alejandro, note that it is not immediately obvious from the ipf docs,
but when using "keep state" on outgoing connections ipf very nicely handles ICMP messages *that are related to the stateful connections*. this is an important concept. thus, if you keep state on outgoing tcp/udp/icmp traffic, related ICMP traffic is handled for you automagically. so, in fact you do not need to let in "dest unreacheable" and so forth. moreover, there is no reason that you have to reply to ICMP echo requests, and certainly you don't need to pass in the echo replies -- again this is handled nicely by keep state.
#icmp pass in quick on $IF_WAN proto icmp all icmp-type 0 #echo reply pass in quick on $IF_WAN proto icmp all icmp-type 8 #echo request pass in quick on $IF_WAN proto icmp all icmp-type 3 #dest unrecheable pass in quick on $IF_WAN proto icmp all icmp-type 11 #time exceeded block in log quick on $IF_WAN proto icmp all
# icmp simplified block in log quick on $IF_WAN proto icmp all ok, now for ftp. first, you need to read the ftp RFCs and i could suggest a quick review of the ipfilter archives... http://www.wu-ftpd.org/rfc/rfc765.txt http://www.wu-ftpd.org/rfc/rfc959.txt http://www.wu-ftpd.org/rfc/rfc1579.txt http://marc.theaimsgroup.com/?l=ipfilter&m=99482650422195&w=2 http://marc.theaimsgroup.com/?l=ipfilter&m=100552653809016&w=2 http://marc.theaimsgroup.com/?l=ipfilter&m=99461893930791&w=2 so after all that you now know that the rules you have below won't work for passive mode (which is pretty much how "modern" browsers handle ftp). in passive mode, the server advertises a tuple (IP + port) to the client, via the control connection. the client connects to the tuple on the server (the server ftpd is "passive" here, hence the term). read that again -- the client connects to the tuple advertised by the server. so the connection starts clientIP,portN --> serverIP,portM SYN the problem is that you don't know what ports N and M are ahead of time! so how to set up the firewall and the ftpd running on it? read up at the links above.
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \ port = 20 flags S keep state keep frags #ftp-data pass in quick on $IF_WAN proto tcp from any to $IP_WAN \ port = 21 flags S keep state keep frags #ftp-ctrl
telnet? really? this is asking for trouble on a firewall. stick with ssh and close up port 23 forever.
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \ port = 23 flags S keep state keep frags #telnet
more trouble. if you need name resolution for hosts that are on your LAN, outgoing port 53 with keep state is all that you need. opening DNS ports for outside access when you are not exchanging zone data can be hazardous -- BIND doesn't exactly have a pristine track record in terms of security holes. and surely sun didn't ship you the latest and safest version of BIND. close these up unless you need XFER, and if so get the latest BIND or use some of the stuff at http://cr.yp.to/djbdns.html
pass in quick on $IF_WAN proto tcp from any to $IP_WAN \
port = 53 flags S keep state keep frags #dns
pass in quick on $IF_WAN proto udp from any to $IP_WAN \
port = 53 keep state keep frags #dns
jim
