IPFW Intranet server: opinion on rules for ipfw

smarcell

smarcell

Hello, I would like the opinion (and if possible tips) of the most knowledgeable staff in ipfw, about my rules below.

Bash: 
#!/bin/sh
# IPFW: rules for a Intranet server
PATH='/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin'

# Running services
tcp_services='22,80,443'

# Trusted LAN
trusted_lan='192.168.64.0/24,192.168.128.0/24'

# Flushing rules
ipfw -q -f flush

# Loopback
ipfw -q add allow via lo0
ipfw -q add deny { dst-ip 127.0.0.0/8 or src-ip 127.0.0.0/8 }

# Broadcast/multicast undesirable
ipfw -q add deny ip from any to 255.255.255.255
ipfw -q add deny ip from any to 224.0.0.0/24 in

# Blocking suspicious packets
ipfw -q add deny all from any to me in frag
ipfw -q add deny all from any to me not verrevpath in
ipfw -q add deny tcp from any to me tcpflags fin,urg,psh in
ipfw -q add deny tcp from any to me tcpflags !fin,!syn,!ack,!urg,!psh,!rst in
ipfw -q add deny tcp from any to me tcpflags syn,fin,rst,ack in
ipfw -q add deny tcp from any to me tcpflags fin,!syn,!rst,!ack in
ipfw -q add deny tcp from any to me tcpflags syn,fin,!rst,!ack in
ipfw -q add deny tcp from any to me tcpflags urg,!syn,!fin,!rst,!ack in
ipfw -q add deny tcp from any to me tcpoptions !mss tcpflags syn,!ack in

# Packets reass
ipfw -q add reass all from any to me in

# Sstateful firewall
ipfw -q add check-state

# Allow access only to trusted networks
ipfw -q add allow tcp from $trusted_lan to me dst-port $tcp_services in setup keep-state

# Ping
ipfw -q add allow icmp from any to me in

# Outgoing packets
ipfw -q add allow tcp from me to any out setup keep-state
ipfw -q add allow { udp or icmp } from me to any out keep-state

* Sorry for bad English
 
Decide You want to block the fragments or try to reassemble them.
Don't block tcpflags you need them. IPFW is stateful firewall and any connections that doesn't have state in dynamic state table will reach your default rule 65535 which by default is deny. So there's no need to explicitly block the tcp packets based on they flag.
 
You could just use the pre-configured workstation firewall with
Code: 
firewall_myservices="22/tcp 80/tcp 443/tcp"
firewall_allowservices="192.168.64.0/24 192.168.128.0/24"
Look in /etc/rc.firewall. If it does not 100% fit your needs, copy&paste the workstation section, rename it (e.g. "srvhost"->/etc/rc.srvhost) and adjust. E.g. the workstation rules allow DHCP (as client), which you might do not want to allow.
 
You must log in or register to reply here.
Back
Top