1145519SdarrenrIP Filter - What's this about ? 2145510Sdarrenr============================ 3145510SdarrenrWeb site: http://coombs.anu.edu.au/~avalon/ip-filter.html 4255332ScyHow-to: http://www.obfuscation.org/ipf/ipf-howto.txt 5145510Sdarrenr 6145510Sdarrenr The idea behind this package is allow those who use Unix workstations as 7145510Sdarrenrrouters (a common occurance in Universities it appears) to apply packet 8255332Scyfiltering to packets going in and out of them. This package has been 9145510Sdarrenrtested on all versions of SunOS 4.1 and Solaris 2.4/2.5, running on Sparcs. 10145510SdarrenrIt is also quite possible for this small kernel extension to be installed 11145510Sdarrenrand used effectively on Sun workstations which don't route IP, just for 12145510Sdarrenradded security. It can also be integrated with the multicast patches. 13145510SdarrenrIt has also been tested successfully on all of the modern free BSDs as 14145510Sdarrenrwell as BSDI, and SGI's IRIX 6.2. 15145510Sdarrenr 16145510Sdarrenr The filter keeps a rule list for both inbound and outbound sides of 17145510Sdarrenrthe IP packet queue and a check is made as early as possible, aiming to 18255332Scystop the packet before it even gets as far as being checked for source 19145510Sdarrenrroute options. In the file "BNF", a set of rules for constructing filter 20145510Sdarrenrrules understood by this package is given. The files in the directory 21145510Sdarrenr"rules", "example.1" ... "example.sr" show example rules you might apply. 22145510Sdarrenr 23255332Scy In practise, I've successfully isolated a workstation from all 24145510Sdarrenrmachines except the NFS file servers on its local subnets (yeah, ok, so 25255332Scythis doesn't really increase security, because of NFS, but you get the 26255332Scydrift on how it can be applied and used). I've also successfully 27255332Scysetup and maintained my own firewalls using it with TIS's Firewall Toolkit, 28145510Sdarrenrincluding using it on an mbone router. 29145510Sdarrenr 30145510Sdarrenr When using it with multicast IP, the calls to fr_check() should be 31145510Sdarrenrbefore the packet is unwrapped and after it is encapsulated. So the 32145510Sdarrenrfilter routines will see the packet as a UDP packet, protocol XYZ. 33145510SdarrenrWhether this is better or worse than having it filter on class D addresses 34145510Sdarrenris debateable, but the idea behind this package is to be able to 35145510Sdarrenrdiscriminate between packets as they are on the 'wire', before they 36145510Sdarrenrget routed anywhere, etc. 37145510Sdarrenr 38255332Scy It is worth noting, that it is possible, using a small MTU and 39255332Scygenerating tiny fragmented IP packets to generate a TCP packet which 40255332Scydoesn't contain enough information to filter on the "flags". Filtering 41255332Scyon these types of packets is possible, but under the more general case 42255332Scyof the packets being "short". ICMP and UDP packets which are too small 43255332Scy(they don't contain a complete header) are dropped and logged, no questions 44255332Scyasked. When filtering on fragmented packets, the last fragment will get 45255332Scythrough for TCP/UDP/ICMP packets. 46255332Scy 47255332ScyBugs/Problems 48255332Scy------------- 49255332ScyIf you have a problem with IP Filter on your operating system, please email 50255332Scya copy of the file "BugReport" with the details of your setup as required 51255332Scyand email to darrenr@pobox.com. 52255332Scy 53255332ScySome general notes. 54255332Scy------------------- 55255332Scy To add/delete a rule from memory, access to the device in /dev is needed, 56allowing non-root maintenaince. The filter list in kernel memory is built 57from the kernel's heap. Each packet coming *in* or *out* is checked against 58the appropriate list, rejects dropped, others passed through. Thus this will 59work on an individual host, not just gateways. Presently there is only one 60list for all interfaces, the changes required to make it a per-interface list 61require more .o replacements for the kernel. When checking a packet, the 62packet is compared to the entire list from top to bottom, the last matching 63line being effective. 64 65 66What does what ? 67---------------- 68if_fil.o (Loadable kernel module) 69 - additional kernel routines to check an access list as to whether 70 or not to drop or pass a packet. It currently defaults to pass 71 on all packets. 72 73ipfstat 74 - digs through your kernel (need to check #define VMUNIX in fils.c) 75 and /dev/kmem for the access filter list and mini stats table. 76 Obviously needs to be run priviledged if required. 77 78ipf 79 - reads the files passed as parameters as input files containing new 80 filter rules to add/delete to the kernel list. The lines are 81 inserted in order; the first line is inserted first, and ends up 82 first on the list. Subsequent invocations append to the list 83 unless specified otherwise. 84 85ipftest 86 - test the ruleset given by filename. Reads in the ruleset and then 87 waits for stdin. 88 89 See the man pages (ipf.1, ipftest.1, ipfstat.8) for more detailed 90 information on what the above do. 91 92mkfilters 93 - suggests a set of filter rules to employ and suggests how to add 94 routes to back these up. 95 96BNF 97 - BNF rule set for the filter rules 98 99Darren Reed 100darrenr@pobox.com 101http://coombs.anu.edu.au/~avalon/ip-filter.html 102