IPFIREWALL (IPFW) Firewall - Revision history

173.88.199.104 at 22:48, 13 August 2012

2012-08-13T22:48:12Z

173.88.199.104 at 22:35, 13 August 2012

2012-08-13T22:35:45Z

Show changes

173.88.199.104: /* Example Inclusive Rule Set */

2012-08-13T22:31:43Z

Example Inclusive Rule Set

173.88.199.104 at 22:28, 13 August 2012

2012-08-13T22:28:33Z

Show changes

173.88.199.104: /* Building Rule Script */

2012-08-13T22:25:36Z

Building Rule Script

173.88.199.104: /* Rule Syntax */

2012-08-13T22:23:18Z

Rule Syntax

173.88.199.104 at 22:00, 13 August 2012

2012-08-13T22:00:39Z

Show changes

173.88.199.104: /* IPFW Command */

2012-08-13T21:54:18Z

IPFW Command

173.88.199.104: /* Kernel options */

2012-08-13T21:52:22Z

Kernel options

173.88.199.104: /* Enabling IPFW */

2012-08-13T21:50:51Z

Enabling IPFW

← Older revision		Revision as of 22:48, 13 August 2012
Line 803:		Line 803:
	################ End of IPFW rules file ###############################		################ End of IPFW rules file ###############################
	</pre>		</pre>
		+
		+
		+
		+	[[Category:Securing FreeBSD]]

@@ Line 486: / Line 486: @@
 # Deny all inbound traffic from non-routable reserved address spaces
 $cmd 00300 deny all from 192.168.0.0/16 to any in via $pif  #RFC 1918 private IP
-$cmd 00301 deny all from 172.16.0.0/12 to anyin via $pif     #RFC 1918 private IP
+$cmd 00301 deny all from 172.16.0.0/12 to anyin via $pif    #RFC 1918 private IP
-$cmd 00302 deny all from 10.0.0.0/8 to anyin via $pif          #RFC 1918 private IP
+$cmd 00302 deny all from 10.0.0.0/8 to anyin via $pif       #RFC 1918 private IP
-$cmd 00303 deny all from 127.0.0.0/8 to anyin via $pif        #loopback
+$cmd 00303 deny all from 127.0.0.0/8 to anyin via $pif      #loopback
 $cmd 00304 deny all from 0.0.0.0/8 to anyin via $pif            #loopback
 $cmd 00305 deny all from 169.254.0.0/16 to anyin via $pif   #DHCP auto-config
-$cmd 00306 deny all from 192.0.2.0/24 to anyin via $pif       #reserved for doc's
+$cmd 00306 deny all from 192.0.2.0/24 to anyin via $pif     #reserved for doc's
 $cmd 00307 deny all from 204.152.64.0/23 to anyin via $pif  #Sun cluster interconnect
-$cmd 00308 deny all from 224.0.0.0/3 to anyin via $pif         #Class D & E multicast
+$cmd 00308 deny all from 224.0.0.0/3 to anyin via $pif      #Class D & E multicast
 # Deny public pings

@@ Line 337: / Line 337: @@
 The same thing could also to accomplished doing it this way as a text file
 ipfw -q -f flush
 ipfw -q add check-state
@@ Line 344: / Line 345: @@
 ipfw -q add allow tcp from any to 192.0.2.11 53 out via tun0 setup keep-state
 ipfw -q add 00611 allow udp from any to 192.0.2.11 53 out via tun0 keep-state

@@ Line 141: / Line 141: @@
 <pre>
-# is used to mark the start of a comment and may appear at the end of a rule line or on its own line. Blank lines are ignored.
+# is used to mark the start of a comment and may appear at
 </pre>
@@ Line 187: / Line 188: @@
      When a packet matches a rule with the log keyword, a message will be
-     logged to syslogd with a facility name of SECURITY. The logging only occurs
+     logged to syslogd with a facility name of SECURITY. The logging
-     if the number of packets logged so far for that particular
+     only occurs if the number of packets logged so far for that
-     rule does not exceed the logamount parameter. If no logamount is
+     particular rule does not exceed the logamount parameter. If no
-     specified, the limit is taken from the sysctl variable
+     logamount is specified, the limit is taken from the sysctl variable
      net.inet.ip.fw.verbose_limit. In both cases, a value of zero removes
      the logging limit. Once the limit is reached, logging can be
      re-enabled by clearing the logging counter or the packet counter for
      that rule. See the ipfw reset log command.
-     Note: logging is done after all other packet matching conditions have
+     Note: logging is done after all other packet matching conditions
-     been successfully verified and before performing the final action
+     have been successfully verified and before performing the final
-     (accept, deny) on the packet. It’s up to you to decide which rules
+     action accept, deny) on the packet. It’s up to you to decide which
-     you want to enable logging on.
+     rules you want to enable logging on.
@@ Line 206: / Line 207: @@
 The keywords described in this section are used to describe attributes of the packet to be interrogated when determining whether rules match or don't match the packet. The following general-purpose attributes are provided for matching and must be used in this order:
      udp | tcp | icmp
          or any protocol names found in /etc/protocols are recognized
-         and may be used. The value specified is the protocol to be matched
+         and may be used. The value specified is the protocol to be
-         against. This is a mandatory requirement.
+         matched against. This is a mandatory requirement.
      from src to dst
-         The from and to keywords are used to match against IP addresses.
+         The from and to keywords are used to match against IP
-         Rules must specify BOTH source and destination parameters.
+         addresses. Rules must specify BOTH source and destination
-         any is a special keyword that matches any IP address.
+        parameters.
-         me is a special keyword that matches any IP address configured
+         'any' is a special keyword that matches any IP address.
-         on an interface in your FBSD system to represent the PC
+         'me' is a special keyword that matches any IP address
-         the firewall is running on. (IE: this box)
+         configured on an interface in your FBSD system to represent the
-         As in from me to any or from any to me or from 0.0.0.0/0 to any
+         As in 'from me to any' or from 'any to me' or
-        or from any to 0.0.0.0/0 or from 0.0.0.0 to any or
+        'from 0.0.0.0/0 to any' or from 'any to 0.0.0.0/0' or
-        from any to 0.0.0.0 or from me to 0.0.0.0  IP addresses are
+        'from 0.0.0.0 to any' or 'from any to 0.0.0.0' or from
-        specified as a dotted IP address numeric form/mask-length or
+        'me to 0.0.0.0'  IP addresses are specified as a dotted IP
-        as single dotted IP address numeric form.
+        address numeric form/mask-length or as single dotted IP address
          This is a mandatory requirement. See this link for
          help on writing mask-lengths. http://jodies.de/ipcalc
@@ Line 251: / Line 255: @@
          This is a mandatory keyword. Upon a match, the firewall will
          create a dynamic rule whose default behavior is to match
-         bidirectional traffic between source and destination IP/port using
+         bidirectional traffic between source and destination IP/port
-         the same protocol.
+         using the same protocol.
      limit {src-addr | src-port | dst-addr | dst-port}
@@ Line 260: / Line 264: @@
          The ‘limit’ and 'keep-state’ cannot be used on same rule.
          Limit provides the same stateful function as ‘keep-state’
          plus its own functions.
+</pre>
-−
-−
-−
-−
 == Stateful Rule Option ==

@@ Line 87: / Line 87: @@
 You would enter on the FBSD command line one of the following forms of the list command.
 ipfw list          List all rules in rule number sequence.
@@ Line 109: / Line 110: @@
 ipfw zero number   Clear accounting counter just for this rule number.
 ipfw show | more
 If you have a big rule set with dynamic rules it will scroll off the screen. Suffix the command with ‘ | more’ which will only display the first screen full, and then you have to use the arrow keys or enter key to scroll down through the info.

@@ Line 41: / Line 41: @@
 Sample kernel source IPFW options statements are in the /usr/src/sys/i386/conf/LINT kernel source and are reproduced here.
+<pre>
 options IPFIREWALL
 options IPFIREWALL_VERBOSE
 options IPFIREWALL_VERBOSE_LIMIT=5
 option  IPDIVERT
 IPFIREWALL This tells the compile to include IPFW as part of the kernel.
@@ Line 57: / Line 58: @@
 A complete list of the IPFW options statements are in /usr/src/sys/i386/conf/LINT
 Installer note: After compiling IPFW into your kernel you lose the ability to access all private LAN and public Internet networks, until you enable IPFW in rc.conf and reboot.
-−
-−
-−
 == RC.CONF Options ==

@@ Line 29: / Line 29: @@
 To set the verbose limit, there is a knob you can set in sysctl.conf by adding this statement to the file:
      ee /etc/sysctl.conf
      net.inet.ip.fw.verbose_limit=5
+</pre>
-−
-−
 == Kernel options ==