Review meines Firewall Rulesets

devil

devil

devil
Hallo,
habe nach langem "read, try and error" eigene Firewallregeln definiert.
Aber ich glaube, dass ich zuviel offen habe...ist ein Einzelplatzrechner, kein NAT oder Routing.

Kann mal bitte jemand ein Review der Regeln machen oder mir sagen, wo ich ein gutes und *geprüftes* Script für IPFW2 finden kann? Danke!

devil
__________________________________
#!/bin/sh
dns="192.168.5.44,213.191.74.18,213.191.92.87"
incomingports="22,80,443"
#ntp1.fau.de,ntp2.fau.de,ntp-cup.external.hp.com,lerc-dns.lerc.nasa.gov"
ntp="131.188.3.221,131.188.3.222,192.6.38.127,128.156.1.43"
ipfw -q -f flush
ipfw add allow ip from any to any via lo0
ipfw add deny all from any to 127.0.0.0/8
ipfw add deny all from 127.0.0.0/8 to any
ipfw add allow tcp from any to any established
ipfw add allow tcp from any to any out via fxp0 setup keep-state
ipfw add allow udp from any to any out via fxp0
ipfw add allow ip from 192.168.5.0/24 to me via fxp0
ipfw add allow tcp from ${dns} 53 to me in via fxp0 setup keep-state
ipfw add allow udp from ${dns} 53 to me in via fxp0 keep-state
ipfw add allow udp from $ntp 123 to me in via fxp0
ipfw add allow udp from me 123 to $ntp out via fxp0
ipfw add allow icmp from any to any icmptype 3,4
ipfw add allow icmp from any to any out icmptype 8
ipfw add allow icmp from any to any in icmptype 0
ipfw add allow tcp from any to me ${incomingports} in via fxp0 setup keep-state
ipfw add 65534 log logamount 10 deny ip from any to any
________________________________________________-
 
Zuletzt bearbeitet von einem Moderator:
Ich persönlich benutzte an meinem FreeBSD-Heimrechner pf, da es die übersichtlichsten und trotzdem mächtigsten Regeln ergibt:

/etc/rc.conf
Code: 
pf_enable="YES"
pf_rules="/etc/pfnet.conf"
/etc/pfnet.conf
Code: 
# pf-Konfiguration
# Andreas Meyer, am 30.10.2004

# Makros
#------------------------------------------------------------------------
# Netzwerkkarten
hard_if  = "fxp0"

# Private Netzwerke
priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"

# Regeln
#-------------------------------------------------------------------------
# Keine Rueckmeldung bei Blockierungen
set block-policy drop

# scrub incoming packets
scrub in all

# setup a default deny policy
block drop in all
block drop out all

# pass traffic on the loopback interface in either direction
pass quick on lo0 all

# Blockiere den externen Verkehr mit privaten Adressen
block drop in  log quick on $hard_if from $priv_nets to any
block drop out log quick on $hard_if from any to $priv_nets

# activate spoofing protection for the internal interface.
antispoof log quick for $hard_if inet

# pass tcp, udp, and icmp out on the external (Internet) interface.
# keep state on udp and icmp and modulate state on tcp.
pass out on $hard_if proto tcp all modulate state flags S/SA
pass out on $hard_if proto { udp, icmp } all keep state

# allow ssh connections in on the external interface as long as they're
# NOT destined for the firewall (i.e., they're destined for a machine on
# the local network). log the initial packet so that we can later tell
# who is trying to connect. use the tcp syn proxy to proxy the connection.
# pass in log on $hard_if proto tcp from any to ($hard_if) port ssh flags S/SA synproxy state
Die Regeln entstammen dem Beispiel unter:
http://www.openbsd.org/faq/pf/filter.html#example
 
Du musst dich einloggen oder registrieren, um hier zu antworten.
Zurück
Oben