#!/bin/sh #### IPFW ruleset and initialization script fwcmd="/sbin/ipfw add" # Firewall add command ks="keep-state" # Bi-directional traffic between source and dest IPs # DNS servers edns=192.231.203.132 # Primary external DNS edns1=192.231.203.3 # Secondary external DNS # LAN variables (inside) iif="bge0" inet="10.0.0.0/24" imask="255.255.255.0" iip="10.0.0.1" # WAN variables (outside) oif="tun0" oip="x.x.x.x" onet="x.x.x.0" omask="255.255.255.0" # VPN variables (remote access to LAN) vif="tun1" vnet="10.0.9.0/24" vmask="255.255.255.0" vip="10.0.9.1" # delete all rules echo "Flushing all IPFW rules..." ipfw -f flush ### Inclusive allow firewall rules ## Un-restricted interfaces/networks $fwcmd allow all from any to any via $iif # Allow all packets for inside interface $fwcmd allow all from any to any via lo0 # Allow all packets for local loopback $fwcmd allow all from any to any via $vif # Allow all packets for VPN interface # check the packet against the dynamic rules table $fwcmd check-state ### Outbound # Allow out DNS lookup from Internode ISP $fwcmd allow tcp from any to $edns 53 out via $oif setup $ks # Primary $fwcmd allow udp from any to $edns 53 out via $oif $ks $fwcmd allow tcp from any to $edns1 53 out via $oif setup $ks # Secondary $fwcmd allow udp from any to $edns1 53 out via $oif $ks # Allow out non-secure and secure HTTP $fwcmd allow tcp from any to any 80,443 out via $oif setup $ks # Allow out send & get email function $fwcmd allow tcp from any to any 25 out via $oif setup $ks $fwcmd allow tcp from any to any 110 out via $oif setup $ks # Allow out FBSD (make install & CVSUP) functions # Basically give user root "GOD" privileges. $fwcmd allow tcp from me to any out via $oif setup $ks uid root # Allow out ping $fwcmd allow icmp from any to any out via $oif $ks # Allow out Time $fwcmd allow tcp from any to any 37 out via $oif setup $ks # Allow out insecure IMAP $fwcmd allow tcp from any to any 143 out via $oif setup $ks # Allow out insecure POP3 $fwcmd allow tcp from any to any 110 out via $oif setup $ks # Allow out nntp news (i.e. news groups) $fwcmd allow tcp from any to any 119 out via $oif setup $ks # Allow out secure FTP, Telnet, and SCP # This function is using SSH (secure shell) $fwcmd allow tcp from any to any 22 out via $oif setup $ks # Allow out whois $fwcmd allow tcp from any to any 43 out via $oif setup $ks # Allow out traceroute $fwcmd allow icmp from any to any icmptypes 11 out via $oif # Allow out outgoing for RDP $fwcmd allow tcp from any to any 3389 out via $oif setup $ks $fwcmd allow udp from any to any 3389 out via $oif $ks # Allow out standard IRC ports $fwcmd allow tcp from any to any 6667-7000 out via $oif setup $ks # Allow out MSN Messenger $fwcmd allow tcp from any to any 1863 out via $oif setup $ks $fwcmd allow udp from any to any 1863 out via $oif $ks $fwcmd allow tcp from any to any 6891-6900 out via $oif setup $ks $fwcmd allow udp from any to any 6891-6900 out via $oif $ks # Allow out jabber $fwcmd allow tcp from any to any 5222 out via $oif setup $ks $fwcmd allow tcp from any to any 5223 out via $oif setup $ks # Allow out ICQ $fwcmd allow tcp from any to any 5190 out via $oif setup $ks # Allow out insecure FTP $fwcmd allow tcp from any to any 21 out via $oif setup $ks $fwcmd allow tcp from any to any 20 out via $oif setup $ks $fwcmd allow tcp from any to any 49152-65535 $ks out xmit $oif # Allow all out (temporary) $fwcmd allow tcp from $inet to any out via $oif setup $ks $fwcmd allow udp from $inet to any out via $oif $ks # Deny and log everything else that is attempting to get out # This rule enforces the block all by default logic $fwcmd deny log all from any to any out via $oif ### Inbound Services ## EXPLICIT DENIES # Deny all inbound traffic from non-routable reserved address spaces $fwcmd deny all from 192.168.0.0/16 to any in via $oif #RFC 1918 private IP $fwcmd deny all from 172.16.0.0/12 to any in via $oif #RFC 1918 private IP $fwcmd deny all from 10.0.0.0/8 to any in via $oif #RFC 1918 private IP $fwcmd deny all from 127.0.0.0/8 to any in via $oif #loopback $fwcmd deny all from 0.0.0.0/8 to any in via $oif #loopback $fwcmd deny all from 169.254.0.0/16 to any in via $oif #DHCP auto-config $fwcmd deny all from 192.0.2.0/24 to any in via $oif #reserved for docs $fwcmd deny all from 204.152.64.0/23 to any in via $oif #Sun cluster interconnect $fwcmd deny all from 224.0.0.0/3 to any in via $oif #Class D & E multicast # Deny ident $fwcmd deny tcp from any to any 113 in via $oif # Deny public pings # $fwcmd deny icmp from any to any in via $oif # Deny all Netbios service. 137=name, 138=datagram, 139=session # Netbios is MS/Windows sharing services. # Block MS/Windows hosts2 name server requests 81 $fwcmd deny tcp from any to any 137 in via $oif $fwcmd deny tcp from any to any 138 in via $oif $fwcmd deny tcp from any to any 139 in via $oif $fwcmd deny tcp from any to any 81 in via $oif # Deny any late arriving packets $fwcmd deny all from any to any frag in via $oif # Deny ACK packets that did not match the dynamic rule table $fwcmd deny tcp from any to any established in via $oif ## EXCPLICIT ALLOWS # Allow in ping $fwcmd allow icmp from any to any in via $oif $ks # Allow in standard VPN port for OpenVPN $fwcmd allow udp from any to me 1194 in via $oif $ks # Allow in standard www function for Apache httpd $fwcmd allow tcp from any to me 80 in via $oif setup limit src-addr 64 # Allow in secure FTP, Telnet, and SCP from public Internet $fwcmd allow tcp from any to me 22 in via $oif setup limit src-addr 16 # Allow in RDP $fwcmd allow tcp from any to any 3389 in via $oif setup $ks $fwcmd allow udp from any to any 3389 in via $oif $ks # Allow in standard SMTP ports $fwcmd allow tcp from any to me 25 in via $oif setup limit src-addr 8 $fwcmd allow tcp from any to me 587 in via $oif setup limit src-addr 8 # Allow in secure IMAPS $fwcmd allow tcp from any to me 993 in via $oif setup $ks # Allow in insecure POP $fwcmd allow tcp from any to me 110 in via $oif setup limit src-addr 4 # Allow in insecure IMAP $fwcmd allow tcp from any to me 143 in via $oif setup limit src-addr 16 # Allow in jabber from public Internet $fwcmd allow tcp from any to me 5222 in via $oif setup $ks $fwcmd allow tcp from any to me 5223 in via $oif setup $ks $fwcmd allow tcp from any to me 5269 in via $oif setup $ks # Allow in NTP from public Internet $fwcmd allow udp from any to any 123 in via $oif # Allow in Bit Torrent $fwcmd allow log tcp from any to $inet 44000-44100 in via $oif setup $ks $fwcmd allow udp from any to $inet 44000-44100 in via $oif $ks # Allow in VNC and divert to ionataeus #$fwcmd fwd 192.168.0.99,5900 tcp from any to any dst-port 5900 # -- ### Everything else is denied by default # Reject & Log all incoming connections from the outside that have no rule-match $fwcmd deny log all from any to any in via $oif # deny and log all packets that fell through to see what they are $fwcmd deny log all from any to any