't rebuild the kernel!==
-The system will dynamically load the kernel module when the rc.conf statement firewall_enable="YES" is used. You do not need to compile IPFW into the FreeBSD kernel unless you want NAT function enabled. You'll still need a ruleset to deal with the traffic your machine gets, of course.
+The system will dynamically load the kernel module when the rc.conf statement firewall_enable=&quot;YES&quot; is used. You do not need to compile IPFW into the FreeBSD kernel unless you want NAT function enabled. You'll still need a ruleset to deal with the traffic your machine gets, of course.
 == Building an [[ipfw]]-enabled kernel ==

@@ Line 174: / Line 174: @@
   ########  this section is to deny and log stealth scans that we can't really deny
   ########  on open ports because doing so would disrupt legitimate services.
   # ACK scan (ACK,RST)

@@ Line 265: / Line 265: @@
 [[Category:Common Tasks]]
 [[Category:FreeBSD for Servers]]
-[[Category: Securing FreeBSD]]
+[[Category:Securing FreeBSD]]