🚀 go-pugleaf

I have put together the following rules to use with IP Filter: v3.3.10.  I
am trying to secure a box that is on the internet and our local network.  I
want to allow internet access only to ports 21,53,80,110,443, and then I
want to allow certain ports to be accessed by other internal computers.  I
want to allow ICMP packets to pass through if they are from 192.168.0.0/24.
Currently I am having problems with the ICMP rules.  Please let me know how
I can solve the ICMP problem.  If there is anything that I am missing or you
see anything that can be improved, please let me know.  I am trying to
secure the system and close all possible security holes.  There is only 1
nic in this box.

Much appreciated,

Matt Salerno

#!/bin/sh
# flush all rules
ipf -F a
ipf -f - <<EOF

#############################
# begin ruleset
#############################
# loopback rules
pass out quick on lo0
pass in quick on lo0

# drop itsy bitsy frags
block in quick proto tcp all with short
block in quick proto tcp all with short

# drop source routed packets
block in quick on hme0 all with opt lsrr
block in quick on hme0 all with opt ssrr

# don't allow anyone to spoof non-routeable addresses
block in quick on hme0 from 127.0.0.0/8 to any
#block in quick on hme0 from 192.168.0.0/16 to any
block in quick on hme0 from 172.16.0.0/12 to any
block in quick on hme0 from 10.0.0.0/8 to any
block out quick on hme0 from any to 127.0.0.1/8
#block out quick on hme0 from any to 192.168.0.0/16
block out quick on hme0 from any to 172.16.0.0/12
block out quick on hme0 from any to 10.0.0.0/8

# Allow access for our computers, Office and Co-Lo
pass in quick on hme0 from 192.168.0.22/32 to any port = 23
pass in quick on hme0 from 192.168.0.0/24 to any port = 23
pass in quick on hme0 from 192.168.0.0/24 to any port = 25
pass in quick on hme0 from 116.218.131.0/27 to any port = 25
pass in quick on hme0 from 116.218.131.0/27 to any port = 1521
pass in quick on hme0 from 116.218.131.0/27 to any port = 7001

pass in quick on hme0 proto icmp from 192.168.0.0/24 to any icmp-type 0
pass in quick on hme0 proto icmp from 192.168.0.0/24 to any  icmp-type 11
block in quick on hme0 proto icmp from any to any

# Allow anonymous/internet to access our system
pass in quick on hme0 proto tcp from any to any port = 21 flags S/SA
pass in quick on hme0 proto tcp from any to any port = 53 flags S/SA
pass in quick on hme0 proto tcp from any to any port = 80 flags S/SA
pass in quick on hme0 proto tcp from any to any port = 110 flags S/SA
pass in quick on hme0 proto tcp from any to any port = 443 flags S/SA

# Deny all in case I forgot anything
block in quick on hme0 from any to any

# Let out-going traffic out and maintain state on established connections
pass out on hme0 proto tcp/udp from any to any keep state
pass out on hme0 proto icmp from any to any keep state
##############################
# end ruleset
##############################

EOF
# log
ipmon > /var/adm/firewall &