1*bc4097aaSchristosConfiguring IP Filter for firewall usage. 2*bc4097aaSchristos========================================= 3*bc4097aaSchristos 4*bc4097aaSchristosStep 1 - Block out "bad" IP packets. 5*bc4097aaSchristos------------------------------------ 6*bc4097aaSchristos 7*bc4097aaSchristosRun the perl script "mkfilters". This will generate a list of blocking 8*bc4097aaSchristosrules which: 9*bc4097aaSchristos a) blocks all packets which might belong to an IP Spoofing attack; 10*bc4097aaSchristos b) blocks all packets with IP options; 11*bc4097aaSchristos c) blocks all packets which have a length which is too short for 12*bc4097aaSchristos any legal packet; 13*bc4097aaSchristos 14*bc4097aaSchristosStep 2 - Convert Network Security Policy to filter rules. 15*bc4097aaSchristos--------------------------------------------------------- 16*bc4097aaSchristos 17*bc4097aaSchristosDraw up a list of which services you want to allow users to use on the 18*bc4097aaSchristosInternet (e.g. WWW, ftp, etc). Draw up a separate list for what you 19*bc4097aaSchristoswant each host that is part of your firewall to be allowed to do, including 20*bc4097aaSchristoscommunication with internal hosts. 21*bc4097aaSchristos 22*bc4097aaSchristosStep 3 - Create TCP "keep state" rules. 23*bc4097aaSchristos--------------------------------------- 24*bc4097aaSchristos 25*bc4097aaSchristosFor each service that uses TCP, create a rule as follows: 26*bc4097aaSchristos 27*bc4097aaSchristospass in on <int-a> proto tcp from <int-net> to any port <ext-service> flags S/SA keep state 28*bc4097aaSchristos 29*bc4097aaSchristoswhere 30*bc4097aaSchristos* "int-a" is the internal interface of the firewall. That is, it is the 31*bc4097aaSchristos closest to your internal network in terms of network hops. 32*bc4097aaSchristos 33*bc4097aaSchristos* "int-net" is the internal network IP# subnet address range. This might 34*bc4097aaSchristos be something like 10.1.0.0/16, or 128.33.1.0/24 35*bc4097aaSchristos 36*bc4097aaSchristos* "ext-service" is the service to which you wish to connect or if it doesn't 37*bc4097aaSchristos have a proper name, a number can be used. The translation of "ext-service" 38*bc4097aaSchristos as a name to a number is controlled with the /etc/services file. 39*bc4097aaSchristos 40