Hello,
After many hours of reading and trying I think I produced a good ruleset,
has anyone any suggestion about it? or something I'm missing? or not
taking log from something important? or taking too much log?.
The propouse is to close the WAN interface of my server, hide the firewall
and log posibly scans from the outside.
If this is ok, my next step is to close the LAN interface.
Thanks in advance.
#!/bin/bash
# IP_WAN: WAN interface ip.
# IP_WBRD: WAN interface broadcast ip.
# IP_WNET: WAN interface net ip.
# IF_WAN: WAN interface name.
export IP_WAN="x.x.x.x/32"
export IP_WBRD="y.y.y.255/32"
export IP_WNET="q.q.q.0/32"
export IF_WAN="net1"
/etc/ipf -Fa
/etc/ipf -FS
/etc/ipf -f - << EOF
#cat << EOF
#block all
block in log on $IF_WAN all
block return-rst in log on $IF_WAN proto tcp all flags S
block return-icmp(port-unr) in log on $IF_WAN proto udp all
block in log quick on $IF_WAN proto tcp all with short
block in log quick on $IF_WAN all with ipopts
#block spoofed ip
block in quick on $IF_WAN from 192.168.0.0/16 to any
block in quick on $IF_WAN from 172.16.0.0/12 to any
block in quick on $IF_WAN from 10.0.0.0/8 to any
block in quick on $IF_WAN from 127.0.0.0/8 to any
block in quick on $IF_WAN from 0.0.0.0/8 to any
block in quick on $IF_WAN from 169.254.0.0/16 to any
block in quick on $IF_WAN from 192.0.2.0/24 to any
block in quick on $IF_WAN from 204.152.64.0/23 to any
block in quick on $IF_WAN from 224.0.0.0/3 to any
block in quick on $IF_WAN from any to 255.255.255.255/32
#block broadcasts
block in quick on $IF_WAN from any to $IP_WBRD
block in quick on $IF_WAN from any to $IP_WNET
#icmp
pass in quick on $IF_WAN proto icmp all icmp-type 0 #echo reply
pass in quick on $IF_WAN proto icmp all icmp-type 8 #echo request
pass in quick on $IF_WAN proto icmp all icmp-type 3 #dest unrecheable
pass in quick on $IF_WAN proto icmp all icmp-type 11 #time exceeded
block in log quick on $IF_WAN proto icmp all
# things i don't want to see in my logs
block return-icmp(port-unr) in quick on $IF_WAN proto udp from any to any \
port 136 >< 140 #netbios
block return-rst in quick on $IF_WAN proto tcp from any to any \
port 136 >< 140 flags S #netbios
block return-rst in quick on $IF_WAN proto tcp from any to $IP_WAN \
port = 113 #ident
#
# services
#
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \
port = 20 flags S keep state keep frags #ftp-data
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \
port = 21 flags S keep state keep frags #ftp-ctrl
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \
port = 22 flags S keep state keep frags #ftp-ctrl
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \
port = 23 flags S keep state keep frags #telnet
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \
port = 25 flags S keep state keep frags #smtp
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \
port = 53 flags S keep state keep frags #dns
pass in quick on $IF_WAN proto udp from any to $IP_WAN \
port = 53 keep state keep frags #dns
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \
port = 80 flags S keep state keep frags #http
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \
port = 110 flags S keep state keep frags #pop3
#rules for outgoing packets.
#proto 47 is GRE (i use pptp in my lan, but in a near future I'll put
#a dedicated machine for that propouse)
pass out quick on $IF_WAN proto tcp from any to any keep state
pass out quick on $IF_WAN proto udp from any to any keep state
pass out quick on $IF_WAN proto icmp from any to any keep state
pass out quick on $IF_WAN proto 47 from any to any #gre
block out log on $IF_WAN all
#rules for my LAN interface
#(none by the way)
pass in on net0 all
pass out on net0 all
EOF
