Thread View: comp.sys.unix.questions
1 messages
1 total messages
Started by Matthew J. Salerno
Fri, 17 Mar 2000 00:00
Need Firewall help - New at this
Author: Matthew J. Salerno
Date: Fri, 17 Mar 2000 00:00
Date: Fri, 17 Mar 2000 00:00
77 lines
4304 bytes
4304 bytes
I have put together the following rules to use with IP Filter: v3.3.10. I am trying to secure a box that is on the internet and our local network. I want to allow internet access only to ports 21,53,80,110,443, and then I want to allow certain ports to be accessed by other internal computers. I want to allow ICMP packets to pass through if they are from 192.168.0.0/24. Currently I am having problems with the ICMP rules. Please let me know how I can solve the ICMP problem. If there is anything that I am missing or you see anything that can be improved, please let me know. I am trying to secure the system and close all possible security holes. There is only 1 nic in this box. Much appreciated, Matt Salerno #!/bin/sh # flush all rules ipf -F a ipf -f - <<EOF ############################# # begin ruleset ############################# # loopback rules pass out quick on lo0 pass in quick on lo0 # drop itsy bitsy frags block in quick proto tcp all with short block in quick proto tcp all with short # drop source routed packets block in quick on hme0 all with opt lsrr block in quick on hme0 all with opt ssrr # don't allow anyone to spoof non-routeable addresses block in quick on hme0 from 127.0.0.0/8 to any #block in quick on hme0 from 192.168.0.0/16 to any block in quick on hme0 from 172.16.0.0/12 to any block in quick on hme0 from 10.0.0.0/8 to any block out quick on hme0 from any to 127.0.0.1/8 #block out quick on hme0 from any to 192.168.0.0/16 block out quick on hme0 from any to 172.16.0.0/12 block out quick on hme0 from any to 10.0.0.0/8 # Allow access for our computers, Office and Co-Lo pass in quick on hme0 from 192.168.0.22/32 to any port = 23 pass in quick on hme0 from 192.168.0.0/24 to any port = 23 pass in quick on hme0 from 192.168.0.0/24 to any port = 25 pass in quick on hme0 from 116.218.131.0/27 to any port = 25 pass in quick on hme0 from 116.218.131.0/27 to any port = 1521 pass in quick on hme0 from 116.218.131.0/27 to any port = 7001 pass in quick on hme0 proto icmp from 192.168.0.0/24 to any icmp-type 0 pass in quick on hme0 proto icmp from 192.168.0.0/24 to any icmp-type 11 block in quick on hme0 proto icmp from any to any # Allow anonymous/internet to access our system pass in quick on hme0 proto tcp from any to any port = 21 flags S/SA pass in quick on hme0 proto tcp from any to any port = 53 flags S/SA pass in quick on hme0 proto tcp from any to any port = 80 flags S/SA pass in quick on hme0 proto tcp from any to any port = 110 flags S/SA pass in quick on hme0 proto tcp from any to any port = 443 flags S/SA # Deny all in case I forgot anything block in quick on hme0 from any to any # Let out-going traffic out and maintain state on established connections pass out on hme0 proto tcp/udp from any to any keep state pass out on hme0 proto icmp from any to any keep state ############################## # end ruleset ############################## EOF # log ipmon > /var/adm/firewall &
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads