Hi guys, I need help for setting up my ipfw, at the moment Ive got 2 computers one 
running freebsd 4.9 stable and the other one is windows XP connecting to the internet 
using dial up (wich is ppp) with static ip, I already compile the kernel to enable 
firewall as well seting up the rc.conf and the firewall rules (firewall_rules) as 
describe below:

 

rc.conf 

....

gateway_enable="YES"

inetd_enable="YES"

#################################################

# Firewall Configuration

#

firewall_enable=YES

firewall_quiet=YES

firewall_type=/usr/local/etc/firewall_rules

 

firewall_flags="-p cpp                          \

                -D INT_IF=rl0                   \

                -D INT_ADDR=192.168.0.1         \

                -D INT_NET=192.168.0.0/16       \

                -D EXT_IF=tun0                  \

                -D EXT_ADDR=202.24.54.145       \

                -D EXT_NET=202.24.54.145/27     \

                -D LOG_DROPPED_PACKETS          \

                -D ALLOW_ALL_ICMP               \

                -D ALLOW_ACTIVE_FTP             \

                -D ALLOW_TRACEROUTE             \

                -D LOCAL_NAME_SERVER            \

                -D LOCAL_TIME_SERVER            \

                -D LOCAL_VPN_SERVER             \

                -D ROUTE_INTERNAL_NET           "

 

# Enable firewall debugging with8

# sysctl -w net.inet.ip.fw.verbose=1

# and look at /var/log/security

 

#################################################

# NAT Configuration

#

# run NAT on the public interface

#natd_enable=YES

#natd_interface=tun0

#natd_flags="-log_denied -use_sockets"

 

# for testing NAT

#natd_flags="$natd_flags -verbose"

 

 

firewall_rules

#ifdef DROP_SILENT

#       ifdef LOG_DROPPED_PACKETS

#               define BLOCK_TCP                deny log

#               define BLOCK_UDP                deny log

#               define BLOCK_ICMP               deny log

#       else

#               define BLOCK_TCP                deny

#               define BLOCK_UDP                deny

#               define BLOCK_ICMP               deny

#       endif

#else

#       ifdef LOG_DROPPED_PACKETS

#               define BLOCK_TCP                reset log

#               define BLOCK_UDP                unreach port log

#               define BLOCK_ICMP               unreach filter-prohib log

#       else

#               define BLOCK_TCP                reset

#               define BLOCK_UDP                unreach port

#               define BLOCK_ICMP               unreach filter-prohib

#       endif

#endif

/*** IP ******************************************************/

 

// filter out all bogus packets at the external interface

add 00990 skipto 2100 ip from any to EXT_ADDR in recv EXT_IF

add 00999 deny all from any to any in recv EXT_IF

 

// hand off packets to natd; they will be reinjected, with the address

// translated, into the next rule

#ifdef DIVERT_TO_NATD

#add 01000 divert natd ip from any to any via EXT_IF

#endif

 

// prevent spoofing

add 02100 deny all from INT_NET to any in via EXT_IF

add 02110 deny all from EXT_NET to any in via INT_IF

 

#ifdef ROUTE_INTERNAL_NET

// allow all packets from the internal network, on any interface

add 02300 allow all from INT_NET to any

#else

add 02300 allow all from INT_ADDR to INT_NET via INT_IF

#endif

 

#ifdef LOCAL_VPN_SERVER

add 02400 allow gre from any to any via EXT_IF

#endif

 

 

/*** TCP ****************************************************/

 

// allow all established connections

add 03000 allow tcp from any to any established

 

// allow outgoing TCP setups from the local host, and from the internal

// network

add 03100 allow tcp from EXT_ADDR to any out via EXT_IF

//add 03110 allow tcp from INT_NET to any in recv INT_IF setup

 

// allow the return TCP connection for FTP data session

#ifdef ALLOW_ACTIVE_FTP

add 03200 allow tcp from any 20 to EXT_ADDR in recv EXT_IF setup

add 03210 allow tcp from any 20 to INT_NET // out xmit INT_IF setup

#endif

 

// allow SMTP to the local host

add 03300 allow tcp from any to EXT_ADDR smtp in recv EXT_IF setup

 

// allow SSH to the local host

add 03400 allow tcp from any to EXT_ADDR ssh in recv EXT_IF setup

 

#ifdef LOCAL_NAME_SERVER

// allow zone transfers to the outside world

add 03500 allow tcp from any to EXT_ADDR domain in recv EXT_IF setup

#endif

 

#ifdef LOCAL_VPN_SERVER

// allow traffic to PPTP daemon

add 03600 allow tcp from any to EXT_ADDR pptp in recv EXT_IF setup

// all other TCP connections are blocked

add 03900 BLOCK_TCP tcp from any to any in via EXT_IF

 

 

/*** UDP ****************************************************/

 

// allow client DNS queries to the outside from this machine

// (domain = DNS port number)

add 04000 allow udp from any domain to EXT_ADDR

add 04010 allow udp from EXT_ADDR to any domain

 

#ifdef LOCAL_NAME_SERVER

// allow client DNS queries from the internal net to this name server

add 04020 allow udp from INT_NET to INT_ADDR domain

add 04030 allow udp from INT_ADDR domain to INT_NET

 

// allow server DNS queries to this nameserver from the Internet

add 04040 allow udp from any to EXT_ADDR domain

add 04050 allow udp from EXT_ADDR domain to any

#endif

 

#ifdef LOCAL_TIME_SERVER

// allow NTP to/from the local host and out to the local network

add 04100 allow udp from any ntp to EXT_ADDR ntp

add 04110 allow udp from EXT_ADDR ntp to any ntp

add 04120 allow udp from INT_ADDR ntp to INT_NET ntp

#endif

 

#ifdef ALLOW_TRACEROUTE

// allow traceroutes

add 04300 allow udp from EXT_ADDR to any 33434-33534

add 04310 allow udp from INT_NET to any 33434-33534

#endif

 

// block everything else

add 04900 BLOCK_UDP udp from any to any in via EXT_IF

 

 

/*** ICMP **************************************************/

 

#ifdef ALLOW_ALL_ICMP

// allow all ICMP packets to and from anywhere

add 05000 allow icmp from any to any

 

#else

// allow only essential ICMP packets to and from the local host

add 05000 allow icmp from EXT_ADDR to any icmptype 3,4,11,12

add 05010 allow icmp from any to EXT_ADDR icmptype 3,4,11,12

 

// as well as to/from the internal network

add 05100 allow icmp from INT_NET to any icmptype 3,4,11,12

add 05110 allow icmp from any to INT_NET icmptype 3,4,11,12

#endif

 

 

/*** EVERYTHING ELSE IS DENIED *********/

 

#ifdef LOG_DROPPED_PACKETS

add 65000 deny log all from any to any

#else

add 65000 deny all from any to any

#endif

 

using reference from http://renaud.waldura.com/doc/freebsd/firewall/

 

but  Id slightly modified the nat and the rules as you can see I commented out the 
NAT configuration and at rule 990 I set it to skip to rule 2100 instead rule 1000 
since the nat didnt work well with ppp (it cant recognize the tun0 device from the 
start up and when i tried manually to add it after connected using ppp the freebsd 
can't connect to the net too)

 

as the result using this firewall only my freebsd the only one that connect to net 
(but both box able to communicate well, ping, sshd, ftp, etc - LAN), questions are:

1.)    Any body (whos expert with ipfw) knows whats wrong with my configuration ?

2.)     Is there any possibility to use nat (not user ppp nat) to work with ipfw + 
ppp, 

 

references, urls, are welcomed. (by the way Ive browse most site in google.com/bsd 
regarding this ipfw + ppp + nat but then again only the reference I used above that 
works pretty much close to what I need...i think). 

 

Thank you once again,

 

Regards,

Mike 


---------------------------------
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to