News Group Posts

ipfilter security logging

Newsgroups: comp.unix.sco.misc
From: Tom Parsons <cis@tegan.com>
Subject: Re: ipfilter and ftp questions:
Date: Sun, 5 Nov 2000 20:54:27 GMT
Message-ID: <20001105145427.29743@tegan.com> 
References: <3a05af5f$0$35014$2c3edae7@news.voyager.net> 

- bill - enscribed:
| Here is my first try at a ipfilter rule set.
| I want to permit www, DNS, and outgoing and incoming ftp.
| I don't have a rule for incoming ftp and would appreciate suggestions.
| The ftp client is a relativel dumb windoze drag-and-lose client and I
| can influence but not command the user to get a different one.  The ftp
| server is (as of now) the 5.0.5 ftp server (I can install another if
| necessary and if the binary is available for 5.0.5)
| 
| I would appreciate comments and suggestions:
| 
| # /etc/ipf.rules
| # rules for ipfilter
| #block all except DNS, WWW, 
| block in       on net0

I suggest you add log to the above to allow you to see what kind of
crap is knocking on your door.

| # prevent spoofing
| block in quick on net0 from 192.168.0.0/16 to any
| block in quick on net0 from 172.16.0.0/12  to any
| block in quick on net0 from 10.0.0.0/8     to any
| block in quick on net0 from 127.0.0.0/24   to any

These are 4 are superflous because you already have:
   block in all on net0

| block in quick on net0 from any to 192.168.0.0/16
| block in quick on net0 from any to 172.16.0.0/12
| block in quick on net0 from any to 10.0.0.0/8
| block in quick on net0 from any to 127.0.0.0/24

These should be block out, not in.

#allow DNS lookups
pass in  quick on net0 proto tcp     from any to  216.93.126.13/32 port
= 53 flags S keep state
pass in  quick on net0 proto udp     from any to  216.93.126.13/32 port
= 53 flags S keep state

Use proto tcp/udp where ever possible.

ftp is more of a PITA and I don't know these are the most efficient rules
but they do work.

pass out quick on net1 proto tcp from x.x.x.x/32 to any port = 20 keep state
pass out quick on net1 proto tcp from x.x.x.x/32 to any port = 21 keep state

pass in log quick on net1 proto tcp/udp from any to x.x.x.x/32 port = 20 
keep state
pass in log quick on net1 proto tcp/udp from any to x.x.x.x/32 port = 21 
keep state

Of course, if you can restrict your ftp access to specific ip numbers
(recommended if you don't have a public server).

--tom 
==========================================================================
 Tom Parsons            tom@tegan.com          
==========================================================================    

Comments?

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.