Solved FreeBSD is always adding unwanted (allow) rule at the end of IPFW script.

Hello guys,

My IPFW rule:
Code:
#!/bin/sh
# ipfw config/rules
# from FBSD Handbook, rc.firewall, et. al.

# Flush all rules before we begin.
ipfw -q -f flush
# Set rules command prefix
cmd="ipfw -q add "
vif="em0"
# allow all for localhost

$cmd 00010 allow ip from any to any via lo0

$cmd 0050 reass all from any to any in
$cmd 0060 check-state

### SSH:
$cmd 00106 allow tcp from any to any dst-port 22 in via $vif setup keep-state
$cmd 00107 allow tcp from any to any dst-port 22 out via $vif setup keep-state

### DNS:
$cmd 00108 allow tcp from any to me dst-port 53 in via $vif setup keep-state
$cmd 00110 allow tcp from me to any dst-port 53 out via $vif setup keep-state
$cmd 00111 allow udp from any to any dst-port 53 via $vif keep-state

# allow HTTP HTTPS replies
$cmd 00400 allow tcp from any to any dst-port 80 in via $vif setup limit src-addr 5
$cmd 00410 allow tcp from any to any dst-port 443 in via $vif setup limit src-addr 5
$cmd 00200 allow tcp from any to any dst-port 80 out via $vif setup keep-state
$cmd 00220 allow tcp from any to any dst-port 443 out via $vif setup keep-state

# allow icmp re: ping, et. al.
# comment this out to disable ping, et.al.
#$cmd 00250 allow icmp from any to any out via $vif keep-state

# alllow timeserver out
#$cmd 00260 allow tcp from any to any dst-port 37 out via $vif setup keep-state

# allow ntp out
#$cmd 00270 allow udp from any to any dst-port 123 out via $vif keep-state

# otherwise deny outbound packets
# outbound catchall.
#$cmd 00299 deny log ip from any to any out via $vif

# inbound rules
# deny inbound traffic to restricted addresses
$cmd 00300 deny ip from 192.168.0.0/16 to any in via $vif
$cmd 00301 deny ip from 172.16.0.0/12 to any in via $vif
$cmd 00302 deny ip from 10.0.0.0/8 to any in via $vif
$cmd 00303 deny ip from 127.0.0.0/8 to any in via $vif
$cmd 00304 deny ip from 0.0.0.0/8 to any in via $vif
$cmd 00305 deny ip from 169.254.0.0/16 to any in via $vif
$cmd 00306 deny ip from 192.0.2.0/24 to any in via $vif
$cmd 00307 deny ip from 204.152.64.0/23 to any in via $vif
$cmd 00308 deny ip from 224.0.0.0/3 to any in via $vif

# deny inbound packets on these ports
# auth 113, netbios (services) 137/138/139, hosts-nameserver 81
$cmd 00315 deny tcp from any to any dst-port 113 in via $vif
$cmd 00320 deny tcp from any to any dst-port 137 in via $vif
$cmd 00321 deny tcp from any to any dst-port 138 in via $vif
$cmd 00322 deny tcp from any to any dst-port 139 in via $vif
$cmd 00323 deny tcp from any to any dst-port 81 in via $vif

# deny partial packets
$cmd 00330 deny ip from any to any frag in via $vif
$cmd 00332 deny tcp from any to any established in via $vif

# deny everything else, and log it
# inbound catchall
$cmd 55000 deny all from 'table(22)' to any
$cmd 56599 deny log ip from any to any in via $vif

IPFW is always adding at the end of scrip rule [B]65535 allow ip from any to any[/B]
Code:
root@BSD:/home/bryn1u # ipfw list | tail
00410 allow tcp from any to any 443 in via em0 setup limit src-addr 5 :default
00600 deny log logamount 50 ip from any to any ipoptions rr
00610 deny log logamount 50 ip from any to any ipoptions ts
00620 deny log logamount 50 ip from any to any ipoptions lsrr
00630 deny log logamount 50 ip from any to any ipoptions ssrr
00640 deny log logamount 50 tcp from any to any tcpflags syn,fin
00650 deny log logamount 50 tcp from any to any tcpflags syn,rst
55000 deny ip from table(22) to any
56599 deny log logamount 5 ip from any to any in via em0
65535 allow ip from any to any

I can't even remove it manually:
Code:
root@BSD:/home/bryn1u # ipfw delete 65535
ipfw: rule 65535 not found

rc.conf
Code:
### IPFW
firewall_enable="YES"
firewall_script="/etc/ipfw.conf"
firewall_logging="YES"

Where is the problem ?
Thank you,
 
There is no problem:
Code:
     A ruleset always includes a default rule (numbered 65535) which cannot be
     modified or deleted, and matches all packets.  The action associated with
     the default rule can be either deny or allow depending on how the kernel
     is configured.
From ipfw(8).
 
Back
Top