xref: /titanic_52/usr/src/cmd/ipf/examples/BASIC_2.FW (revision 7c478bd95313f5f23a4c958a745db2134aa03244)
1*7c478bd9Sstevel@tonic-gate#!/sbin/ipf -f -
2*7c478bd9Sstevel@tonic-gate#
3*7c478bd9Sstevel@tonic-gate# SAMPLE: PERMISSIVE FILTER RULES
4*7c478bd9Sstevel@tonic-gate#
5*7c478bd9Sstevel@tonic-gate# THIS EXAMPLE IS WRITTEN FOR IP FILTER 3.3
6*7c478bd9Sstevel@tonic-gate#
7*7c478bd9Sstevel@tonic-gate# ppp0 - (external) PPP connection to ISP, address a.b.c.d/32
8*7c478bd9Sstevel@tonic-gate#
9*7c478bd9Sstevel@tonic-gate# ed0 - (internal) network interface, address w.x.y.z/32
10*7c478bd9Sstevel@tonic-gate#
11*7c478bd9Sstevel@tonic-gate# This file contains the basic rules needed to construct a firewall for the
12*7c478bd9Sstevel@tonic-gate# above situation.
13*7c478bd9Sstevel@tonic-gate#
14*7c478bd9Sstevel@tonic-gate#-------------------------------------------------------
15*7c478bd9Sstevel@tonic-gate# *Nasty* packets we don't want to allow near us at all!
16*7c478bd9Sstevel@tonic-gate# short packets which are packets fragmented too short to be real.
17*7c478bd9Sstevel@tonic-gateblock in log quick all with short
18*7c478bd9Sstevel@tonic-gate#-------------------------------------------------------
19*7c478bd9Sstevel@tonic-gate# Group setup.
20*7c478bd9Sstevel@tonic-gate# ============
21*7c478bd9Sstevel@tonic-gate# By default, block and log everything.  This maybe too much logging
22*7c478bd9Sstevel@tonic-gate# (especially for ed0) and needs to be further refined.
23*7c478bd9Sstevel@tonic-gate#
24*7c478bd9Sstevel@tonic-gateblock in log on ppp0 all head 100
25*7c478bd9Sstevel@tonic-gateblock out log on ppp0 all head 150
26*7c478bd9Sstevel@tonic-gateblock in log on ed0 from w.x.y.z/24 to any head 200
27*7c478bd9Sstevel@tonic-gateblock out log on ed0 all head 250
28*7c478bd9Sstevel@tonic-gate#-------------------------------------------------------
29*7c478bd9Sstevel@tonic-gate# Invalid Internet packets.
30*7c478bd9Sstevel@tonic-gate# =========================
31*7c478bd9Sstevel@tonic-gate#
32*7c478bd9Sstevel@tonic-gate# Deny reserved addresses.
33*7c478bd9Sstevel@tonic-gate#
34*7c478bd9Sstevel@tonic-gateblock in log quick from 10.0.0.0/8 to any group 100
35*7c478bd9Sstevel@tonic-gateblock in log quick from 192.168.0.0/16 to any group 100
36*7c478bd9Sstevel@tonic-gateblock in log quick from 172.16.0.0/12 to any group 100
37*7c478bd9Sstevel@tonic-gate#
38*7c478bd9Sstevel@tonic-gate# Prevent IP spoofing.
39*7c478bd9Sstevel@tonic-gate#
40*7c478bd9Sstevel@tonic-gateblock in log quick from a.b.c.d/24 to any group 100
41*7c478bd9Sstevel@tonic-gate#
42*7c478bd9Sstevel@tonic-gate#-------------------------------------------------------
43*7c478bd9Sstevel@tonic-gate# Localhost packets.
44*7c478bd9Sstevel@tonic-gate# ==================
45*7c478bd9Sstevel@tonic-gate# packets going in/out of network interfaces that aren't on the loopback
46*7c478bd9Sstevel@tonic-gate# interface should *NOT* exist.
47*7c478bd9Sstevel@tonic-gateblock in log quick from 127.0.0.0/8 to any group 100
48*7c478bd9Sstevel@tonic-gateblock in log quick from any to 127.0.0.0/8 group 100
49*7c478bd9Sstevel@tonic-gateblock in log quick from 127.0.0.0/8 to any group 200
50*7c478bd9Sstevel@tonic-gateblock in log quick from any to 127.0.0.0/8 group 200
51*7c478bd9Sstevel@tonic-gate# And of course, make sure the loopback allows packets to traverse it.
52*7c478bd9Sstevel@tonic-gatepass in quick on lo0 all
53*7c478bd9Sstevel@tonic-gatepass out quick on lo0 all
54*7c478bd9Sstevel@tonic-gate#-------------------------------------------------------
55*7c478bd9Sstevel@tonic-gate# Allow any communication between the inside network and the outside only.
56*7c478bd9Sstevel@tonic-gate#
57*7c478bd9Sstevel@tonic-gate# Allow all outgoing connections (SSH, TELNET, FTP, WWW, gopher, etc)
58*7c478bd9Sstevel@tonic-gate#
59*7c478bd9Sstevel@tonic-gatepass in log quick proto tcp all flags S/SA keep state group 200
60*7c478bd9Sstevel@tonic-gate#
61*7c478bd9Sstevel@tonic-gate# Support all UDP `connections' initiated from inside.
62*7c478bd9Sstevel@tonic-gate#
63*7c478bd9Sstevel@tonic-gate# Allow ping out
64*7c478bd9Sstevel@tonic-gate#
65*7c478bd9Sstevel@tonic-gatepass in log quick proto icmp all keep state group 200
66*7c478bd9Sstevel@tonic-gate#-------------------------------------------------------
67*7c478bd9Sstevel@tonic-gate# Log these:
68*7c478bd9Sstevel@tonic-gate# ==========
69*7c478bd9Sstevel@tonic-gate# * return RST packets for invalid SYN packets to help the other end close
70*7c478bd9Sstevel@tonic-gateblock return-rst in log proto tcp from any to any flags S/SA group 100
71*7c478bd9Sstevel@tonic-gate# * return ICMP error packets for invalid UDP packets
72*7c478bd9Sstevel@tonic-gateblock return-icmp(net-unr) in proto udp all group 100
73