1*7c478bd9Sstevel@tonic-gate#!/sbin/ipf -f - 2*7c478bd9Sstevel@tonic-gate# 3*7c478bd9Sstevel@tonic-gate# SAMPLE: PERMISSIVE FILTER RULES 4*7c478bd9Sstevel@tonic-gate# 5*7c478bd9Sstevel@tonic-gate# THIS EXAMPLE IS WRITTEN FOR IP FILTER 3.3 6*7c478bd9Sstevel@tonic-gate# 7*7c478bd9Sstevel@tonic-gate# ppp0 - (external) PPP connection to ISP, address a.b.c.d/32 8*7c478bd9Sstevel@tonic-gate# 9*7c478bd9Sstevel@tonic-gate# ed0 - (internal) network interface, address w.x.y.z/32 10*7c478bd9Sstevel@tonic-gate# 11*7c478bd9Sstevel@tonic-gate# This file contains the basic rules needed to construct a firewall for the 12*7c478bd9Sstevel@tonic-gate# above situation. 13*7c478bd9Sstevel@tonic-gate# 14*7c478bd9Sstevel@tonic-gate#------------------------------------------------------- 15*7c478bd9Sstevel@tonic-gate# *Nasty* packets we don't want to allow near us at all! 16*7c478bd9Sstevel@tonic-gate# short packets which are packets fragmented too short to be real. 17*7c478bd9Sstevel@tonic-gateblock in log quick all with short 18*7c478bd9Sstevel@tonic-gate#------------------------------------------------------- 19*7c478bd9Sstevel@tonic-gate# Group setup. 20*7c478bd9Sstevel@tonic-gate# ============ 21*7c478bd9Sstevel@tonic-gate# By default, block and log everything. This maybe too much logging 22*7c478bd9Sstevel@tonic-gate# (especially for ed0) and needs to be further refined. 23*7c478bd9Sstevel@tonic-gate# 24*7c478bd9Sstevel@tonic-gateblock in log on ppp0 all head 100 25*7c478bd9Sstevel@tonic-gateblock out log on ppp0 all head 150 26*7c478bd9Sstevel@tonic-gateblock in log on ed0 from w.x.y.z/24 to any head 200 27*7c478bd9Sstevel@tonic-gateblock out log on ed0 all head 250 28*7c478bd9Sstevel@tonic-gate#------------------------------------------------------- 29*7c478bd9Sstevel@tonic-gate# Invalid Internet packets. 30*7c478bd9Sstevel@tonic-gate# ========================= 31*7c478bd9Sstevel@tonic-gate# 32*7c478bd9Sstevel@tonic-gate# Deny reserved addresses. 33*7c478bd9Sstevel@tonic-gate# 34*7c478bd9Sstevel@tonic-gateblock in log quick from 10.0.0.0/8 to any group 100 35*7c478bd9Sstevel@tonic-gateblock in log quick from 192.168.0.0/16 to any group 100 36*7c478bd9Sstevel@tonic-gateblock in log quick from 172.16.0.0/12 to any group 100 37*7c478bd9Sstevel@tonic-gate# 38*7c478bd9Sstevel@tonic-gate# Prevent IP spoofing. 39*7c478bd9Sstevel@tonic-gate# 40*7c478bd9Sstevel@tonic-gateblock in log quick from a.b.c.d/24 to any group 100 41*7c478bd9Sstevel@tonic-gate# 42*7c478bd9Sstevel@tonic-gate#------------------------------------------------------- 43*7c478bd9Sstevel@tonic-gate# Localhost packets. 44*7c478bd9Sstevel@tonic-gate# ================== 45*7c478bd9Sstevel@tonic-gate# packets going in/out of network interfaces that aren't on the loopback 46*7c478bd9Sstevel@tonic-gate# interface should *NOT* exist. 47*7c478bd9Sstevel@tonic-gateblock in log quick from 127.0.0.0/8 to any group 100 48*7c478bd9Sstevel@tonic-gateblock in log quick from any to 127.0.0.0/8 group 100 49*7c478bd9Sstevel@tonic-gateblock in log quick from 127.0.0.0/8 to any group 200 50*7c478bd9Sstevel@tonic-gateblock in log quick from any to 127.0.0.0/8 group 200 51*7c478bd9Sstevel@tonic-gate# And of course, make sure the loopback allows packets to traverse it. 52*7c478bd9Sstevel@tonic-gatepass in quick on lo0 all 53*7c478bd9Sstevel@tonic-gatepass out quick on lo0 all 54*7c478bd9Sstevel@tonic-gate#------------------------------------------------------- 55*7c478bd9Sstevel@tonic-gate# Allow any communication between the inside network and the outside only. 56*7c478bd9Sstevel@tonic-gate# 57*7c478bd9Sstevel@tonic-gate# Allow all outgoing connections (SSH, TELNET, FTP, WWW, gopher, etc) 58*7c478bd9Sstevel@tonic-gate# 59*7c478bd9Sstevel@tonic-gatepass in log quick proto tcp all flags S/SA keep state group 200 60*7c478bd9Sstevel@tonic-gate# 61*7c478bd9Sstevel@tonic-gate# Support all UDP `connections' initiated from inside. 62*7c478bd9Sstevel@tonic-gate# 63*7c478bd9Sstevel@tonic-gate# Allow ping out 64*7c478bd9Sstevel@tonic-gate# 65*7c478bd9Sstevel@tonic-gatepass in log quick proto icmp all keep state group 200 66*7c478bd9Sstevel@tonic-gate#------------------------------------------------------- 67*7c478bd9Sstevel@tonic-gate# Log these: 68*7c478bd9Sstevel@tonic-gate# ========== 69*7c478bd9Sstevel@tonic-gate# * return RST packets for invalid SYN packets to help the other end close 70*7c478bd9Sstevel@tonic-gateblock return-rst in log proto tcp from any to any flags S/SA group 100 71*7c478bd9Sstevel@tonic-gate# * return ICMP error packets for invalid UDP packets 72*7c478bd9Sstevel@tonic-gateblock return-icmp(net-unr) in proto udp all group 100 73