The following is my commented ipf.conf... There are 3 questions following it.
--------- begin ipf.conf --------------- # Block the subnet that seems to be routed through me eroneously block in quick on pppoe0 from any to 206.208.54.0/24 [comment, I logged these a little while, but @10,000/hour I decided to just dump them and ask my ISP if they can stop routing these.] # Block any packets that are not heading to my IP block in log quick on pppoe0 from any to !65.196.my.ip/32 head 11 #Unless they are destined for my NAT'd subnet pass in on pppoe0 from any to 192.168.1.0/24 group 11 # Block all dangerous/malformed packets (both interfaces) block in log quick from any to any with ipopts block in log quick proto tcp from any to any with short # Block inbound packets from unroutables (from internet) block in quick on pppoe0 from 192.168.0.0/16 to any block in quick on pppoe0 from 172.16.0.0/12 to any block in quick on pppoe0 from 10.0.0.0/8 to any block in quick on pppoe0 from 127.0.0.0/8 to any block in quick on pppoe0 from 0.0.0.0/8 to any block in quick on pppoe0 from 169.254.0.0/16 to any block in quick on pppoe0 from 192.0.2.0/24 to any block in quick on pppoe0 from 204.152.64.0/23 to any block in quick on pppoe0 from 224.0.0.0/3 to any # Block outbound packets to unroutables (to internet) block out quick on pppoe0 from any to 192.168.0.0/16 block out quick on pppoe0 from any to 172.16.0.0/12 block out quick on pppoe0 from any to 10.0.0.0/8 block out quick on pppoe0 from any to 127.0.0.0/8 block out quick on pppoe0 from any to 0.0.0.0/8 block out quick on pppoe0 from any to 169.254.0.0/16 block out quick on pppoe0 from any to 192.0.2.0/24 block out quick on pppoe0 from any to 204.152.64.0/23 block out quick on pppoe0 from any to 224.0.0.0/3 # Block any packets that are not from my IP (to internet) block out log quick on pppoe0 from !65.196.my.ip/32 to any head 12 #Unless they are from my NAT'd subnet pass out on pppoe0 from 192.168.1.0/24 to any group 12 # Block any in/out-bound netbios packets from/to the internet block out log quick on pppoe0 proto tcp/udp from any to any port = 137 block in log quick on pppoe0 proto tcp/udp from any to any port = 137 # Output packets get passed immediate with keep state (both interfaces) # BAD_SUBNETS check occurs on way INTO my router box only pass out quick proto tcp from any to any flags S keep state pass out quick proto udp from any to any keep state pass out quick proto icmp from any to any keep state # All packets from my subnet better appear to be FROM my subnet # if not true at my internal interface - stop them and tell me block in log quick on rtk1 proto tcp/udp from !192.168.1.0/24 to any block in log quick on rtk1 proto icmp from !192.168.1.0/24 to any #### Default inbound pass stance prior to block list checks #### # Assume an accept stance for any general traffic # # (Though we will further check against block lists) # ################################################################ pass in proto tcp/udp from any to any pass in proto icmp from any to any ------------- end ipf.conf ---------------- Questions: 1) Does my strategy seem sound? 2) Am I leaving anything critical out? This is a simple server (small website, plus I telnet/ftp in sometimes) and it deals with a couple small servers behind it on the NAT'd subnet. 3) Is there any way to block a packet to or from a subnet in one rule? block in log quick on pppoe0 to/from 192.168.0.0/16 if I could do something like that I could halve my unroutables rules. Thanks, gene
