1#!/sbin/ipf -f - 2# 3# SAMPLE: PERMISSIVE FILTER RULES 4# 5# THIS EXAMPLE IS WRITTEN FOR IP FILTER 3.3 6# 7# ppp0 - (external) PPP connection to ISP, address a.b.c.d/32 8# 9# ed0 - (internal) network interface, address w.x.y.z/32 10# 11# This file contains the basic rules needed to construct a firewall for the 12# above situation. 13# 14#------------------------------------------------------- 15# *Nasty* packets we don't want to allow near us at all! 16# short packets which are packets fragmented too short to be real. 17block in log quick all with short 18#------------------------------------------------------- 19# Group setup. 20# ============ 21# By default, block and log everything. This maybe too much logging 22# (especially for ed0) and needs to be further refined. 23# 24block in log on ppp0 all head 100 25block out log on ppp0 all head 150 26block in log on ed0 from w.x.y.z/24 to any head 200 27block out log on ed0 all head 250 28#------------------------------------------------------- 29# Invalid Internet packets. 30# ========================= 31# 32# Deny reserved addresses. 33# 34block in log quick from 10.0.0.0/8 to any group 100 35block in log quick from 192.168.0.0/16 to any group 100 36block in log quick from 172.16.0.0/12 to any group 100 37# 38# Prevent IP spoofing. 39# 40block in log quick from a.b.c.d/24 to any group 100 41# 42#------------------------------------------------------- 43# Localhost packets. 44# ================== 45# packets going in/out of network interfaces that aren't on the loopback 46# interface should *NOT* exist. 47block in log quick from 127.0.0.0/8 to any group 100 48block in log quick from any to 127.0.0.0/8 group 100 49block in log quick from 127.0.0.0/8 to any group 200 50block in log quick from any to 127.0.0.0/8 group 200 51# And of course, make sure the loopback allows packets to traverse it. 52pass in quick on lo0 all 53pass out quick on lo0 all 54#------------------------------------------------------- 55# Allow any communication between the inside network and the outside only. 56# 57# Allow all outgoing connections (SSH, TELNET, FTP, WWW, gopher, etc) 58# 59pass in log quick proto tcp all flags S/SA keep state group 200 60# 61# Support all UDP `connections' initiated from inside. 62# 63# Allow ping out 64# 65pass in log quick proto icmp all keep state group 200 66#------------------------------------------------------- 67# Log these: 68# ========== 69# * return RST packets for invalid SYN packets to help the other end close 70block return-rst in log proto tcp from any to any flags S/SA group 100 71# * return ICMP error packets for invalid UDP packets 72block return-icmp(net-unr) in proto udp all group 100 73