FreeBSD kernel settings

er det nødvendigt med en ny kerne for at få IPFW til at spille?

Ja den skal man, det skal aktiveres i kernen før det virker, og skal hilse og side det er pænt sygt IPFW, men er på arbejde nu, men min manual og guide som jeg selv laver kommer op på mit domænet http://freebsd-service.net på dansk :) dog er serveren nede pga arbejdet med firewall og DMZ områder osv.............

ok, jeg kommer jo fra linux og er ved at konvertere til BSD, men jeg synes at jeg havde læst et eller andet sted, at der var en "genvej" altså uden at lave en ny kerne.

Jeg håber ipfw minder bare lidt om iptables, ellers har jeg tabt på forhånd, orker ikke at skulle begynde forfra :)

Det er faktisk mega let -



First, you have to make a few changes to your kernel. This isn't as hard as it sounds. Su to root, cd /usr/src/sys/i386/conf, and copy GENERIC to a new file. Let's call it ACME. This will be your new kernel config. Here are the changes you need to make:
*** GENERIC    Tue Sep 14 15:53:30 1999
--- ACME        Thu Nov 18 16:27:03 1999
***************
*** 22,28 ****
  cpu          "I486_CPU"
  cpu          "I586_CPU"
  cpu          "I686_CPU"
! ident        GENERIC
  maxusers      32
 
  options      MATH_EMULATE            #Support for x87 emulation
--- 22,28 ----
  cpu          "I486_CPU"
  cpu          "I586_CPU"
  cpu          "I686_CPU"
! ident        ACME
  maxusers      32
 
  options      MATH_EMULATE            #Support for x87 emulation
***************
*** 211,213 ****
--- 211,218 ----
  # The number of devices determines the maximum number of
  # simultaneous BPF clients programs runnable.
  pseudo-device bpfilter 1      #Berkeley packet filter
+
+ # Enable ipfw and natd.
+ options IPFIREWALL
+ options IPFIREWALL_VERBOSE
+ options IPDIVERT

In other words, change the ident and add the firewall options. If you're running FreeBSD 4.x and you want to set up an IPv6 firewall too, you should also add IPV6FIREWALL and IPV6FIREWALL_VERBOSE. Note that the regular IPv4 firewall does not affect IPv6 packets at all. If you set up a v4 firewall and not a v6 firewall, all v6 packets will be allowed through. You really need to do both, or disable IPv6 altogether.
After setting up the config, build and install the new kernel:

# /usr/sbin/config ACME
# cd ../../compile/ACME
# make depend
# make
# make install


Second, edit /etc/rc.conf and add these defines to the end:
# Enable ipfw.
firewall_enable="YES"
firewall_type="type"    # see rc.firewall for what goes here
firewall_quiet="NO"

The firewall_type should be "client" to secure a single stand-alone machine, or "simple" for a gateway guarding an internal network.
If you want to do Network Address Translation, add these defines too:

# Enable natd.
natd_enable="YES"
natd_interface="fxp0"  # your public network interface
natd_flags="-m"        # preserve port numbers if possible


Og her er /etc/rc.firewall



# Set these to your outside interface network and netmask and ip.
        oif="fxp0"
        onet="63.197.1234.0"
        omask="255.255.255.0"
        oip="63.197.1234.1"

        # Set these to your inside interface network and netmask and ip.
        iif="fxp1"
        inet="192.100.666.0"
        imask="255.255.255.0"
        iip="192.100.666.1"

        # Stop spoofing
        ${fwcmd} add deny log all from ${inet}:${imask} to any in via ${oif}
        ${fwcmd} add deny log all from ${onet}:${omask} to any in via ${iif}

        # Stop RFC1918 nets on the outside interface
        ${fwcmd} add deny log all from any to 10.0.0.0/8 via ${oif}
        ${fwcmd} add deny log all from any to 172.16.0.0/12 via ${oif}
        ${fwcmd} add deny log all from any to 192.168.0.0/16 via ${oif}

        # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
        # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
        # on the outside interface
        ${fwcmd} add deny log all from any to 0.0.0.0/8 via ${oif}
        ${fwcmd} add deny log all from any to 169.254.0.0/16 via ${oif}
        ${fwcmd} add deny log all from any to 192.0.2.0/24 via ${oif}
        ${fwcmd} add deny log all from any to 224.0.0.0/4 via ${oif}
        ${fwcmd} add deny log all from any to 240.0.0.0/4 via ${oif}

        # Network Address Translation.  This rule is placed here deliberately
        # so that it does not interfere with the surrounding address-checking
        # rules.  If for example one of your internal LAN machines had its IP
        # address set to 192.0.2.1 then an incoming packet for it after being
        # translated by natd(8) would match the `deny' rule above.  Similarly
        # an outgoing packet originated from it before being translated would
        # match the `deny' rule below.
        case ${natd_enable} in
        [Yy][Ee][Ss])
                if [ -n "${natd_interface}" ]; then
                        ${fwcmd} add divert natd all from any to any via ${natd_interface}
                fi
                ;;
        esac

        # Stop RFC1918 nets on the outside interface
        ${fwcmd} add deny log all from 10.0.0.0/8 to any via ${oif}
        ${fwcmd} add deny log all from 172.16.0.0/12 to any via ${oif}
        ${fwcmd} add deny log all from 192.168.0.0/16 to any via ${oif}

        # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
        # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
        # on the outside interface
        ${fwcmd} add deny log all from 0.0.0.0/8 to any via ${oif}
        ${fwcmd} add deny log all from 169.254.0.0/16 to any via ${oif}
        ${fwcmd} add deny log all from 192.0.2.0/24 to any via ${oif}
        ${fwcmd} add deny log all from 224.0.0.0/4 to any via ${oif}
        ${fwcmd} add deny log all from 240.0.0.0/4 to any via ${oif}

        # Allow anything on the internal net
        ${fwcmd} add pass all from any to any via ${iif}

        # Allow anything outbound from this net.
        ${fwcmd} add pass all from ${onet}:${omask} to any out via ${oif}

        # Deny anything outbound from other nets.
        ${fwcmd} add deny log all from any to any out via ${oif}

        # Allow TCP through if setup succeeded.
        ${fwcmd} add pass tcp from any to any established

        # Allow IP fragments to pass through.
        ${fwcmd} add pass all from any to any frag

        # Allow all IPv6 packets through - they are handled by the separate
    # ipv6 firewall rules in rc.firewall6.
        ${fwcmd} add pass ipv6 from any to any

        # Allow inbound ftp, ssh, email, tcp-dns, http, https, pop3, pop3s.
        ${fwcmd} add pass tcp from any to ${oip} 21 setup in via ${oif}
        ${fwcmd} add pass tcp from any to ${oip} 22 setup in via ${oif}
        ${fwcmd} add pass tcp from any to ${oip} 25 setup in via ${oif}
        ${fwcmd} add pass tcp from any to ${oip} 53 setup in via ${oif}
        ${fwcmd} add pass tcp from any to ${oip} 80 setup in via ${oif}
        ${fwcmd} add pass tcp from any to ${oip} 443 setup in via ${oif}
        ${fwcmd} add pass tcp from any to ${oip} 110 setup in via ${oif}
        ${fwcmd} add pass tcp from any to ${oip} 995 setup in via ${oif}

        # Deny inbound auth, netbios, ldap, and Microsoft's DB protocol
    # without logging.
        ${fwcmd} add deny tcp from any to ${oip} 113 setup in via ${oif}
        ${fwcmd} add deny tcp from any to ${oip} 139 setup in via ${oif}
        ${fwcmd} add deny tcp from any to ${oip} 389 setup in via ${oif}
        ${fwcmd} add deny tcp from any to ${oip} 445 setup in via ${oif}

        # Deny some chatty UDP broadcast protocols without logging.
        ${fwcmd} add deny udp from any 137 to any in via ${oif}
        ${fwcmd} add deny udp from any to any 137 in via ${oif}
        ${fwcmd} add deny udp from any 138 to any in via ${oif}
        ${fwcmd} add deny udp from any 513 to any in via ${oif}
        ${fwcmd} add deny udp from any 525 to any in via ${oif}

        # Allow inbound DNS and NTP replies.  This is somewhat of a hole,
        # since we're looking at the incoming port number, which can be
        # faked, but that's just the way DNS and NTP work.
        ${fwcmd} add pass udp from any 53 to ${oip} in via ${oif}
        ${fwcmd} add pass udp from any 123 to ${oip} in via ${oif}

        # Allow inbound DNS queries.
        ${fwcmd} add pass udp from any to ${oip} 53 in via ${oif}

        # Deny inbound NTP queries without logging.
        ${fwcmd} add deny udp from any to ${oip} 123 in via ${oif}

        # Allow traceroute to function, but not to get in.
        ${fwcmd} add unreach port udp from any to ${oip} 33435-33524 in via ${oif}

        # Allow some inbound icmps - echo reply, dest unreach, source quench,
        # echo, ttl exceeded.
        ${fwcmd} add pass icmp from any to any in via ${oif} icmptypes 0,3,4,8,11

        # Broadcasts are denied and not logged.
        ${fwcmd} add deny all from any to 255.255.255.255

        # Everything else is denied and logged.
        ${fwcmd} add deny log all from any to any


Færdig :)

tak for eksemplet.. du har helt ret, det ser ikke så¨besværligt ud. ipfp (ligner) også meget iptables - skal bare lige sætte mig ind i den nye syntaks.. men det går nok.

Jeg har jo tidligere lavet en iptables generator til Linux ( http://iptables.linux.dk ) kender du til noget tilsvarende til BSD? (Jeg har ikke googlet rundt endnu), det var bare lige hvis du kendte noget lignende allerede. ?

Ellers tak for info iøvrigt... Jeg burde vel give dig point :o)

Nøj den er gammel, sidder lige og ryder op du er jo sikkert blevet vold syg siden sidst hehe.

Men det gør der her: http://ipfwgen.sourceforge.net/