🚀 go-pugleaf

[Posted and mailed]

In article <367DF272.B37FF259@tip.csiro.au>,
	Adam Carter <acarter@tip.csiro.au> writes:

> hopeing to allow ppl on www.xxx.yyy.zzz/29 unlimited access to the
> internet but barring all access from the internet to that subnet. I
> setup;
> 
> ipfwadm -F -p deny
> ipfwadm -F -a accept -b -S www.xxx.yyy.zzz/29
> 
> however this seems to allow all access both ways. Removing the -b causes
> no access either way. So what am i doing wrong? Where can i find more in
> depth info than the man/help pages?

Your rule isn't specific enough to do what you want. All your rule says is:

accept for forwarding any datagrams that have a source address matching
www.xxx.yyy.zzz/29, or (-b) their corresponding replies. The reply in this
case would be any datagram with a *destination* address matching
www.xxx.yyy.zzz/29. So all your rule really does is ensure that the only
datagrams forwarded are ones that have either originated, or are destined
for your network. Not a big win as you've noticed.

If what you really want is to disallow incoming TCP connections, then you
need to use the -y flag. The -y flag causes the rule to match the
SYN datagram that begins a TCP connection.

So, presuming all you wanted to do was prevent all incoming TCP connections
you could use something like:

ipfwadm -F -p accept
ipfwadm -F -a deny -D www.xxx.yyy.zzz/29 -y

Note that this would interfere with normal ftp operation, because the
ftp data session is normally an incoming tcp connection, so you'd
either have to use ftp PASV mode (which most web browsers default
to for example) or to force it in your ftp client by command.

Alternatively you could add a rule which allows it, something like:

ipfwadm -F -p accept
ipfwadm -F -a accept -D www.xxx.yyy.zzz/29 ftp-data -y
ipfwadm -F -a deny -D www.xxx.yyy.zzz/29 -y

Note that this configuration does nothing to firewall ICMP or UDP datagrams.
Nor will it stop people from connecting to the firewall machine itself, you'd
need to use -I rules rather than -F ones to do that.


To generate competent firewall rulesets you really need to have a good
understanding of the services you will be using to determine what you
must allow and what you may therefore filter.

Another perhaps simpler way of achieving what you want is to use IP
masquerading. It is a characteristic of IP masquerading to prevent incoming
connections to hosts behind the masquerade host.

regards
Terry

-- 
terry@albert.aapra.org.au, terry@linux.org.au