rc.firewall revision 51231
115027Sphk############ 215027Sphk# Setup system for firewall service. 350472Speter# $FreeBSD: head/etc/rc.firewall 51231 1999-09-13 15:44:20Z sheldonh $ 415027Sphk 543849Sjkh# Suck in the configuration variables. 651231Ssheldonhif [ -r /etc/defaults/rc.conf ]; then 743849Sjkh . /etc/defaults/rc.conf 851231Ssheldonhelif [ -r /etc/rc.conf ]; then 933203Sadam . /etc/rc.conf 1033203Sadamfi 1133203Sadam 1215027Sphk############ 1329300Sdanny# Define the firewall type in /etc/rc.conf. Valid values are: 1429300Sdanny# open - will allow anyone in 1529300Sdanny# client - will try to protect just this machine 1629300Sdanny# simple - will try to protect a whole network 1729300Sdanny# closed - totally disables IP services except via lo0 interface 1829300Sdanny# UNKNOWN - disables the loading of firewall rules. 1929300Sdanny# filename - will load the rules in the given filename (full path required) 2015027Sphk# 2151231Ssheldonh# For ``client'' and ``simple'' the entries below should be customized 2229300Sdanny# appropriately. 2315027Sphk 2415027Sphk############ 2515027Sphk# 2615027Sphk# If you don't know enough about packet filtering, we suggest that you 2715027Sphk# take time to read this book: 2815027Sphk# 2915210Sphk# Building Internet Firewalls 3015210Sphk# Brent Chapman and Elizabeth Zwicky 3115210Sphk# 3215210Sphk# O'Reilly & Associates, Inc 3315210Sphk# ISBN 1-56592-124-0 3425478Sjkh# http://www.ora.com/ 3515210Sphk# 3615210Sphk# For a more advanced treatment of Internet Security read: 3715210Sphk# 3815027Sphk# Firewalls & Internet Security 3915027Sphk# Repelling the wily hacker 4015027Sphk# William R. Cheswick, Steven M. Bellowin 4115027Sphk# 4215027Sphk# Addison-Wesley 4315027Sphk# ISBN 0-201-6337-4 4425478Sjkh# http://www.awl.com/ 4515027Sphk# 4615027Sphk 4751231Ssheldonhif [ -n "${1}" ]; then 4851231Ssheldonh firewall_type="${1}" 4929300Sdannyfi 5029300Sdanny 5115027Sphk############ 5229300Sdanny# Set quiet mode if requested 5351231Ssheldonh# 5451231Ssheldonhcase ${firewall_quiet} in 5551231Ssheldonh[Yy][Ee][Ss]) 5629300Sdanny fwcmd="/sbin/ipfw -q" 5751231Ssheldonh ;; 5851231Ssheldonh*) 5929300Sdanny fwcmd="/sbin/ipfw" 6051231Ssheldonh ;; 6151231Ssheldonhesac 6229300Sdanny 6329300Sdanny############ 6416578Salex# Flush out the list before we begin. 6551231Ssheldonh# 6650357Ssheldonh${fwcmd} -f flush 6716578Salex 6816578Salex############ 6935267Sbrian# These rules are required for using natd. All packets are passed to 7035267Sbrian# natd before they encounter your remaining rules. The firewall rules 7135267Sbrian# will then be run again on each packet after translation by natd, 7235267Sbrian# minus any divert rules (see natd(8)). 7351231Ssheldonh# 7451231Ssheldonhcase ${natd_enable} in 7551231Ssheldonh[Yy][Ee][Ss]) 7651231Ssheldonh if [ -n "${natd_interface}" ]; then 7751231Ssheldonh ${fwcmd} add divert natd all from any to any via ${natd_interface} 7851231Ssheldonh fi 7951231Ssheldonh ;; 8051231Ssheldonhesac 8135267Sbrian 8235267Sbrian############ 8315027Sphk# If you just configured ipfw in the kernel as a tool to solve network 8415027Sphk# problems or you just want to disallow some particular kinds of traffic 8517594Sjkh# they you will want to change the default policy to open. You can also 8617594Sjkh# do this as your only action by setting the firewall_type to ``open''. 8751231Ssheldonh# 8850357Ssheldonh# ${fwcmd} add 65000 pass all from any to any 8915027Sphk 9015027Sphk############ 9130617Sdanny# Only in rare cases do you want to change these rules 9251231Ssheldonh# 9350357Ssheldonh${fwcmd} add 100 pass all from any to any via lo0 9450357Ssheldonh${fwcmd} add 200 deny all from any to 127.0.0.0/8 9515027Sphk 9615027Sphk 9717594Sjkh# Prototype setups. 9851231Ssheldonh# 9951231Ssheldonhcase ${firewall_type} in 10051231Ssheldonh[Oo][Pp][Ee][Nn]) 10150357Ssheldonh ${fwcmd} add 65000 pass all from any to any 10251231Ssheldonh ;; 10351231Ssheldonh[Cc][Ll][Ii][Ee][Nn][Tt]) 10417594Sjkh 10551231Ssheldonh ############ 10651231Ssheldonh # This is a prototype setup that will protect your system somewhat 10751231Ssheldonh # against people from outside your own network. 10851231Ssheldonh ############ 10929300Sdanny 11051231Ssheldonh # set these to your network and netmask and ip 11151231Ssheldonh net="192.168.4.0" 11251231Ssheldonh mask="255.255.255.0" 11351231Ssheldonh ip="192.168.4.17" 11417594Sjkh 11551231Ssheldonh # Allow any traffic to or from my own net. 11651231Ssheldonh ${fwcmd} add pass all from ${ip} to ${net}:${mask} 11751231Ssheldonh ${fwcmd} add pass all from ${net}:${mask} to ${ip} 11815027Sphk 11951231Ssheldonh # Allow TCP through if setup succeeded 12051231Ssheldonh ${fwcmd} add pass tcp from any to any established 12115027Sphk 12251231Ssheldonh # Allow setup of incoming email 12351231Ssheldonh ${fwcmd} add pass tcp from any to ${ip} 25 setup 12415027Sphk 12551231Ssheldonh # Allow setup of outgoing TCP connections only 12651231Ssheldonh ${fwcmd} add pass tcp from ${ip} to any setup 12715027Sphk 12851231Ssheldonh # Disallow setup of all other TCP connections 12951231Ssheldonh ${fwcmd} add deny tcp from any to any setup 13015027Sphk 13151231Ssheldonh # Allow DNS queries out in the world 13251231Ssheldonh ${fwcmd} add pass udp from any 53 to ${ip} 13351231Ssheldonh ${fwcmd} add pass udp from ${ip} to any 53 13415027Sphk 13551231Ssheldonh # Allow NTP queries out in the world 13651231Ssheldonh ${fwcmd} add pass udp from any 123 to ${ip} 13751231Ssheldonh ${fwcmd} add pass udp from ${ip} to any 123 13815027Sphk 13951231Ssheldonh # Everything else is denied by default, unless the 14051231Ssheldonh # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel 14151231Ssheldonh # config file. 14251231Ssheldonh ;; 14315027Sphk 14451231Ssheldonh[Ss][Ii][Mm][Pp][Ll][Ee]) 14515027Sphk 14651231Ssheldonh ############ 14751231Ssheldonh # This is a prototype setup for a simple firewall. Configure this 14851231Ssheldonh # machine as a named server and ntp server, and point all the machines 14951231Ssheldonh # on the inside at this machine for those services. 15051231Ssheldonh ############ 15115027Sphk 15251231Ssheldonh # set these to your outside interface network and netmask and ip 15351231Ssheldonh oif="ed0" 15451231Ssheldonh onet="192.168.4.0" 15551231Ssheldonh omask="255.255.255.0" 15651231Ssheldonh oip="192.168.4.17" 15717594Sjkh 15851231Ssheldonh # set these to your inside interface network and netmask and ip 15951231Ssheldonh iif="ed1" 16051231Ssheldonh inet="192.168.3.0" 16151231Ssheldonh imask="255.255.255.0" 16251231Ssheldonh iip="192.168.3.17" 16315027Sphk 16451231Ssheldonh # Stop spoofing 16551231Ssheldonh ${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif} 16651231Ssheldonh ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif} 16715027Sphk 16851231Ssheldonh # Stop RFC1918 nets on the outside interface 16951231Ssheldonh ${fwcmd} add deny all from 192.168.0.0:255.255.0.0 to any via ${oif} 17051231Ssheldonh ${fwcmd} add deny all from any to 192.168.0.0:255.255.0.0 via ${oif} 17151231Ssheldonh ${fwcmd} add deny all from 172.16.0.0:255.240.0.0 to any via ${oif} 17251231Ssheldonh ${fwcmd} add deny all from any to 172.16.0.0:255.240.0.0 via ${oif} 17351231Ssheldonh ${fwcmd} add deny all from 10.0.0.0:255.0.0.0 to any via ${oif} 17451231Ssheldonh ${fwcmd} add deny all from any to 10.0.0.0:255.0.0.0 via ${oif} 17515027Sphk 17651231Ssheldonh # Allow TCP through if setup succeeded 17751231Ssheldonh ${fwcmd} add pass tcp from any to any established 17815027Sphk 17951231Ssheldonh # Allow setup of incoming email 18051231Ssheldonh ${fwcmd} add pass tcp from any to ${oip} 25 setup 18115027Sphk 18251231Ssheldonh # Allow access to our DNS 18351231Ssheldonh ${fwcmd} add pass tcp from any to ${oip} 53 setup 18415027Sphk 18551231Ssheldonh # Allow access to our WWW 18651231Ssheldonh ${fwcmd} add pass tcp from any to ${oip} 80 setup 18715027Sphk 18851231Ssheldonh # Reject&Log all setup of incoming connections from the outside 18951231Ssheldonh ${fwcmd} add deny log tcp from any to any in via ${oif} setup 19015027Sphk 19151231Ssheldonh # Allow setup of any other TCP connection 19251231Ssheldonh ${fwcmd} add pass tcp from any to any setup 19315027Sphk 19451231Ssheldonh # Allow DNS queries out in the world 19551231Ssheldonh ${fwcmd} add pass udp from any 53 to ${oip} 19651231Ssheldonh ${fwcmd} add pass udp from ${oip} to any 53 19715027Sphk 19851231Ssheldonh # Allow NTP queries out in the world 19951231Ssheldonh ${fwcmd} add pass udp from any 123 to ${oip} 20051231Ssheldonh ${fwcmd} add pass udp from ${oip} to any 123 20115027Sphk 20251231Ssheldonh # Everything else is denied by default, unless the 20351231Ssheldonh # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel 20451231Ssheldonh # config file. 20551231Ssheldonh ;; 20615027Sphk 20751231Ssheldonh[Uu][Nn][Kk][Nn][Oo][Ww][Nn]) 20851231Ssheldonh ;; 20951231Ssheldonh*) 21051231Ssheldonh if [ -r "${firewall_type}" ]; then 21151231Ssheldonh ${fwcmd} ${firewall_type} 21251231Ssheldonh fi 21351231Ssheldonh ;; 21451231Ssheldonhesac 215