[causalities]

Hey all, i'm currently using FBSD 5.0 and I've just compiled ipfilter into my kernel. I'm still trying to get a hang of FBSD, and even tho i'm getting huge headaches over it, i believe once i've gotten the hang of it, it will serve me much better than a Windoze box. But meanwhile, sorry for being such a n00b. :oops:

My FBSD box is my router and i'm sharing my broadband with other computers on my network. Basically I'd like to be able to access mail (from my isp's pop), web browsing, icq, msn, irc, eyeball (video conferencing), kazaa (and other gnutellas), games (wc3 etc). So I'm guessing my firewall wont be "that" secure? Erm, if anyone has or knows of a ruleset already set up with most of this, it might save me some time? If not, this is what i have so far.

I've created the following two files /etc/ipf.rules : /etc/ipnat.rules. However, I'm not so sure they are working. I've run:
ipf -E #just in case it wasn't up#
ipf -Fa -f /etc/ipf.rules #as describe at http://www.obfuscation.org/ipf/ipf-howto.txt#.
ipnat -CF -f /etc/ipnat.rules #source same as above#

Next when I use ipfstat
the results dont show any packets being blocked. Even though ipf is running and the new ruleset was loaded.

Here are both my ipf.rules and ipnat.rules.
thanks in advance for anybody's help....

*********************ipf.rules*******************

################################################## ###############
# Outside Interface
################################################## ###############

#----------------------------------------------------------------
# Allow out all TCP, UDP, and ICMP traffic & keep state on it
# so that it's allowed back in.
#
# If you wanted to do egress filtering...here's where you'd do it.
# You'd change the lines below so that rather than allowing out any
# arbitrary TCP connection, it would only allow out mail, pop3, and http
# connections (for example). So, the first line, below, would be
# replaced with:
# pass out quick on rl0 proto tcp from any to any port = 25 keep state
# pass out quick on rl0 proto tcp from any to any port = 110 keep state
# pass out quick on rl0 proto tcp from any to any port = 80 keep state
# ...and then do the same for the remaining lines so that you allow
# only specified protocols/ports 'out' of your network
#----------------------------------------------------------------
pass out quick on rl0 proto tcp from any to any keep state
pass out quick on rl0 proto udp from any to any keep state
pass out quick on rl0 proto icmp from any to any keep state
block out quick on rl0 all

#WarCraft III rules
pass in quick on rl0 proto tcp from any to any port = 6112 flags S/SA keep state
pass out quick on rl0 proto tcp from any to any port = 6112 flags S/SA keep state
pass in quick on rl0 proto tcp from any to any port 6113 >< 6119 flags S/SA keep state
pass out quick on rl0 proto tcp from any to any port 6113 >< 6119 flags S/SA keep state

#-----------------------------------------------------------------------
# Block all inbound traffic from non-routable or reserved address spaces
#-----------------------------------------------------------------------
block in log quick on rl0 from 192.168.0.0/16 to any #RFC 1918 private IP
block in log quick on rl0 from 172.16.0.0/12 to any #RFC 1918 private IP
#block in log quick on rl0 from 10.0.0.0/8 to any #RFC 1918 private IP
block in log quick on rl0 from 127.0.0.0/8 to any #loopback
block in log quick on rl0 from 0.0.0.0/8 to any #loopback
block in log quick on rl0 from 169.254.0.0/16 to any #DHCP auto-config
block in log quick on rl0 from 192.0.2.0/24 to any #reserved for doc's
block in log quick on rl0 from 204.152.64.0/23 to any #Sun cluster interconnect
block in quick on rl0 from 224.0.0.0/3 to any #Class D & E multicast

#----------------------------------------------------------------
# Allow bootp traffic in from your ISP's DHCP server only.
#----------------------------------------------------------------
pass in quick on rl0 proto udp from X.X.X.X/32 to any port = 68 keep state

#----------------------------------------------------------------
# Block and log all remaining traffic coming into the firewall
# - Block TCP with a RST (to make it appear as if the service
# isn't listening)
# - Block UDP with an ICMP Port Unreachable (to make it appear
# as if the service isn't listening)
# - Block all remaining traffic the good 'ol fashioned way
#----------------------------------------------------------------
block return-rst in log quick on rl0 proto tcp from any to any
block return-icmp-as-dest(port-unr) in log quick on rl0 proto udp from any to any
block in log quick on rl0 all

################################################## ###############
# Inside Interface
################################################## ###############

#----------------------------------------------------------------
# Allow out all TCP, UDP, and ICMP traffic & keep state
#----------------------------------------------------------------
pass out quick on rl1 proto tcp from any to any keep state
pass out quick on rl1 proto udp from any to any keep state
pass out quick on rl1 proto icmp from any to any keep state
block out quick on rl1 all

#----------------------------------------------------------------
# Allow in all TCP, UDP, and ICMP traffic & keep state
#----------------------------------------------------------------
pass in quick on rl1 proto tcp from any to any keep state
pass in quick on rl1 proto udp from any to any keep state
pass in quick on rl1 proto icmp from any to any keep state
block in quick on rl1 all

################################################## ###############
# Loopback Interface
################################################## ###############

#----------------------------------------------------------------
# Allow everything to/from your loopback interface so you
# can ping yourself (e.g. ping localhost)
#----------------------------------------------------------------
pass in quick on lo0 all
pass out quick on lo0 all

******************ipnat.rules below****************************

#--------------------------------------------------------------------
# Do 'normal' IP address translation. This line will take all packets
# going out on your external NIC (ed0) that have a source address coming
# from your internal network (192.168.1.0), and translate it to whatever
# IP address your external NIC happens to have at that time
#--------------------------------------------------------------------
map ed0 192.168.0.0/24 -> 0/32

#--------------------------------------------------------------------
# If you have a system on your internal network that needs to be
# 'reachable' by external systems on the internet, you'll need a rule
# similar to the one below. This one takes all inbound http traffic
# (TCP port 80) that hits the firewall's external interface (ed0) and
# redirects it to port 80 on the 192.168.1.50 system on the internal network.
# Simply uncomment the rule, change the IP address and port number so that
# it does what you need. Remember that you have to enable the corresponding
# inbound filter in your /etc/ipf.rules file, too.
#--------------------------------------------------------------------
# rdr ed0 0.0.0.0/0 port 80 -> 192.168.1.50 port 80 tcp

rdr ed0 0.0.0.0/0 port 6112 -> 192.168.0.5 port 6112
rdr ed0 0.0.0.0/0 port 6113 -> 192.168.0.5 port 6113
rdr ed0 0.0.0.0/0 port 6114 -> 192.168.0.5 port 6114
rdr ed0 0.0.0.0/0 port 6115 -> 192.168.0.5 port 6115
rdr ed0 0.0.0.0/0 port 6116 -> 192.168.0.5 port 6116
rdr ed0 0.0.0.0/0 port 6117 -> 192.168.0.5 port 6117
rdr ed0 0.0.0.0/0 port 6118 -> 192.168.0.5 port 6118
rdr ed0 0.0.0.0/0 port 6119 -> 192.168.0.5 port 6119

[|MiNi0n|]

Using ipf -Fa -f -v /etc/ipf.rules will output the rules to screen when they're loaded. Makes diagnosing problems much easier. Just a quick tip, I don't have time to parse your rules right now, I'll have a look tomorrow!

[causalities]

hi MiNiOn, thx for replying and offering to take a look at my rules. :D

ipf -Fa -f -v /etc/ipf.rules
outputs:
ipf: fopen(-v) failed: No such file or directory

I've made sure /etc/ipf.rules is there, and also that the contents there. I'm running as root as well. So...

[|MiNi0n|]

Sorry, my fault, it's:

ipf -Fa -v -f /etc/ipf.rules

[causalities]

Wow. Uhm... there's a lotta (!) after each of my rules. Does the (!) mean there are problems with the rules? And is the problem specifically on my interface (rl0)?
:?: :!: :?

ipf -Fa -v -f /etc/ipf.rules
[pass out quick on rl0 proto tcp from any to any keep state]
pass out quick on rl0(!) proto tcp from any to any keep state
[pass out quick on rl0 proto udp from any to any keep state]
pass out quick on rl0(!) proto udp from any to any keep state
[pass out quick on rl0 proto icmp from any to any keep state]
pass out quick on rl0(!) proto icmp from any to any keep state
[block out quick on rl0 all]
block out quick on rl0(!) from any to any
[pass in quick on rl0 proto tcp from any to any port = 6112 flags S/SA keep state]
pass in quick on rl0(!) proto tcp from any to any port = 6112 flags S/SA keep state
[pass out quick on rl0 proto tcp from any to any port = 6112 flags S/SA keep state]
pass out quick on rl0(!) proto tcp from any to any port = 6112 flags S/SA keep state
[pass in quick on rl0 proto tcp from any to any port 6113 >< 6119 flags S/SA keep state]
pass in quick on rl0(!) proto tcp from any to any port 6113 >< 6119 flags S/SA keep state
[pass out quick on rl0 proto tcp from any to any port 6113 >< 6119 flags S/SA keep state]
pass out quick on rl0(!) proto tcp from any to any port 6113 >< 6119 flags S/SA keep state
[block in log quick on rl0 from 192.168.0.0/16 to any ]
block in log quick on rl0(!) from 192.168.0.0/16 to any
[block in log quick on rl0 from 172.16.0.0/12 to any ]
block in log quick on rl0(!) from 172.16.0.0/12 to any
[block in log quick on rl0 from 127.0.0.0/8 to any ]
block in log quick on rl0(!) from 127.0.0.0/8 to any
[block in log quick on rl0 from 0.0.0.0/8 to any ]
block in log quick on rl0(!) from 0.0.0.0/8 to any
[block in log quick on rl0 from 169.254.0.0/16 to any ]
block in log quick on rl0(!) from 169.254.0.0/16 to any
[block in log quick on rl0 from 192.0.2.0/24 to any ]
block in log quick on rl0(!) from 192.0.2.0/24 to any
[block in log quick on rl0 from 204.152.64.0/23 to any ]
block in log quick on rl0(!) from 204.152.64.0/23 to any
[block in quick on rl0 from 224.0.0.0/3 to any ]
block in quick on rl0(!) from 224.0.0.0/3 to any
[pass in quick on rl0 proto udp from 0.0.0.0/32 to any port = 68 keep state]
pass in quick on rl0(!) proto udp from 0.0.0.0/32 to any port = 68 keep state
[block return-rst in log quick on rl0 proto tcp from any to any]
block return-rst in log quick on rl0(!) proto tcp from any to any
[block return-icmp-as-dest(port-unr) in log quick on rl0 proto udp from any to any]
block return-icmp-as-dest(port-unr) in log quick on rl0(!) proto udp from any to any
[block in log quick on rl0 all]
block in log quick on rl0(!) from any to any
[pass out quick on rl1 proto tcp from any to any keep state]
pass out quick on rl1(!) proto tcp from any to any keep state
[pass out quick on rl1 proto udp from any to any keep state]
pass out quick on rl1(!) proto udp from any to any keep state
[pass out quick on rl1 proto icmp from any to any keep state]
pass out quick on rl1(!) proto icmp from any to any keep state
[block out quick on rl1 all]
block out quick on rl1(!) from any to any
[pass in quick on rl1 proto tcp from any to any keep state]
pass in quick on rl1(!) proto tcp from any to any keep state
[pass in quick on rl1 proto udp from any to any keep state]
pass in quick on rl1(!) proto udp from any to any keep state
[pass in quick on rl1 proto icmp from any to any keep state]
pass in quick on rl1(!) proto icmp from any to any keep state
[block in quick on rl1 all]
block in quick on rl1(!) from any to any
[pass in quick on lo0 all]
pass in quick on lo0(!) from any to any
[pass out quick on lo0 all]
pass out quick on lo0(!) from any to any

[jlam]

*********************ipf.rules*******************

################################################## ###############
# Outside Interface
################################################## ###############

#----------------------------------------------------------------
# Allow out all TCP, UDP, and ICMP traffic & keep state on it
# so that it's allowed back in.
#
# If you wanted to do egress filtering...here's where you'd do it.
# You'd change the lines below so that rather than allowing out any
# arbitrary TCP connection, it would only allow out mail, pop3, and http
# connections (for example). So, the first line, below, would be
# replaced with:
# pass out quick on rl0 proto tcp from any to any port = 25 keep state
# pass out quick on rl0 proto tcp from any to any port = 110 keep state
# pass out quick on rl0 proto tcp from any to any port = 80 keep state
# ...and then do the same for the remaining lines so that you allow
# only specified protocols/ports 'out' of your network
#----------------------------------------------------------------
pass out quick on rl0 proto tcp from any to any keep state
pass out quick on rl0 proto udp from any to any keep state
pass out quick on rl0 proto icmp from any to any keep state
block out quick on rl0 all
You went a little overboard with the "quick" keyword. Rule processing for a packet stops immediately when a matching rule that contains "quick" is encountered. Your last "block out quick on rl0 all" rule makes the subsequent War3 "pass out" rules unreachable. However, they're unreachable anyway since any packets that would be matched by the War3 rules are already covered by your first rule. The better way to "block all other packets" is to prepend:
[code:1:f315a721b6]block in log all
block out all[/code:1:f315a721b6]
to your ruleset. This announces that you plan on blocking traffic on all your interfaces by default.
#WarCraft III rules
pass in quick on rl0 proto tcp from any to any port = 6112 flags S/SA keep state
pass out quick on rl0 proto tcp from any to any port = 6112 flags S/SA keep state
pass in quick on rl0 proto tcp from any to any port 6113 >< 6119 flags S/SA keep state
pass out quick on rl0 proto tcp from any to any port 6113 >< 6119 flags S/SA keep state
I think they recommend just "flags S" instead of "flags S/SA" nowadays to detect the start of the TCP handshake. It looks like you could get rid of the first two rules here and modify the last two to be "port 6112 >< 6119". Also, do you really mean to have both "pass in ... keep state" as well as "pass out ... keep state" here? The "pass in ... keep state" rules allow any machine can initiate a TCP connection to your machine, while the "pass out ... keep state" rules allow your machine to initiate a TCP connection to other machines. Are you sure that you don't just need the latter (I can't answer since I'm not familiar with War3)?
#-----------------------------------------------------------------------
# Block all inbound traffic from non-routable or reserved address spaces
#-----------------------------------------------------------------------
block in log quick on rl0 from 192.168.0.0/16 to any #RFC 1918 private IP
block in log quick on rl0 from 172.16.0.0/12 to any #RFC 1918 private IP
#block in log quick on rl0 from 10.0.0.0/8 to any #RFC 1918 private IP
block in log quick on rl0 from 127.0.0.0/8 to any #loopback
block in log quick on rl0 from 0.0.0.0/8 to any #loopback
block in log quick on rl0 from 169.254.0.0/16 to any #DHCP auto-config
block in log quick on rl0 from 192.0.2.0/24 to any #reserved for doc's
block in log quick on rl0 from 204.152.64.0/23 to any #Sun cluster interconnect
block in quick on rl0 from 224.0.0.0/3 to any #Class D & E multicast

#----------------------------------------------------------------
# Allow bootp traffic in from your ISP's DHCP server only.
#----------------------------------------------------------------
pass in quick on rl0 proto udp from X.X.X.X/32 to any port = 68 keep state
These rules look just fine.
#----------------------------------------------------------------
# Block and log all remaining traffic coming into the firewall
# - Block TCP with a RST (to make it appear as if the service
# isn't listening)
# - Block UDP with an ICMP Port Unreachable (to make it appear
# as if the service isn't listening)
# - Block all remaining traffic the good 'ol fashioned way
#----------------------------------------------------------------
block return-rst in log quick on rl0 proto tcp from any to any
block return-icmp-as-dest(port-unr) in log quick on rl0 proto udp from any to any
block in log quick on rl0 all
I think it's better to move these rules without the "quick" tag to the start of your ruleset. This just states the flavor of your firewall rules very early: "I want to block all incoming traffic, except..." and then your subsequent rules would note the exceptions. So:
[code:1:f315a721b6]block return-rst in log on rl0 proto tcp all
block return-icmp-as-dest(port-unr) in log on rl0 proto udp all
block in log on rl0 all
[/code:1:f315a721b6]
################################################## ###############
# Inside Interface
################################################## ###############

#----------------------------------------------------------------
# Allow out all TCP, UDP, and ICMP traffic & keep state
#----------------------------------------------------------------
pass out quick on rl1 proto tcp from any to any keep state
pass out quick on rl1 proto udp from any to any keep state
pass out quick on rl1 proto icmp from any to any keep state
block out quick on rl1 all

#----------------------------------------------------------------
# Allow in all TCP, UDP, and ICMP traffic & keep state
#----------------------------------------------------------------
pass in quick on rl1 proto tcp from any to any keep state
pass in quick on rl1 proto udp from any to any keep state
pass in quick on rl1 proto icmp from any to any keep state
block in quick on rl1 all
These rules cumulatively don't actually do anything, since they say "allow my machine to connect to any other local machine" and "allow any local machine to connect to my machine". You can just remove them, or you can replace them with the following if you want to be pedantic and add explicit rules for every interface (which is a good thing for firewall rules):
[code:1:f315a721b6]block in on rl1 all
block out on rl1 all

pass in quick on rl1 all
pass out quick on rl1 all
[/code:1:f315a721b6]
################################################## ###############
# Loopback Interface
################################################## ###############

#----------------------------------------------------------------
# Allow everything to/from your loopback interface so you
# can ping yourself (e.g. ping localhost)
#----------------------------------------------------------------
pass in quick on lo0 all
pass out quick on lo0 all

Usually these localhost rules are placed "first" (after the initial "block" rules that I recommended that you put at the start of your ruleset). This is to optimize traffic on your loopback interface so that packets don't have to fall through all of your other rules before encountering the localhost rules.

Sorry I can't offer advice on the IPNAT rules, since it's been too long since I set up a NAT using ipfilter.

You shouldn't really be seeing blocked packets unless "outside" machines regularly try to connect your firewall machine. Your current IPFilter ruleset only opens up ports 611[2-9] to be accessible the outside world. You can test this if you have an account on some machine outside your network. Just try to telnet to your firewall on various ports from your outside account to generate traffic that IPFilter should block.

jlam

[|MiNi0n|]

Sorry, I missed the question you had about logging too. You need the following in your rc.conf file, particularly the ipmon stuff:

ipfilter_enable="YES" # Set to YES to enable ipfilter functionality
ipfilter_program="/sbin/ipf" # where the ipfilter program lives
ipfilter_rules="/etc/ipf.rules" # rules definition file for ipfilter, see
ipfilter_flags="" # additional flags for ipfilter
ipmon_enable="YES" # Set to YES for ipmon; needs ipfilter or ipnat
ipmon_program="/sbin/ipmon" # where the ipfilter monitor program lives
ipmon_flags="-D /var/log/ipflog" # typically "-Ds" or "-D /var/log/ipflog"

[causalities]

thankx jlam, i've modified my firewall rules with the changes now. i'm just going to get a friend to try and telnet into my server and see if it actually drops any packets...

[causalities]

thanks minion, will i have to reboot my machine if i change my rc.conf file to make those changes effective?