2 # Setup system for firewall service.
3 # $Id: rc.firewall,v 1.18 1998/04/18 10:27:05 brian Exp $
5 if [ -f /etc/rc.conf ]; then
10 # Define the firewall type in /etc/rc.conf. Valid values are:
11 # open - will allow anyone in
12 # client - will try to protect just this machine
13 # simple - will try to protect a whole network
14 # closed - totally disables IP services except via lo0 interface
15 # UNKNOWN - disables the loading of firewall rules.
16 # filename - will load the rules in the given filename (full path required)
18 # For ``client'' and ``simple'' the entries below should be customized
23 # If you don't know enough about packet filtering, we suggest that you
24 # take time to read this book:
26 # Building Internet Firewalls
27 # Brent Chapman and Elizabeth Zwicky
29 # O'Reilly & Associates, Inc
33 # For a more advanced treatment of Internet Security read:
35 # Firewalls & Internet Security
36 # Repelling the wily hacker
37 # William R. Cheswick, Steven M. Bellowin
44 if [ "x$1" != "x" ]; then
49 # Set quiet mode if requested
50 if [ "x$firewall_quiet" = "xYES" ]; then
57 # Flush out the list before we begin.
61 # These rules are required for using natd. All packets are passed to
62 # natd before they encounter your remaining rules. The firewall rules
63 # will then be run again on each packet after translation by natd,
64 # minus any divert rules (see natd(8)).
65 if [ "X${natd_enable}" = X"YES" -a "X${natd_interface}" != X"" ]; then
66 $fwcmd add divert natd all from any to any via ${natd_interface}
70 # If you just configured ipfw in the kernel as a tool to solve network
71 # problems or you just want to disallow some particular kinds of traffic
72 # they you will want to change the default policy to open. You can also
73 # do this as your only action by setting the firewall_type to ``open''.
75 # $fwcmd add 65000 pass all from any to any
78 # Only in rare cases do you want to change these rules
79 $fwcmd add 100 pass all from any to any via lo0
80 $fwcmd add 200 deny all from any to 127.0.0.0/8
84 if [ "${firewall_type}" = "open" -o "${firewall_type}" = "OPEN" ]; then
86 $fwcmd add 65000 pass all from any to any
88 elif [ "${firewall_type}" = "client" ]; then
91 # This is a prototype setup that will protect your system somewhat against
92 # people from outside your own network.
95 # set these to your network and netmask and ip
100 # Allow any traffic to or from my own net.
101 $fwcmd add pass all from ${ip} to ${net}:${mask}
102 $fwcmd add pass all from ${net}:${mask} to ${ip}
104 # Allow TCP through if setup succeeded
105 $fwcmd add pass tcp from any to any established
107 # Allow setup of incoming email
108 $fwcmd add pass tcp from any to ${ip} 25 setup
110 # Allow setup of outgoing TCP connections only
111 $fwcmd add pass tcp from ${ip} to any setup
113 # Disallow setup of all other TCP connections
114 $fwcmd add deny tcp from any to any setup
116 # Allow DNS queries out in the world
117 $fwcmd add pass udp from any 53 to ${ip}
118 $fwcmd add pass udp from ${ip} to any 53
120 # Allow NTP queries out in the world
121 $fwcmd add pass udp from any 123 to ${ip}
122 $fwcmd add pass udp from ${ip} to any 123
124 # Everything else is denied as default.
126 elif [ "${firewall_type}" = "simple" ]; then
129 # This is a prototype setup for a simple firewall. Configure this machine
130 # as a named server and ntp server, and point all the machines on the inside
131 # at this machine for those services.
134 # set these to your outside interface network and netmask and ip
137 omask="255.255.255.0"
140 # set these to your inside interface network and netmask and ip
143 imask="255.255.255.0"
147 $fwcmd add deny all from ${inet}:${imask} to any in via ${oif}
148 $fwcmd add deny all from ${onet}:${omask} to any in via ${iif}
150 # Stop RFC1918 nets on the outside interface
151 $fwcmd add deny all from 192.168.0.0:255.255.0.0 to any via ${oif}
152 $fwcmd add deny all from any to 192.168.0.0:255.255.0.0 via ${oif}
153 $fwcmd add deny all from 172.16.0.0:255.240.0.0 to any via ${oif}
154 $fwcmd add deny all from any to 172.16.0.0:255.240.0.0 via ${oif}
155 $fwcmd add deny all from 10.0.0.0:255.0.0.0 to any via ${oif}
156 $fwcmd add deny all from any to 10.0.0.0:255.0.0.0 via ${oif}
158 # Allow TCP through if setup succeeded
159 $fwcmd add pass tcp from any to any established
161 # Allow setup of incoming email
162 $fwcmd add pass tcp from any to ${oip} 25 setup
164 # Allow access to our DNS
165 $fwcmd add pass tcp from any to ${oip} 53 setup
167 # Allow access to our WWW
168 $fwcmd add pass tcp from any to ${oip} 80 setup
170 # Reject&Log all setup of incoming connections from the outside
171 $fwcmd add deny log tcp from any to any in via ${oif} setup
173 # Allow setup of any other TCP connection
174 $fwcmd add pass tcp from any to any setup
176 # Allow DNS queries out in the world
177 $fwcmd add pass udp from any 53 to ${oip}
178 $fwcmd add pass udp from ${oip} to any 53
180 # Allow NTP queries out in the world
181 $fwcmd add pass udp from any 123 to ${oip}
182 $fwcmd add pass udp from ${oip} to any 123
184 # Everything else is denied as default.
186 elif [ "${firewall_type}" != "UNKNOWN" -a -r "${firewall_type}" ]; then
187 $fwcmd ${firewall_type}