Deleted Added
sdiff udiff text old ( 50472 ) new ( 51231 )
full compact
rc.firewall (50472) rc.firewall (51231)
1############
2# Setup system for firewall service.
1############
2# Setup system for firewall service.
3# $FreeBSD: head/etc/rc.firewall 50472 1999-08-27 23:37:10Z peter $
3# $FreeBSD: head/etc/rc.firewall 51231 1999-09-13 15:44:20Z sheldonh $
4
5# Suck in the configuration variables.
4
5# Suck in the configuration variables.
6if [ -f /etc/defaults/rc.conf ]; then
6if [ -r /etc/defaults/rc.conf ]; then
7 . /etc/defaults/rc.conf
7 . /etc/defaults/rc.conf
8elif [ -f /etc/rc.conf ]; then
8elif [ -r /etc/rc.conf ]; then
9 . /etc/rc.conf
10fi
11
12############
13# Define the firewall type in /etc/rc.conf. Valid values are:
14# open - will allow anyone in
15# client - will try to protect just this machine
16# simple - will try to protect a whole network
17# closed - totally disables IP services except via lo0 interface
18# UNKNOWN - disables the loading of firewall rules.
19# filename - will load the rules in the given filename (full path required)
20#
9 . /etc/rc.conf
10fi
11
12############
13# Define the firewall type in /etc/rc.conf. Valid values are:
14# open - will allow anyone in
15# client - will try to protect just this machine
16# simple - will try to protect a whole network
17# closed - totally disables IP services except via lo0 interface
18# UNKNOWN - disables the loading of firewall rules.
19# filename - will load the rules in the given filename (full path required)
20#
21# For ``client'' and ``simple'' the entries below should be customized
21# For ``client'' and ``simple'' the entries below should be customized
22# appropriately.
23
24############
25#
26# If you don't know enough about packet filtering, we suggest that you
27# take time to read this book:
28#
29# Building Internet Firewalls

--- 9 unchanged lines hidden (view full) ---

39# Repelling the wily hacker
40# William R. Cheswick, Steven M. Bellowin
41#
42# Addison-Wesley
43# ISBN 0-201-6337-4
44# http://www.awl.com/
45#
46
22# appropriately.
23
24############
25#
26# If you don't know enough about packet filtering, we suggest that you
27# take time to read this book:
28#
29# Building Internet Firewalls

--- 9 unchanged lines hidden (view full) ---

39# Repelling the wily hacker
40# William R. Cheswick, Steven M. Bellowin
41#
42# Addison-Wesley
43# ISBN 0-201-6337-4
44# http://www.awl.com/
45#
46
47if [ -n "$1" ]; then
48 firewall_type=$1
47if [ -n "${1}" ]; then
48 firewall_type="${1}"
49fi
50
51############
52# Set quiet mode if requested
49fi
50
51############
52# Set quiet mode if requested
53if [ "${firewall_quiet}" = "YES" ]; then
53#
54case ${firewall_quiet} in
55[Yy][Ee][Ss])
54 fwcmd="/sbin/ipfw -q"
56 fwcmd="/sbin/ipfw -q"
55else
57 ;;
58*)
56 fwcmd="/sbin/ipfw"
59 fwcmd="/sbin/ipfw"
57fi
60 ;;
61esac
58
59############
60# Flush out the list before we begin.
62
63############
64# Flush out the list before we begin.
65#
61${fwcmd} -f flush
62
63############
64# These rules are required for using natd. All packets are passed to
65# natd before they encounter your remaining rules. The firewall rules
66# will then be run again on each packet after translation by natd,
67# minus any divert rules (see natd(8)).
66${fwcmd} -f flush
67
68############
69# These rules are required for using natd. All packets are passed to
70# natd before they encounter your remaining rules. The firewall rules
71# will then be run again on each packet after translation by natd,
72# minus any divert rules (see natd(8)).
68if [ "${natd_enable}" = "YES" -a "${natd_interface}" != "X" ]; then
69 ${fwcmd} add divert natd all from any to any via ${natd_interface}
70fi
73#
74case ${natd_enable} in
75[Yy][Ee][Ss])
76 if [ -n "${natd_interface}" ]; then
77 ${fwcmd} add divert natd all from any to any via ${natd_interface}
78 fi
79 ;;
80esac
71
72############
73# If you just configured ipfw in the kernel as a tool to solve network
74# problems or you just want to disallow some particular kinds of traffic
75# they you will want to change the default policy to open. You can also
76# do this as your only action by setting the firewall_type to ``open''.
81
82############
83# If you just configured ipfw in the kernel as a tool to solve network
84# problems or you just want to disallow some particular kinds of traffic
85# they you will want to change the default policy to open. You can also
86# do this as your only action by setting the firewall_type to ``open''.
77
87#
78# ${fwcmd} add 65000 pass all from any to any
79
80############
81# Only in rare cases do you want to change these rules
88# ${fwcmd} add 65000 pass all from any to any
89
90############
91# Only in rare cases do you want to change these rules
92#
82${fwcmd} add 100 pass all from any to any via lo0
83${fwcmd} add 200 deny all from any to 127.0.0.0/8
84
85
86# Prototype setups.
93${fwcmd} add 100 pass all from any to any via lo0
94${fwcmd} add 200 deny all from any to 127.0.0.0/8
95
96
97# Prototype setups.
87if [ "${firewall_type}" = "open" -o "${firewall_type}" = "OPEN" ]; then
88
98#
99case ${firewall_type} in
100[Oo][Pp][Ee][Nn])
89 ${fwcmd} add 65000 pass all from any to any
101 ${fwcmd} add 65000 pass all from any to any
102 ;;
103[Cc][Ll][Ii][Ee][Nn][Tt])
90
104
91elif [ "${firewall_type}" = "client" ]; then
105 ############
106 # This is a prototype setup that will protect your system somewhat
107 # against people from outside your own network.
108 ############
92
109
93 ############
94 # This is a prototype setup that will protect your system somewhat against
95 # people from outside your own network.
96 ############
110 # set these to your network and netmask and ip
111 net="192.168.4.0"
112 mask="255.255.255.0"
113 ip="192.168.4.17"
97
114
98 # set these to your network and netmask and ip
99 net="192.168.4.0"
100 mask="255.255.255.0"
101 ip="192.168.4.17"
115 # Allow any traffic to or from my own net.
116 ${fwcmd} add pass all from ${ip} to ${net}:${mask}
117 ${fwcmd} add pass all from ${net}:${mask} to ${ip}
102
118
103 # Allow any traffic to or from my own net.
104 ${fwcmd} add pass all from ${ip} to ${net}:${mask}
105 ${fwcmd} add pass all from ${net}:${mask} to ${ip}
119 # Allow TCP through if setup succeeded
120 ${fwcmd} add pass tcp from any to any established
106
121
107 # Allow TCP through if setup succeeded
108 ${fwcmd} add pass tcp from any to any established
122 # Allow setup of incoming email
123 ${fwcmd} add pass tcp from any to ${ip} 25 setup
109
124
110 # Allow setup of incoming email
111 ${fwcmd} add pass tcp from any to ${ip} 25 setup
125 # Allow setup of outgoing TCP connections only
126 ${fwcmd} add pass tcp from ${ip} to any setup
112
127
113 # Allow setup of outgoing TCP connections only
114 ${fwcmd} add pass tcp from ${ip} to any setup
128 # Disallow setup of all other TCP connections
129 ${fwcmd} add deny tcp from any to any setup
115
130
116 # Disallow setup of all other TCP connections
117 ${fwcmd} add deny tcp from any to any setup
131 # Allow DNS queries out in the world
132 ${fwcmd} add pass udp from any 53 to ${ip}
133 ${fwcmd} add pass udp from ${ip} to any 53
118
134
119 # Allow DNS queries out in the world
120 ${fwcmd} add pass udp from any 53 to ${ip}
121 ${fwcmd} add pass udp from ${ip} to any 53
135 # Allow NTP queries out in the world
136 ${fwcmd} add pass udp from any 123 to ${ip}
137 ${fwcmd} add pass udp from ${ip} to any 123
122
138
123 # Allow NTP queries out in the world
124 ${fwcmd} add pass udp from any 123 to ${ip}
125 ${fwcmd} add pass udp from ${ip} to any 123
139 # Everything else is denied by default, unless the
140 # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
141 # config file.
142 ;;
126
143
127 # Everything else is denied as default.
144[Ss][Ii][Mm][Pp][Ll][Ee])
128
145
129elif [ "${firewall_type}" = "simple" ]; then
146 ############
147 # This is a prototype setup for a simple firewall. Configure this
148 # machine as a named server and ntp server, and point all the machines
149 # on the inside at this machine for those services.
150 ############
130
151
131 ############
132 # This is a prototype setup for a simple firewall. Configure this machine
133 # as a named server and ntp server, and point all the machines on the inside
134 # at this machine for those services.
135 ############
152 # set these to your outside interface network and netmask and ip
153 oif="ed0"
154 onet="192.168.4.0"
155 omask="255.255.255.0"
156 oip="192.168.4.17"
136
157
137 # set these to your outside interface network and netmask and ip
138 oif="ed0"
139 onet="192.168.4.0"
140 omask="255.255.255.0"
141 oip="192.168.4.17"
158 # set these to your inside interface network and netmask and ip
159 iif="ed1"
160 inet="192.168.3.0"
161 imask="255.255.255.0"
162 iip="192.168.3.17"
142
163
143 # set these to your inside interface network and netmask and ip
144 iif="ed1"
145 inet="192.168.3.0"
146 imask="255.255.255.0"
147 iip="192.168.3.17"
164 # Stop spoofing
165 ${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
166 ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}
148
167
149 # Stop spoofing
150 ${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
151 ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}
168 # Stop RFC1918 nets on the outside interface
169 ${fwcmd} add deny all from 192.168.0.0:255.255.0.0 to any via ${oif}
170 ${fwcmd} add deny all from any to 192.168.0.0:255.255.0.0 via ${oif}
171 ${fwcmd} add deny all from 172.16.0.0:255.240.0.0 to any via ${oif}
172 ${fwcmd} add deny all from any to 172.16.0.0:255.240.0.0 via ${oif}
173 ${fwcmd} add deny all from 10.0.0.0:255.0.0.0 to any via ${oif}
174 ${fwcmd} add deny all from any to 10.0.0.0:255.0.0.0 via ${oif}
152
175
153 # Stop RFC1918 nets on the outside interface
154 ${fwcmd} add deny all from 192.168.0.0:255.255.0.0 to any via ${oif}
155 ${fwcmd} add deny all from any to 192.168.0.0:255.255.0.0 via ${oif}
156 ${fwcmd} add deny all from 172.16.0.0:255.240.0.0 to any via ${oif}
157 ${fwcmd} add deny all from any to 172.16.0.0:255.240.0.0 via ${oif}
158 ${fwcmd} add deny all from 10.0.0.0:255.0.0.0 to any via ${oif}
159 ${fwcmd} add deny all from any to 10.0.0.0:255.0.0.0 via ${oif}
176 # Allow TCP through if setup succeeded
177 ${fwcmd} add pass tcp from any to any established
160
178
161 # Allow TCP through if setup succeeded
162 ${fwcmd} add pass tcp from any to any established
179 # Allow setup of incoming email
180 ${fwcmd} add pass tcp from any to ${oip} 25 setup
163
181
164 # Allow setup of incoming email
165 ${fwcmd} add pass tcp from any to ${oip} 25 setup
182 # Allow access to our DNS
183 ${fwcmd} add pass tcp from any to ${oip} 53 setup
166
184
167 # Allow access to our DNS
168 ${fwcmd} add pass tcp from any to ${oip} 53 setup
185 # Allow access to our WWW
186 ${fwcmd} add pass tcp from any to ${oip} 80 setup
169
187
170 # Allow access to our WWW
171 ${fwcmd} add pass tcp from any to ${oip} 80 setup
188 # Reject&Log all setup of incoming connections from the outside
189 ${fwcmd} add deny log tcp from any to any in via ${oif} setup
172
190
173 # Reject&Log all setup of incoming connections from the outside
174 ${fwcmd} add deny log tcp from any to any in via ${oif} setup
191 # Allow setup of any other TCP connection
192 ${fwcmd} add pass tcp from any to any setup
175
193
176 # Allow setup of any other TCP connection
177 ${fwcmd} add pass tcp from any to any setup
194 # Allow DNS queries out in the world
195 ${fwcmd} add pass udp from any 53 to ${oip}
196 ${fwcmd} add pass udp from ${oip} to any 53
178
197
179 # Allow DNS queries out in the world
180 ${fwcmd} add pass udp from any 53 to ${oip}
181 ${fwcmd} add pass udp from ${oip} to any 53
198 # Allow NTP queries out in the world
199 ${fwcmd} add pass udp from any 123 to ${oip}
200 ${fwcmd} add pass udp from ${oip} to any 123
182
201
183 # Allow NTP queries out in the world
184 ${fwcmd} add pass udp from any 123 to ${oip}
185 ${fwcmd} add pass udp from ${oip} to any 123
202 # Everything else is denied by default, unless the
203 # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
204 # config file.
205 ;;
186
206
187 # Everything else is denied as default.
188
189elif [ "${firewall_type}" != "UNKNOWN" -a -r "${firewall_type}" ]; then
190 ${fwcmd} ${firewall_type}
191fi
207[Uu][Nn][Kk][Nn][Oo][Ww][Nn])
208 ;;
209*)
210 if [ -r "${firewall_type}" ]; then
211 ${fwcmd} ${firewall_type}
212 fi
213 ;;
214esac