On Mon, Dec 02, 2002 at 01:11:54PM -0300, Alejandro Valdez wrote:
> Hello,
>
> After many hours of reading and trying I think I produced a good ruleset,
> has anyone any suggestion about it? or something I'm missing? or not
> taking log from something important? or taking too much log?.
>
> The propouse is to close the WAN interface of my server, hide the firewall
> and log posibly scans from the outside.
> If this is ok, my next step is to close the LAN interface.
>
> Thanks in advance.
If you are worried about efficiency you probably want
to use groups to minimize rule checking. I prefer to group
according to interface. However if you arn't processing lots
of connections through the firewall it probably doesn't matter much.
>
> #!/bin/bash
>
> # IP_WAN: WAN interface ip.
> # IP_WBRD: WAN interface broadcast ip.
> # IP_WNET: WAN interface net ip.
> # IF_WAN: WAN interface name.
>
> export IP_WAN="x.x.x.x/32"
> export IP_WBRD="y.y.y.255/32"
> export IP_WNET="q.q.q.0/32"
Hmm, should this be be q.q.q.0/xx where xx != 32 ??
> export IF_WAN="net1"
>
> /etc/ipf -Fa
> /etc/ipf -FS
> /etc/ipf -f - << EOF
>
> #cat << EOF
>
> #block all
> block in log on $IF_WAN all
>
> block return-rst in log on $IF_WAN proto tcp all flags S
>
> block return-icmp(port-unr) in log on $IF_WAN proto udp all
>
> block in log quick on $IF_WAN proto tcp all with short
Why limit this to "proto tcp" ?
Some people also like to block "proto icmp all with frag"
> #rules for outgoing packets.
> #proto 47 is GRE (i use pptp in my lan, but in a near future I'll put
> #a dedicated machine for that propouse)
> pass out quick on $IF_WAN proto tcp from any to any keep state
> pass out quick on $IF_WAN proto udp from any to any keep state
> pass out quick on $IF_WAN proto icmp from any to any keep state
> pass out quick on $IF_WAN proto 47 from any to any #gre
> block out log on $IF_WAN all
>
I don't like the above. Its not needed and too promiscuous.
I like to keep state only on the interface going in, except
for stuff that originates from the firewall like logging etc.
> #rules for my LAN interface
> #(none by the way)
Keep state here for outgoing connections, and use groups
based on interface to improve/eliminate rule checking.
my 2
-steve
