1*0Sstevel@tonic-gate#!/sbin/ipf -f - 2*0Sstevel@tonic-gate# 3*0Sstevel@tonic-gate# SAMPLE: RESTRICTIVE FILTER RULES 4*0Sstevel@tonic-gate# 5*0Sstevel@tonic-gate# THIS EXAMPLE IS WRITTEN FOR IP FILTER 3.3 6*0Sstevel@tonic-gate# 7*0Sstevel@tonic-gate# ppp0 - (external) PPP connection to ISP, address a.b.c.d/32 8*0Sstevel@tonic-gate# 9*0Sstevel@tonic-gate# ed0 - (internal) network interface, address w.x.y.z/32 10*0Sstevel@tonic-gate# 11*0Sstevel@tonic-gate# This file contains the basic rules needed to construct a firewall for the 12*0Sstevel@tonic-gate# above situation. 13*0Sstevel@tonic-gate# 14*0Sstevel@tonic-gate#------------------------------------------------------- 15*0Sstevel@tonic-gate# *Nasty* packets we don't want to allow near us at all! 16*0Sstevel@tonic-gate# short packets which are packets fragmented too short to be real. 17*0Sstevel@tonic-gateblock in log quick all with short 18*0Sstevel@tonic-gate#------------------------------------------------------- 19*0Sstevel@tonic-gate# Group setup. 20*0Sstevel@tonic-gate# ============ 21*0Sstevel@tonic-gate# By default, block and log everything. This maybe too much logging 22*0Sstevel@tonic-gate# (especially for ed0) and needs to be further refined. 23*0Sstevel@tonic-gate# 24*0Sstevel@tonic-gateblock in log on ppp0 all head 100 25*0Sstevel@tonic-gateblock in log proto tcp all flags S/SA head 101 group 100 26*0Sstevel@tonic-gateblock out log on ppp0 all head 150 27*0Sstevel@tonic-gateblock in log on ed0 from w.x.y.z/24 to any head 200 28*0Sstevel@tonic-gateblock in log proto tcp all flags S/SA head 201 group 200 29*0Sstevel@tonic-gateblock in log proto udp all head 202 group 200 30*0Sstevel@tonic-gateblock out log on ed0 all head 250 31*0Sstevel@tonic-gate#------------------------------------------------------- 32*0Sstevel@tonic-gate# Localhost packets. 33*0Sstevel@tonic-gate# ================== 34*0Sstevel@tonic-gate# packets going in/out of network interfaces that aren't on the loopback 35*0Sstevel@tonic-gate# interface should *NOT* exist. 36*0Sstevel@tonic-gateblock in log quick from 127.0.0.0/8 to any group 100 37*0Sstevel@tonic-gateblock in log quick from any to 127.0.0.0/8 group 100 38*0Sstevel@tonic-gateblock in log quick from 127.0.0.0/8 to any group 200 39*0Sstevel@tonic-gateblock in log quick from any to 127.0.0.0/8 group 200 40*0Sstevel@tonic-gate# And of course, make sure the loopback allows packets to traverse it. 41*0Sstevel@tonic-gatepass in quick on lo0 all 42*0Sstevel@tonic-gatepass out quick on lo0 all 43*0Sstevel@tonic-gate#------------------------------------------------------- 44*0Sstevel@tonic-gate# Invalid Internet packets. 45*0Sstevel@tonic-gate# ========================= 46*0Sstevel@tonic-gate# 47*0Sstevel@tonic-gate# Deny reserved addresses. 48*0Sstevel@tonic-gate# 49*0Sstevel@tonic-gateblock in log quick from 10.0.0.0/8 to any group 100 50*0Sstevel@tonic-gateblock in log quick from 192.168.0.0/16 to any group 100 51*0Sstevel@tonic-gateblock in log quick from 172.16.0.0/12 to any group 100 52*0Sstevel@tonic-gate# 53*0Sstevel@tonic-gate# Prevent IP spoofing. 54*0Sstevel@tonic-gate# 55*0Sstevel@tonic-gateblock in log quick from a.b.c.d/24 to any group 100 56*0Sstevel@tonic-gate# 57*0Sstevel@tonic-gate#------------------------------------------------------- 58*0Sstevel@tonic-gate# Allow outgoing DNS requests (no named on firewall) 59*0Sstevel@tonic-gate# 60*0Sstevel@tonic-gatepass in quick proto udp from any to any port = 53 keep state group 202 61*0Sstevel@tonic-gate# 62*0Sstevel@tonic-gate# If we were running named on the firewall and all internal hosts talked to 63*0Sstevel@tonic-gate# it, we'd use the following: 64*0Sstevel@tonic-gate# 65*0Sstevel@tonic-gate#pass in quick proto udp from any to w.x.y.z/32 port = 53 keep state group 202 66*0Sstevel@tonic-gate#pass out quick on ppp0 proto udp from a.b.c.d/32 to any port = 53 keep state 67*0Sstevel@tonic-gate# 68*0Sstevel@tonic-gate# Allow outgoing FTP from any internal host to any external FTP server. 69*0Sstevel@tonic-gate# 70*0Sstevel@tonic-gatepass in quick proto tcp from any to any port = ftp keep state group 201 71*0Sstevel@tonic-gatepass in quick proto tcp from any to any port = ftp-data keep state group 201 72*0Sstevel@tonic-gatepass in quick proto tcp from any port = ftp-data to any port > 1023 keep state group 101 73*0Sstevel@tonic-gate# 74*0Sstevel@tonic-gate# Allow NTP from any internal host to any external NTP server. 75*0Sstevel@tonic-gate# 76*0Sstevel@tonic-gatepass in quick proto udp from any to any port = ntp keep state group 202 77*0Sstevel@tonic-gate# 78*0Sstevel@tonic-gate# Allow outgoing connections: SSH, TELNET, WWW 79*0Sstevel@tonic-gate# 80*0Sstevel@tonic-gatepass in quick proto tcp from any to any port = 22 keep state group 201 81*0Sstevel@tonic-gatepass in quick proto tcp from any to any port = telnet keep state group 201 82*0Sstevel@tonic-gatepass in quick proto tcp from any to any port = www keep state group 201 83*0Sstevel@tonic-gate# 84*0Sstevel@tonic-gate#------------------------------------------------------- 85*0Sstevel@tonic-gateblock in log proto tcp from any to a.b.c.d/32 flags S/SA head 110 group 100 86*0Sstevel@tonic-gate# 87*0Sstevel@tonic-gate# Allow incoming to the external firewall interface: mail, WWW, DNS 88*0Sstevel@tonic-gate# 89*0Sstevel@tonic-gatepass in log quick proto tcp from any to any port = smtp keep state group 110 90*0Sstevel@tonic-gatepass in log quick proto tcp from any to any port = www keep state group 110 91*0Sstevel@tonic-gatepass in log quick proto tcp from any to any port = 53 keep state group 110 92*0Sstevel@tonic-gatepass in log quick proto udp from any to any port = 53 keep state group 100 93*0Sstevel@tonic-gate#------------------------------------------------------- 94*0Sstevel@tonic-gate# Log these: 95*0Sstevel@tonic-gate# ========== 96*0Sstevel@tonic-gate# * return RST packets for invalid SYN packets to help the other end close 97*0Sstevel@tonic-gateblock return-rst in log proto tcp from any to any flags S/SA group 100 98*0Sstevel@tonic-gate# * return ICMP error packets for invalid UDP packets 99*0Sstevel@tonic-gateblock return-icmp(net-unr) in proto udp all group 100 100