IPFW Firewall

Installeren

Eerst moet er bij de sysinstall twee programma’s geïnstalleerd worden.

/usr/sbin/sysinstall

Kies het volgende: Configure, dan Distributions, dan src, dan base en sys en dan “ok”

Configuratie

Commando om de firewall (IPFW) aan te zetten:

kldload -v ipfw.ko

Firewall automatisch bij het opstarten aanzetten:

# ee /etc/rc.conf

firewall_enable="YES"
firewall_type="open"

IPFW configuratie file aanpassen: /etc/ipfw.rules

################ Start of IPFW rules file ###############################
# Flush out the list before we begin.
ipfw -q -f flush

# Set rules command prefix
cmd="ipfw -q add"
pif="em0"     # interface name of NIC attached to Internet

# Change xl0 to LAN NIC interface name
$cmd 00005 allow all from any to any via xl0

# No restrictions on Loopback Interface
$cmd 00010 allow all from any to any via lo0

# Allo if it matches an existing entry in the dynamic rules table
$cmd 00101 check-state

#loopback
$cmd 00010 allow all from any to any via lo0
$cmd 00011 deny ip from any to 127.0.0.0/8
$cmd 00012 deny ip from 127.0.0.0/8 to any

# ISP DNS
# Replace x.x.x.x with the IP address of a public DNS server
# and repeat for each DNS server in /etc/resolv.conf
$cmd 00020 allow tcp from any to 80.84.224.249 53 out via $pif setup keep-state
$cmd 00021 allow udp from any to 80.84.224.249 53 out via $pif keep-state
$cmd 00022 allow tcp from any to 80.84.224.26 53 out via $pif setup keep-state
$cmd 00023 allow udp from any to 80.84.224.26 53 out via $pif keep-state
$cmd 00024 allow tcp from any to 83.96.192.26 53 out via $pif setup keep-state
$cmd 00025 allow udp from any to 83.96.192.26 53 out via $pif keep-state

# FTP-DATA
$cmd 00040 allow tcp from any to any 20 in via $pif
$cmd 00041 allow tcp from any to any 20 out via $pif

# FTP
$cmd 00040 allow tcp from any to any 21 in via $pif
$cmd 00041 allow tcp from any to any 21 out via $pif

# SSH
$cmd 00030 allow tcp from any to any 22 in via $pif setup keep-state
$cmd 00031 allow tcp from any to any 22 out via $pif setup keep-state

# WWW
$cmd 00040 allow tcp from any to any 80 in via $pif
$cmd 00041 allow tcp from any to any 80 out via $pif

# HTTPS
$cmd 00050 allow tcp from any to any 443 in via $pif setup keep-state
$cmd 00051 allow tcp from any to any 443 out via $pif setup keep-state

# PLESK
$cmd 00060 allow tcp from any to any 8443 in via $pif setup keep-state
$cmd 00061 allow tcp from any to any 8443 out via $pif setup keep-state

# POPPASSD (Plesk)
$cmd 00060 allow tcp from 127.0.0.0/8 to any 106 in via $pif setup keep-state
$cmd 00061 allow tcp from 127.0.0.0/8 to any 106 out via $pif setup keep-state
$cmd 00060 allow udp from 127.0.0.0/8 to any 106 in via $pif setup keep-state
$cmd 00061 allow udp from 127.0.0.0/8 to any 106 out via $pif setup keep-state

# AUTH (Plesk)
$cmd 00041 allow tcp from any to any 113 out via $pif

# SMTPS (Plesk)
$cmd 00070 allow tcp from any to any 465 in via $pif setup keep-state
$cmd 00071 allow tcp from any to any 465 out via $pif setup keep-state
$cmd 00072 allow udp from any to any 465 in via $pif setup keep-state
$cmd 00073 allow udp from any to any 465 out via $pif setup keep-state

# FTPS (Plesk)
$cmd 00070 allow tcp from any to any 990 in via $pif setup keep-state
$cmd 00071 allow tcp from any to any 990 out via $pif setup keep-state
$cmd 00072 allow udp from any to any 990 in via $pif setup keep-state
$cmd 00073 allow udp from any to any 990 out via $pif setup keep-state

# plesk-license-update 
$cmd 00071 allow tcp from any to any 5224 out via $pif setup keep-state
$cmd 00073 allow udp from any to any 5224 out via $pif setup keep-state

# SEND & GET EMAIL
$cmd 00070 allow tcp from any to any 25 in via $pif setup keep-state
$cmd 00071 allow tcp from any to any 25 out via $pif setup keep-state
$cmd 00072 allow tcp from any to any 110 in via $pif setup keep-state
$cmd 00073 allow tcp from any to any 110 out via $pif setup keep-state
$cmd 00074 allow tcp from any to any 143 in via $pif setup keep-state
$cmd 00075 allow tcp from any to any 143 out via $pif setup keep-state
$cmd 00076 allow tcp from any to any 993 in via $pif setup keep-state
$cmd 00077 allow tcp from any to any 993 out via $pif setup keep-state
$cmd 00078 allow tcp from any to any 995 in via $pif setup keep-state
$cmd 00079 allow tcp from any to any 995 out via $pif setup keep-state

# PING
$cmd 00080 allow icmp from any to any in via $pif setup keep-state
$cmd 00081 allow icmp from any to any out via $pif setup keep-state

# TIME
$cmd 00090 allow tcp from any to any 37 out via $pif setup keep-state

# NTP
$cmd 00100 allow udp from any to any 123 out via $pif setup keep-state

# NNTP NEWS (i.e. news groups)
$cmd 00110 allow tcp from any to any 119 in via $pif setup keep-state
$cmd 00111 allow tcp from any to any 119 out via $pif setup keep-state

# WHOIS
$cmd 00120 allow tcp from any to any 43 in via $pif setup keep-state
$cmd 00121 allow tcp from any to any 43 out via $pif setup keep-state

# FBSD (make install & CVSUP)
$cmd 00130 allow tcp from any to any out via $pif setup keep-state uid root

# Deny all Netbios service
$cmd 00140 deny tcp from any to any 137 in via $pif
$cmd 00141 deny tcp from any to any 138 in via $pif
$cmd 00142 deny tcp from any to any 139 in via $pif
$cmd 00143 deny tcp from any to any 81 in via $pif

# MYSQL
$cmd 00120 allow tcp from any to any 3306 in via $pif setup keep-state
$cmd 00121 allow udp from any to any 3306 in via $pif setup keep-state

# PostgreSQL
$cmd 00120 allow tcp from any to any 5432 in via $pif setup keep-state

# TOMCAT
$cmd 00120 allow tcp from any to any 8080 in via $pif setup keep-state

# Coyote and Warp (Tomcat Java) connectors in Plesk 
$cmd 00120 allow tcp from any to any 9080 in via $pif setup keep-state
$cmd 00120 allow tcp from any to any 9008 in via $pif setup keep-state

$cmd 00150 deny log ip from any to any

De nieuwe firewall regels inladen:

# sh /etc/ipfw.rules

/etc/ipfw.rules.jdn

In /etc/sysctl.conf kan een instelling gemaakt worden waardoor loggen na volgende herstarts wordt ingeschakeld:

net.inet.ip.fw.verbose_limit=5

Je kunt controleren of de instellingen verwerkt zijn:

# ipfw -t list

Links

• Zie ook: IPFW (Freebsd handboek)