We are running IPFilter v3.3.18 under OpenBSD v2.8. These versions
are essentially locked for the time-being, since the only mass storage the
firewall has is a 64MB ATA flash card, and this is our only OpenBSD system.
(The firewall was assembled and initially configured by an outside source
largely as a turnkey system.)
The network security folks here mandate that we can't run a full-
fledged router on our network backbone, so we have to configure our firewall
via IPF's "transparent filtering." I can pretty much understand keeping state
and/or using TCP flags in the "normal" case, but I'm having trouble getting
our firewall to maintain state and properly track the TCP flags, given that
I can't use any "out" rules. Our firewall only has two Ethernet interfaces,
fxp0 (outside) and fxp1 (inside). If all I wanted to do was to make sure
that all packets were properly formatted per state (and flags in the case of
TCP) on both interfaces, I would think the following would be sufficient:
block in on fxp0
pass in quick on fxp0 proto icmp from any to <network> keep state
pass in quick on fxp0 proto tcp from any to <network> flags S keep state \
keep frags
pass in quick on fxp0 proto udp from any to <network> keep state
block in on fxp1
pass in quick on fxp1 proto icmp from <network> to any keep state
pass in quick on fxp1 proto tcp from <network> to any flags S keep state \
keep frags
pass in quick on fxp1 proto udp from <network> to any keep state
("<network>" is the CIDR specification for the protected network in question.)
By the way, can the rules be continued on multiple lines as I've done above,
or does each have to be specified on a single physical line? We have them
all as one rule per physical line, but wrapping as above would certainly be
handy.
So, would the above actually block any legitimate data? How should
the loopback interface be handled? (In particular, would a simple "pass in
quick on lo0 all" be sufficient, or should state be tracked on lo0, too?)
Thanks,
Mike
--
Michael T. Davis | Systems Specialist: ChE,MSE
E-mail: [EMAIL PROTECTED] | Departmental Networking/Computing
-or- [EMAIL PROTECTED] | The Ohio State University
http://www.er6.eng.ohio-state.edu/~davism/ | 197 Watts, (614) 292-6928
