Hi! On Sun, 09 Feb 2003 14:21:32 -0500 (EST) "Michael T. Davis" <[EMAIL PROTECTED]> wrote:
> I can pretty much > understand keeping state and/or using TCP flags in the "normal" case, > but I'm having trouble getting our firewall to maintain state and > properly track the TCP flags, given that I can't use any "out" rules. Why can't you use and out rules? I've created a similar system for a small non-profit ISP on FreeBSD (see http://www.raisdorf.net/publications/bridge) and it worked well. > Our firewall only has two Ethernet interfaces, fxp0 (outside) and fxp1 > (inside). If all I wanted to do was to make sure that all packets > were properly formatted per state (and flags in the case of TCP) on > both interfaces, I would think the following would be sufficient: > > block in on fxp0 > pass in quick on fxp0 proto icmp from any to <network> keep state > pass in quick on fxp0 proto tcp from any to <network> flags S keep > state \ > keep frags > pass in quick on fxp0 proto udp from any to <network> keep state > > block in on fxp1 > pass in quick on fxp1 proto icmp from <network> to any keep state > pass in quick on fxp1 proto tcp from <network> to any flags S keep > state \ > keep frags > pass in quick on fxp1 proto udp from <network> to any keep state This looks like overkill to me. > So, would the above actually block any legitimate data? How > should > the loopback interface be handled? (In particular, would a simple > "pass in quick on lo0 all" be sufficient, or should state be tracked > on lo0, too?) I hope you have a third nic in the box for management. You can allow incoming ssh traffic on the internal interface but I prefer not assigning an IP to the bridging interfaces. # nice default block in all block out all # no restrictions on loopback pass in quick on lo0 pass out quick on lo0 # ssh on management interface pass in quick on fxp2 from somehost to firewall port 22 flags S/SA keep state # "allow" all traffic on local side of the bridge pass in quick on fxp1 pass out quick on fxp1 # now here we filter just like on a "normal" external interface pass in quick on fxp0 from foo to bla port 80 flags S/SA keep state # add all your rules here pass out quick on fxp0 proto from localnet to any flags S/SA keep state # default block ... I hops this helps, Hendrik -- Hendrik Scholz - <[EMAIL PROTECTED]> - http://raisdorf.net/ drag me, drop me - treat me like an object
