freebsd firewall configuration

8/10/2019 FreeBSD Firewall Configuration

1/7

reeBSD Firewall Configuration

FreeBSD makes it very easy to set up a rule-based packet filtering firewall. You can

protect just one host or an entire network. You can easily add !etwork "ddress

#ranslation too so that you can connect up your whole internal network via only one $%

address from the outside.

#here are three parts to this.

&. First you have to make a few changes to your kernel. #his isn't as hard as it

sounds. Su to root cd (usr(src(sys(i)*+(conf and copy ,!$/ to a new file.

0et's call it "/1. #his will be your new kernel config. 2ere are the changes

you need to make32. *** GENERIC Sun Apr 27 20:41:46 20033. --- ACME Sun May 9 12:47:24 20044. ***************

5. *** 22,29 ****6. cpu I46!C"#7. cpu I56!C"#. cpu I66!C"#9. $ %&'n( GENERIC10. )au+'r+ 011.12. )a'p(%n+ /E#G- u%& 'rn' %(

&18 &'u +y)+13.14. --- 22,40 ----15. cpu I46!C"#16. cpu I56!C"#

17. cpu I66!C"#1. $ %&'n( ACME19. )au+'r+ 020. 21. Ena' %p.22. p(%n+ I";IRE6;[email protected]. )a'p(%n+ /E#G- u%& 'rn' %(

&18 &'u +y)+33.

$n other words change the ident and add the firewall options. "dding the

$%4+F$5"00 options to the kernel doesn't actually enable $%v+6 to do that

you have to add ipv+7enable89YS9 to your (etc(rc.conf. 2owever if you have

$%v+ enabled and you are setting up an $%v: firewall you mustenable the $%v+

firewall as well. $f you were to set up a v: firewall and not a v+ firewall all v+

packets would be allowed through which would be bad.

"fter setting up the config build and install the new kernel3


2/7

u+r+%ncn% ACME c& ....c)p%'ACME )a' &'p'n& )a' )a' %n+(a

):. Second edit (etc(rc.conf and add these defines to the end3

35. Ena' %p.36. %r'a!'na'BESB37. %r'a!(yp'BtypeB +'' rc.%r'a r a(

'+ 'r'3. %r'a!Du%'(BN?B39.40. Ena' %p6.41. %p6!%r'a!'na'BESB42. %p6!%r'a!(yp'BtypeB +'' rc.%r'a6 r a(

'+ 'r'43. %p6!%r'a!Du%'(BN?B

#he firewall types should be 9client9 to secure a single stand-alone machine or

9simple9 for a gateway guarding an internal network.

$f you want to do !etwork "ddress #ranslation add these defines too3

Ena' na(&.na(&!'na'BESBna(&!%n('rac'Bfxp0B yur pu%c n'(r %n('rac'na(&!a+B-)B pr'+'r' pr( nu)'r+% p++%'

::. #hird you have to make a few edits in rc.firewall and rc.firewall+. #he

comments there e;plain what is needed it's real easy. 0ook for the section with

rules for your firewall type either 9client9 or 9simple9. "t the beginning of thesection there will be a few defines for your $% numbers network interfaces etc.6

fill these in.

#hat's it for a starter setup anyway. eboot and you should be up and running.

Important Troubleshooting Note

FreeBSD's firewall facility is designed so that it's secure by default. $f you enable it and

then don't add any rules it drops ALLpackets. #his means if you mess something up in

your firewall setup you may find that you can't get to your machine through the

network to fi; it. You will have to log in via the system console.

#his happened to me once during debugging. $t's no big deal as long as you understand

what's going on. $t's easy to recover from if you have access to the console6 just edit

(etc(rc.conf change firewall7type to 9open9 or just comment out the firewall lines and

boot again. But do be careful if you're tweaking your firewall setup over the net.

FTP Note

Firewall setups like this prevent regular F#% from working. #his is really F#%'s fault.

$t's an old-fashioned and over-complicated protocol which re F#% fails.


3/7

#here is a workaround - use F#%'s 9passive9 mode which basically tells it to stick to a

regular client-server protocol. very time you run ftp just give the 9passive9 command.

5ith recent versions of F#% clients you can make this the default by setting the

environment variable F#%7%"SS$471?D to 9yes9.

#he other workaround of course is to avoid F#% and just use 2##% or scp instead.

More Adan!ed Topi!s

?nce you have a firewall set up you may find you don't like the canned rule sets. $f so

it's easy to make your own. #he first thing you might do is allow ssh connections

through. =ssh is a secure replacement for telnet(rlogin6 you can fetch it from

http3((www.openssh.org(.> 5here your ruleset says 9"llow setup of incoming email9

add a similar rule for ssh by changing the port number @A to a @@.

?r you can go whole hog and make an entirely new ruleset. $ ended up making two new

ones called acme-solo and acme-net which are souped-up versions of the default clientand simple rulesets. 2ere's the code3

FAaFCcFM)FE'-FS+F?F=F?8 ACME +%n'-)ac%n' cu+() %r'a +'(up. "r('c(++)'a( aa%n+( (' u(+%&' r&.

S'( (%+ ( yur %p a&&r'++. %pB192.100.666.1B

+'(up!pac

A any(%n u(un& r) (%+ a&&r'++. Hc)&J a&& a a r) H%pJ ( any u(

/'ny any(%n u(un& r) ('r a&&r'++'+. Hc)&J a&& &'ny a r) any ( any u(

A @C" (ru % +'(up +ucc''&'&. Hc)&J a&& a (cp r) any ( any '+(a%+'&

A I" ra)'n(+ ( pa++ (ru.

Hc)&J a&& a a r) any ( any ra

A a I"6 pac'(+ (ru - ('y ar' an&'& y ('+'para(' %p6 %r'a ru'+ %n rc.%r'a6. Hc)&J a&& a %p6 r) any ( any

A %nun& (p, ++, ')a%, (cp-&n+, ((p, ((p+, %)ap,%)ap+, pp3, pp3+. Hc)&J a&& a (cp r) any ( H%pJ 21 +'(up Hc)&J a&& a (cp r) any ( H%pJ 22 +'(up Hc)&J a&& a (cp r) any ( H%pJ 25 +'(up Hc)&J a&& a (cp r) any ( H%pJ 53 +'(up Hc)&J a&& a (cp r) any ( H%pJ 0 +'(up Hc)&J a&& a (cp r) any ( H%pJ 443 +'(up
http://www.openssh.org/http://www.openssh.org/


4/7

Hc)&J a&& a (cp r) any ( H%pJ 143 +'(up Hc)&J a&& a (cp r) any ( H%pJ 993 +'(up Hc)&J a&& a (cp r) any ( H%pJ 110 +'(up Hc)&J a&& a (cp r) any ( H%pJ 995 +'(up

/'ny %nun& au(, n'(%+, &ap, an& M%cr+(K+ /

pr(c %(u( %n. Hc)&J a&& r'+'( (cp r) any ( H%pJ 113 +'(up Hc)&J a&& r'+'( (cp r) any ( H%pJ 139 +'(up Hc)&J a&& r'+'( (cp r) any ( H%pJ 39 +'(up Hc)&J a&& r'+'( (cp r) any ( H%pJ 445 +'(up

/'ny +)' ca((y #/" ra&ca+( pr(c+ %(u( %n. Hc)&J a&& &'ny u&p r) any 137 ( any Hc)&J a&& &'ny u&p r) any ( any 137 Hc)&J a&& &'ny u&p r) any 13 ( any Hc)&J a&& &'ny u&p r) any 513 ( any Hc)&J a&& &'ny u&p r) any 525 ( any

A %nun& /NS an& N@" r'p%'+. @%+ %+ +)'a( a', +%nc' 'Kr' %n a( (' %nc)%n pr( nu)'r, %c can' a'&, u( (a(K+ Lu+( (' ay /NS an& N@" r. Hc)&J a&& a u&p r) any 53 ( H%pJ Hc)&J a&& a u&p r) any 123 ( H%pJ

A %nun& /NS Du'r%'+. Hc)&J a&& a u&p r) any ( H%pJ 53

A %nun& N@" Du'r%'+. Hc)&J a&& a u&p r) any ( H%pJ 123

A (rac'ru(' ( unc(%n, u( n( ( '( %n. Hc)&J a&& unr'ac pr( u&p r) any ( H%pJ 33435-33524

A +)' %nun& %c)p+ - 'c r'py, &'+( unr'ac, +urc'Du'nc, 'c, (( 'c''&'&. Hc)&J a&& a %c)p r) any ( any %c)p(yp'+ 0,3,4,,11

E'ry(%n '+' %+ &'n%'& an& '&. Hc)&J a&& &'ny a r) any ( any

FAaFCcFM)FE'-FNnFE'F@(8 ACME n'(r cu+() %r'a +'(up. @' a++u)p(%n 'r' %+(a( (' %n('rna +(+ ar' (ru+('&, an& can & a)+( any(%n('y an(. @' ny (%n ' a' ( ' car'u au( %+ a( c)'+ %n'r (' u(+%&' %n('rac'. S, yuK +'' a ( B%n %a H%JB cau+'+ 'r'.

S'( ('+' ( yur u(+%&' %n('rac' n'(r an& n'()a+ an&%p.


5/7

%Bp0B n'(B216.27.1234.0B )a+B255.255.255.0B %pB216.27.1234.1B

S'( ('+' ( yur %n+%&' %n('rac' n'(r an& n'()a+ an&

%p. %%Bp1B %n'(B192.100.666.0B %)a+B255.255.255.0B %%pB192.100.666.1B

+'(up!pac

S(p +p%n. Hc)&J a&& &'ny a r) H%n'(J:H%)a+J ( any %n %a H%J Hc)&J a&& &'ny a r) Hn'(J:H)a+J ( any %n %a H%%J

S(p R;C191 n'(+ n (' u(+%&' %n('rac'. Hc)&J a&& &'ny a r) any ( 10.0.0.0 %a H%J Hc)&J a&& &'ny a r) any ( 172.16.0.012 %a H%J Hc)&J a&& &'ny a r) any ( 192.16.0.016 %a H%J

S(p &ra(-)ann%n-&+ua-03.(( 1 May 20008 n'(+ %ncu&'+RESER>E/-1, /C" au(-cn%ura(%n, NE@-@ES@, M#=@ICAS@ ca++ /8, an&ca++ E8 n (' u(+%&' %n('rac'. Hc)&J a&& &'ny a r) any ( 0.0.0.0 %a H%J Hc)&J a&& &'ny a r) any ( 169.254.0.016 %a H%J Hc)&J a&& &'ny a r) any ( 192.0.2.024 %a H%J Hc)&J a&& &'ny a r) any ( 224.0.0.04 %a H%J Hc)&J a&& &'ny a r) any ( 240.0.0.04 %a H%J

Sp'c%a 'ary ru'+ r pr(c+ an&'& n (' a('ay)ac%n', + (a( ('+' pac'(+ &nK( a' ( (ru na(& %c %++. Hc)&J a&& a (cp r) any ( H%pJ 21 %n %a H%J (p Hc)&J a&& a (cp r) H%pJ 21 ( any u( %a H%J Hc)&J a&& a (cp r) any ( H%pJ 22 %n %a H%J ++ Hc)&J a&& a (cp r) H%pJ 22 ( any u( %a H%J Hc)&J a&& a (cp r) any ( H%pJ 25 %n %a H%J +)(p Hc)&J a&& a (cp r) H%pJ 25 ( any u( %a H%J Hc)&J a&& a (cp r) any ( H%pJ 53 %n %a H%J (cp&n+ Hc)&J a&& a (cp r) H%pJ 53 ( any u( %a H%J Hc)&J a&& a (cp r) any ( H%pJ 0 %n %a H%J ((p Hc)&J a&& a (cp r) H%pJ 0 ( any u( %a H%J Hc)&J a&& a (cp r) any ( H%pJ 443 %n %a H%J ((p+ Hc)&J a&& a (cp r) H%pJ 443 ( any u( %a H%J Hc)&J a&& a (cp r) any ( H%pJ 143 %n %a H%J

%)ap Hc)&J a&& a (cp r) H%pJ 143 ( any u( %a H%J


6/7

Hc)&J a&& a (cp r) any ( H%pJ 993 %n %a H%J %)ap+ Hc)&J a&& a (cp r) H%pJ 993 ( any u( %a H%J Hc)&J a&& a (cp r) any ( H%pJ 110 %n %a H%J pp3 Hc)&J a&& a (cp r) H%pJ 110 ( any u( %a H%J

Hc)&J a&& a (cp r) any ( H%pJ 995 %n %a H%J pp3+ Hc)&J a&& a (cp r) H%pJ 995 ( any u( %a H%J

N'(r A&&r'++ @ran+a(%n. @%+ ru' %+ pac'& 'r'&'%'ra('y + (a( %( &'+ n( %n('r'r' %( (' +urrun&%n a&&r'++-c'c%n ru'+. I r 'a)p' n' yur %n('rna =AN )ac%n'+ a&%(+ I" a&&r'++ +'( ( 192.0.2.1 ('n an %nc)%n pac'( r %(a('r '%n (ran+a('& y na(&8 u& )a(c (' O&'nyK ru' a'.

S%)%ary an u(%n pac'( r%%na('& r) %( 'r' '%n(ran+a('& u& )a(c (' O&'nyK ru' '. ca+' Hna(&!'na'J %n FyFE'FS+8 % F -n BHna(&!%n('rac'JB ('n Hc)&J a&& &%'r( na(& a r) any ( any%a Hna(&!%n('rac'J % '+ac

S(p R;C191 n'(+ n (' u(+%&' %n('rac'. Hc)&J a&& &'ny a r) 10.0.0.0 ( any %a H%J Hc)&J a&& &'ny a r) 172.16.0.012 ( any %a H%J Hc)&J a&& &'ny a r) 192.16.0.016 ( any %a H%J

S(p &ra(-)ann%n-&+ua-03.(( 1 May 20008 n'(+ %ncu&'+RESER>E/-1, /C" au(-cn%ura(%n, NE@-@ES@, M#=@ICAS@ ca++ /8, an&ca++ E8 n (' u(+%&' %n('rac'. Hc)&J a&& &'ny a r) 0.0.0.0 ( any %a H%J Hc)&J a&& &'ny a r) 169.254.0.016 ( any %a H%J Hc)&J a&& &'ny a r) 192.0.2.024 ( any %a H%J Hc)&J a&& &'ny a r) 224.0.0.04 ( any %a H%J Hc)&J a&& &'ny a r) 240.0.0.04 ( any %a H%J

A any(%n n (' %n('rna n'(. Hc)&J a&& a a r) any ( any %a H%%J

A any(%n u(un& r) (%+ n'(. Hc)&J a&& a a r) Hn'(J:H)a+J ( any u( %a H%J

/'ny any(%n u(un& r) ('r n'(+. Hc)&J a&& &'ny a r) any ( any u( %a H%J

A @C" (ru % +'(up +ucc''&'&.

Hc)&J a&& a (cp r) any ( any '+(a%+'&


7/7

A I" ra)'n(+ ( pa++ (ru. Hc)&J a&& a a r) any ( any ra

A a I"6 pac'(+ (ru - ('y ar' an&'& y ('+'para(' %p6 %r'a ru'+ %n rc.%r'a6.

Hc)&J a&& a %p6 r) any ( any

/'ny %nun& au(, n'(%+, &ap, an& M%cr+(K+ /pr(c %(u( %n. Hc)&J a&& r'+'( (cp r) any ( H%pJ 113 +'(up %n %a H%J Hc)&J a&& r'+'( (cp r) any ( H%pJ 139 +'(up %n %a H%J Hc)&J a&& r'+'( (cp r) any ( H%pJ 39 +'(up %n %a H%J Hc)&J a&& r'+'( (cp r) any ( H%pJ 445 +'(up %n %a H%J

/'ny +)' ca((y #/" ra&ca+( pr(c+ %(u( %n. Hc)&J a&& &'ny u&p r) any 137 ( any %n %a H%J Hc)&J a&& &'ny u&p r) any ( any 137 %n %a H%J Hc)&J a&& &'ny u&p r) any 13 ( any %n %a H%J Hc)&J a&& &'ny u&p r) any 513 ( any %n %a H%J Hc)&J a&& &'ny u&p r) any 525 ( any %n %a H%J

A %nun& /NS an& N@" r'p%'+. @%+ %+ +)'a( a', +%nc' 'Kr' %n a( (' %nc)%n pr( nu)'r, %c can' a'&, u( (a(K+ Lu+( (' ay /NS an& N@" r. Hc)&J a&& a u&p r) any 53 ( H%pJ %n %a H%J Hc)&J a&& a u&p r) any 123 ( H%pJ %n %a H%J

A %nun& /NS Du'r%'+. Hc)&J a&& a u&p r) any ( H%pJ 53 %n %a H%J

A %nun& N@" Du'r%'+. Hc)&J a&& a u&p r) any ( H%pJ 123 %n %a H%J

A (rac'ru(' ( unc(%n, u( n( ( '( %n. Hc)&J a&& unr'ac pr( u&p r) any ( H%pJ 33435-33524%n %a H%J

A +)' %nun& %c)p+ - 'c r'py, &'+( unr'ac, +urc'Du'nc, 'c, (( 'c''&'&. Hc)&J a&& a %c)p r) any ( any %n %a H%J%c)p(yp'+ 0,3,4,,11

ra&ca+(+ ar' &'n%'& an& n( '&. Hc)&J a&& &'ny a r) any ( 255.255.255.255

E'ry(%n '+' %+ &'n%'& an& '&. Hc)&J a&& &'ny a r) any ( any

freebsd firewall configuration

Documents