On Mon, 2 Dec 2002, Steve Shorter wrote: > On Mon, Dec 02, 2002 at 01:11:54PM -0300, Alejandro Valdez wrote: > > Hello, > > > > After many hours of reading and trying I think I produced a good ruleset, > > has anyone any suggestion about it? or something I'm missing? or not > > taking log from something important? or taking too much log?. > > > > The propouse is to close the WAN interface of my server, hide the firewall > > and log posibly scans from the outside. > > If this is ok, my next step is to close the LAN interface. > > > > Thanks in advance. > > If you are worried about efficiency you probably want > to use groups to minimize rule checking. I prefer to group > according to interface. However if you arn't processing lots > of connections through the firewall it probably doesn't matter much. > > > > > #!/bin/bash > > > > # IP_WAN: WAN interface ip. > > # IP_WBRD: WAN interface broadcast ip. > > # IP_WNET: WAN interface net ip. > > # IF_WAN: WAN interface name. > > > > export IP_WAN="x.x.x.x/32" > > export IP_WBRD="y.y.y.255/32" > > export IP_WNET="q.q.q.0/32" > > Hmm, should this be be q.q.q.0/xx where xx != 32 ?? > > > export IF_WAN="net1" > > > > /etc/ipf -Fa > > /etc/ipf -FS > > /etc/ipf -f - << EOF > > > > #cat << EOF > > > > #block all > > block in log on $IF_WAN all > > > > block return-rst in log on $IF_WAN proto tcp all flags S > > > > block return-icmp(port-unr) in log on $IF_WAN proto udp all > > > > block in log quick on $IF_WAN proto tcp all with short > > Why limit this to "proto tcp" ?
OK. > Some people also like to block "proto icmp all with frag" This mean block all the icmp packets that have been fragmented?. Why should the firewall drop that packets?. > > #rules for outgoing packets. > > #proto 47 is GRE (i use pptp in my lan, but in a near future I'll put > > #a dedicated machine for that propouse) > > pass out quick on $IF_WAN proto tcp from any to any keep state > > pass out quick on $IF_WAN proto udp from any to any keep state > > pass out quick on $IF_WAN proto icmp from any to any keep state > > pass out quick on $IF_WAN proto 47 from any to any #gre > > block out log on $IF_WAN all > > > > I don't like the above. Its not needed and too promiscuous. > > I like to keep state only on the interface going in, except > for stuff that originates from the firewall like logging etc. > > > #rules for my LAN interface > > #(none by the way) > > Keep state here for outgoing connections, and use groups > based on interface to improve/eliminate rule checking. I din't say it, but the firewall is also doing NAT for the LAN machines. Outgoing connections for the firewall are of two kind: 1) Initiated in the firewall (for example, an outgoing ssh from the firewall to an internet host). 2) Initiated at the LAN from a private network (192.168.x.x). Should I keep state for the outgogin LAN connections in the LAN interface and not in the WAN interface?. Why should I do that?
