[Midnightbsd-cvs] src [11774] trunk/etc/rc.firewall: fix some typos and change how we handle rfc 1918 nets on the outside
laffer1 at midnightbsd.org
laffer1 at midnightbsd.org
Wed Jul 11 12:44:05 EDT 2018
Revision: 11774
http://svnweb.midnightbsd.org/src/?rev=11774
Author: laffer1
Date: 2018-07-11 12:44:03 -0400 (Wed, 11 Jul 2018)
Log Message:
-----------
fix some typos and change how we handle rfc 1918 nets on the outside
Modified Paths:
--------------
trunk/etc/rc.firewall
Property Changed:
----------------
trunk/etc/rc.firewall
Modified: trunk/etc/rc.firewall
===================================================================
--- trunk/etc/rc.firewall 2018-07-11 16:33:02 UTC (rev 11773)
+++ trunk/etc/rc.firewall 2018-07-11 16:44:03 UTC (rev 11774)
@@ -23,7 +23,7 @@
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#
-# $MidnightBSD: src/etc/rc.firewall,v 1.7 2010/09/10 18:33:45 laffer1 Exp $
+# $MidnightBSD$
# $FreeBSD: src/etc/rc.firewall,v 1.47.10.1 2005/11/19 06:06:59 ume Exp $
#
@@ -48,8 +48,8 @@
# client - will try to protect just this machine
# simple - will try to protect a whole network
# closed - totally disables IP services except via lo0 interface
-# workstation - will try to protect just this machine using statefull
-# firewalling. See below for rc.conf variables used
+# workstation - will try to protect just this machine using stateful
+# firewalling. See below for rc.conf variables used
# UNKNOWN - disables the loading of firewall rules.
# filename - will load the rules in the given filename (full path required)
#
@@ -80,7 +80,7 @@
# http://www.pearsonhighered.com/educator/academic/product/0,3110,020163466X,00.html
#
-setup_loopback () {
+setup_loopback() {
############
# Only in rare cases do you want to change these rules
#
@@ -93,7 +93,7 @@
fi
}
-setup_ipv6_mandatory () {
+setup_ipv6_mandatory() {
[ $ipv6_available -eq 0 ] || return 0
############
@@ -107,7 +107,7 @@
${fwcmd} add pass ipv6-icmp from fe80::/10 to fe80::/10
${fwcmd} add pass ipv6-icmp from fe80::/10 to ff02::/16
- # Allow ICMPv6 destination unreach
+ # Allow ICMPv6 destination unreachable
${fwcmd} add pass ipv6-icmp from any to any icmp6types 1
# Allow NS/NA/toobig (don't filter it out)
@@ -304,6 +304,7 @@
# firewall_simple_oif_ipv6: Outside IPv6 network interface.
# firewall_simple_onet_ipv6: Outside IPv6 network prefix.
############
+ BAD_ADDR_TBL=13
# set these to your outside interface network
oif="$firewall_simple_oif"
@@ -328,20 +329,24 @@
fi
fi
+ # Define stuff we should never send out or receive in.
# Stop RFC1918 nets on the outside interface
- ${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
- ${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
- ${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
+ ${fwcmd} table ${BAD_ADDR_TBL} flush
+ ${fwcmd} table ${BAD_ADDR_TBL} add 10.0.0.0/8
+ ${fwcmd} table ${BAD_ADDR_TBL} add 172.16.0.0/12
+ ${fwcmd} table ${BAD_ADDR_TBL} add 192.168.0.0/16
- # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
+ # And stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
- ${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
- ${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
- ${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
- ${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
- ${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
+ ${fwcmd} table ${BAD_ADDR_TBL} add 0.0.0.0/8
+ ${fwcmd} table ${BAD_ADDR_TBL} add 169.254.0.0/16
+ ${fwcmd} table ${BAD_ADDR_TBL} add 192.0.2.0/24
+ ${fwcmd} table ${BAD_ADDR_TBL} add 224.0.0.0/4
+ ${fwcmd} table ${BAD_ADDR_TBL} add 240.0.0.0/4
+ ${fwcmd} add deny all from any to "table($BAD_ADDR_TBL)" via ${oif}
+
# Network Address Translation. This rule is placed here deliberately
# so that it does not interfere with the surrounding address-checking
# rules. If for example one of your internal LAN machines had its IP
@@ -357,20 +362,7 @@
;;
esac
- # Stop RFC1918 nets on the outside interface
- ${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
- ${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
- ${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}
-
- # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
- # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
- # on the outside interface
- ${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
- ${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
- ${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
- ${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
- ${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}
-
+ ${fwcmd} add deny all from "table($BAD_ADDR_TBL)" to any via ${oif}
if [ -n "$inet6" ]; then
# Stop unique local unicast address on the outside interface
${fwcmd} add deny all from fc00::/7 to any via ${oif6}
@@ -460,8 +452,8 @@
[Ww][Oo][Rr][Kk][Ss][Tt][Aa][Tt][Ii][Oo][Nn])
# Configuration:
- # firewall_myservices: List of TCP ports on which this host
- # offers services.
+ # firewall_myservices: List of ports/protocols on which this
+ # host offers services.
# firewall_allowservices: List of IPv4 and/or IPv6 addresses
# that have access to
# $firewall_myservices.
@@ -475,7 +467,7 @@
# default denied packets should be
# logged (in /var/log/security).
# firewall_nologports: List of TCP/UDP ports for which
- # denied incomming packets are not
+ # denied incoming packets are not
# logged.
# Allow packets for which a state has been built.
@@ -525,7 +517,25 @@
#
for i in ${firewall_allowservices} ; do
for j in ${firewall_myservices} ; do
- ${fwcmd} add pass tcp from $i to me $j
+ case $j in
+ [0-9A-Za-z]*/[Pp][Rr][Oo][Tt][Oo])
+ ${fwcmd} add pass ${j%/[Pp][Rr][Oo][Tt][Oo]} from $i to me
+ ;;
+ [0-9A-Za-z]*/[Tt][Cc][Pp])
+ ${fwcmd} add pass tcp from $i to me ${j%/[Tt][Cc][Pp]}
+ ;;
+ [0-9A-Za-z]*/[Uu][Dd][Pp])
+ ${fwcmd} add pass udp from $i to me ${j%/[Uu][Dd][Pp]}
+ ;;
+ *[0-9A-Za-z])
+ echo "Consider using ${j}/tcp in firewall_myservices." \
+ > /dev/stderr
+ ${fwcmd} add pass tcp from $i to me $j
+ ;;
+ *)
+ echo "Invalid port in firewall_myservices: $j" > /dev/stderr
+ ;;
+ esac
done
done
@@ -543,7 +553,7 @@
${fwcmd} add deny { tcp or udp } from any to any $i in
done
- # Broadcasts and muticasts
+ # Broadcasts and multicasts
${fwcmd} add deny ip from any to 255.255.255.255
${fwcmd} add deny ip from any to 224.0.0.0/24 in # XXX
@@ -551,7 +561,7 @@
${fwcmd} add deny udp from any to any 520 in
# Noise from webbrowsing.
- # The statefull filter is a bit agressive, and will cause some
+ # The stateful filter is a bit aggressive, and will cause some
# connection teardowns to be logged.
${fwcmd} add deny tcp from any 80,443 to any 1024-65535 in
Property changes on: trunk/etc/rc.firewall
___________________________________________________________________
Added: svn:keywords
## -0,0 +1 ##
+MidnightBSD=%H
\ No newline at end of property
More information about the Midnightbsd-cvs
mailing list