Lines Matching +full:add +full:- +full:on
1 #!/bin/sh -
2 # Copyright (c) 1996 Poul-Henning Kamp
21 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 if [ -z "${source_rc_confs_defined}" ]; then
34 if [ -r /etc/defaults/rc.conf ]; then
37 elif [ -r /etc/rc.conf ]; then
44 # open - will allow anyone in
45 # client - will try to protect just this machine
46 # simple - will try to protect a whole network
47 # closed - totally disables IP services except via lo0 interface
48 # workstation - will try to protect just this machine using stateful
50 # UNKNOWN - disables the loading of firewall rules.
51 # filename - will load the rules in the given filename (full path required)
65 # ISBN 1-56592-871-7
74 # Addison-Wesley / Prentice Hall
75 # ISBN 0-201-63466-X
84 ${fwcmd} add 100 pass all from any to any via lo0
85 ${fwcmd} add 200 deny all from any to 127.0.0.0/8
86 ${fwcmd} add 300 deny ip from 127.0.0.0/8 to any
87 if [ $ipv6_available -eq 0 ]; then
88 ${fwcmd} add 400 deny all from any to ::1
89 ${fwcmd} add 500 deny all from ::1 to any
94 [ $ipv6_available -eq 0 ] || return 0
102 ${fwcmd} add pass ipv6-icmp from :: to ff02::/16
104 ${fwcmd} add pass ipv6-icmp from fe80::/10 to fe80::/10
105 ${fwcmd} add pass ipv6-icmp from fe80::/10 to ff02::/16
108 ${fwcmd} add pass ipv6-icmp from any to any icmp6types 1
111 ${fwcmd} add pass ipv6-icmp from any to any icmp6types 2,135,136
117 if [ -n "${1}" ]; then
120 if [ -z "${firewall_rc_config_load}" ]; then
136 fwcmd="/sbin/ipfw -q"
146 ${fwcmd} -f flush
154 # will then be run again on each packet after translation by natd
158 # different place to not interfere with address-checking rules.
164 if [ -n "${natd_interface}" ]; then
165 ${fwcmd} add 50 divert natd ip4 from any to any via ${natd_interface}
171 if [ -n "${firewall_nat_interface}" ]; then
173 grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; then
179 ${fwcmd} add 50 nat 123 ip4 from any to any via ${firewall_nat_interface}
191 # ${fwcmd} add 65000 pass all from any to any
198 ${fwcmd} add 65000 pass all from any to any
216 ${fwcmd} add pass all from ${net} to 255.255.255.255
219 ${fwcmd} add pass all from me to ${net}
220 ${fwcmd} add pass all from ${net} to me
221 if [ -n "$net6" ]; then
222 ${fwcmd} add pass all from me to ${net6}
223 ${fwcmd} add pass all from ${net6} to me
224 # Allow any link-local multicast traffic
225 ${fwcmd} add pass all from fe80::/10 to ff02::/16
226 ${fwcmd} add pass all from ${net6} to ff02::/16
228 ${fwcmd} add pass udp from fe80::/10 to me 546
232 ${fwcmd} add pass tcp from any to any established
235 ${fwcmd} add pass all from any to any frag
238 ${fwcmd} add pass tcp from any to me 25 setup
241 ${fwcmd} add pass tcp from me to any setup
244 ${fwcmd} add deny tcp from any to any setup
247 ${fwcmd} add pass udp from me to any 53 keep-state
250 ${fwcmd} add pass udp from me to any 123 keep-state
261 # on the inside at this machine for those services.
278 oif6="${firewall_simple_oif_ipv6:-$firewall_simple_oif}"
284 iif6="${firewall_simple_iif_ipv6:-$firewall_simple_iif}"
288 ${fwcmd} add deny all from ${inet} to any in via ${oif}
289 ${fwcmd} add deny all from ${onet} to any in via ${iif}
290 if [ -n "$inet6" ]; then
291 ${fwcmd} add deny all from ${inet6} to any in via ${oif6}
292 if [ -n "$onet6" ]; then
293 ${fwcmd} add deny all from ${onet6} to any in \
299 # Stop RFC1918 nets on the outside interface
301 ${fwcmd} table ${BAD_ADDR_TBL} add 10.0.0.0/8
302 ${fwcmd} table ${BAD_ADDR_TBL} add 172.16.0.0/12
303 ${fwcmd} table ${BAD_ADDR_TBL} add 192.168.0.0/16
305 # And stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
306 # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
307 # on the outside interface
308 ${fwcmd} table ${BAD_ADDR_TBL} add 0.0.0.0/8
309 ${fwcmd} table ${BAD_ADDR_TBL} add 169.254.0.0/16
310 ${fwcmd} table ${BAD_ADDR_TBL} add 192.0.2.0/24
311 ${fwcmd} table ${BAD_ADDR_TBL} add 224.0.0.0/4
312 ${fwcmd} table ${BAD_ADDR_TBL} add 240.0.0.0/4
314 ${fwcmd} add deny all from any to "table($BAD_ADDR_TBL)" via ${oif}
317 # so that it does not interfere with the surrounding address-checking
325 if [ -n "${natd_interface}" ]; then
326 ${fwcmd} add divert natd ip4 from any to any via ${natd_interface}
331 ${fwcmd} add deny all from "table($BAD_ADDR_TBL)" to any via ${oif}
332 if [ -n "$inet6" ]; then
333 # Stop unique local unicast address on the outside interface
334 ${fwcmd} add deny all from fc00::/7 to any via ${oif6}
335 ${fwcmd} add deny all from any to fc00::/7 via ${oif6}
337 # Stop site-local on the outside interface
338 ${fwcmd} add deny all from fec0::/10 to any via ${oif6}
339 ${fwcmd} add deny all from any to fec0::/10 via ${oif6}
341 # Disallow "internal" addresses to appear on the wire.
342 ${fwcmd} add deny all from ::ffff:0.0.0.0/96 to any \
344 ${fwcmd} add deny all from any to ::ffff:0.0.0.0/96 \
348 ${fwcmd} add deny all from ::224.0.0.0/100 to any via ${oif6}
349 ${fwcmd} add deny all from any to ::224.0.0.0/100 via ${oif6}
350 ${fwcmd} add deny all from ::127.0.0.0/104 to any via ${oif6}
351 ${fwcmd} add deny all from any to ::127.0.0.0/104 via ${oif6}
352 ${fwcmd} add deny all from ::0.0.0.0/104 to any via ${oif6}
353 ${fwcmd} add deny all from any to ::0.0.0.0/104 via ${oif6}
354 ${fwcmd} add deny all from ::255.0.0.0/104 to any via ${oif6}
355 ${fwcmd} add deny all from any to ::255.0.0.0/104 via ${oif6}
357 ${fwcmd} add deny all from ::0.0.0.0/96 to any via ${oif6}
358 ${fwcmd} add deny all from any to ::0.0.0.0/96 via ${oif6}
361 ${fwcmd} add deny all from 2002:e000::/20 to any via ${oif6}
362 ${fwcmd} add deny all from any to 2002:e000::/20 via ${oif6}
363 ${fwcmd} add deny all from 2002:7f00::/24 to any via ${oif6}
364 ${fwcmd} add deny all from any to 2002:7f00::/24 via ${oif6}
365 ${fwcmd} add deny all from 2002:0000::/24 to any via ${oif6}
366 ${fwcmd} add deny all from any to 2002:0000::/24 via ${oif6}
367 ${fwcmd} add deny all from 2002:ff00::/24 to any via ${oif6}
368 ${fwcmd} add deny all from any to 2002:ff00::/24 via ${oif6}
370 ${fwcmd} add deny all from 2002:0a00::/24 to any via ${oif6}
371 ${fwcmd} add deny all from any to 2002:0a00::/24 via ${oif6}
372 ${fwcmd} add deny all from 2002:ac10::/28 to any via ${oif6}
373 ${fwcmd} add deny all from any to 2002:ac10::/28 via ${oif6}
374 ${fwcmd} add deny all from 2002:c0a8::/32 to any via ${oif6}
375 ${fwcmd} add deny all from any to 2002:c0a8::/32 via ${oif6}
377 ${fwcmd} add deny all from ff05::/16 to any via ${oif6}
378 ${fwcmd} add deny all from any to ff05::/16 via ${oif6}
382 ${fwcmd} add pass tcp from any to any established
385 ${fwcmd} add pass all from any to any frag
388 ${fwcmd} add pass tcp from any to me 25 setup
391 ${fwcmd} add pass tcp from any to me 53 setup
392 ${fwcmd} add pass udp from any to me 53
393 ${fwcmd} add pass udp from me 53 to any
396 ${fwcmd} add pass tcp from any to me 80 setup
399 ${fwcmd} add deny log ip4 from any to any in via ${oif} setup proto tcp
400 if [ -n "$inet6" ]; then
401 ${fwcmd} add deny log ip6 from any to any in via ${oif6} \
406 ${fwcmd} add pass tcp from any to any setup
409 ${fwcmd} add pass udp from me to any 53 keep-state
412 ${fwcmd} add pass udp from me to any 123 keep-state
421 # firewall_myservices: List of ports/protocols on which this
440 ${fwcmd} add check-state
443 ${fwcmd} add pass tcp from me to any established
446 ${fwcmd} add pass tcp from me to any setup keep-state
447 ${fwcmd} add pass udp from me to any keep-state
448 ${fwcmd} add pass icmp from me to any keep-state
449 if [ $ipv6_available -eq 0 ]; then
450 ${fwcmd} add pass ipv6-icmp from me to any keep-state
454 ${fwcmd} add pass udp from 0.0.0.0 68 to 255.255.255.255 67 out
455 ${fwcmd} add pass udp from any 67 to me 68 in
456 ${fwcmd} add pass udp from any 67 to 255.255.255.255 68 in
457 if [ $ipv6_available -eq 0 ]; then
458 ${fwcmd} add pass udp from fe80::/10 to me 546 in
462 ${fwcmd} add pass icmp from any to any icmptype 8
463 if [ $ipv6_available -eq 0 ]; then
464 ${fwcmd} add pass ipv6-icmp from any to any icmp6type 128,129
468 ${fwcmd} add pass icmp from any to any icmptype 3,4,11
469 if [ $ipv6_available -eq 0 ]; then
470 ${fwcmd} add pass ipv6-icmp from any to any icmp6type 3
473 # Add permits for this workstations published services below
475 # If you really wish to let anyone use services on your
478 # Note: We don't use keep-state as that would allow DoS of
480 # You can add 'keep-state' to the lines for slightly
487 [0-9A-Za-z]*/[Pp][Rr][Oo][Tt][Oo])
488 ${fwcmd} add pass ${j%/[Pp][Rr][Oo][Tt][Oo]} from $i to me
490 [0-9A-Za-z]*/[Tt][Cc][Pp])
491 ${fwcmd} add pass tcp from $i to me ${j%/[Tt][Cc][Pp]}
493 [0-9A-Za-z]*/[Uu][Dd][Pp])
494 ${fwcmd} add pass udp from $i to me ${j%/[Uu][Dd][Pp]}
496 *[0-9A-Za-z])
499 ${fwcmd} add pass tcp from $i to me $j
512 ${fwcmd} add pass ip from $i to me
515 ${fwcmd} add 65000 count ip from any to any
519 ${fwcmd} add deny { tcp or udp } from any to any $i in
523 ${fwcmd} add deny ip from any to 255.255.255.255
524 ${fwcmd} add deny ip from any to 224.0.0.0/24 in # XXX
527 ${fwcmd} add deny udp from any to any 520 in
532 ${fwcmd} add deny tcp from any 80,443 to any 1024-65535 in
536 if [ ${firewall_logdeny:-x} = "YES" -o ${firewall_logdeny:-x} = "yes" ] ; then
540 ${fwcmd} add deny $log ip from any to any
544 ${fwcmd} add 65000 deny ip from any to any
549 if [ -r "${firewall_type}" ]; then