APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

ipnat ipfilter firewall example


What is this stuff?

If this isn't exactly what you wanted, please try our Search (there's a LOT of techy and non-techy stuff here about Linux, Unix, Mac OS X and just computers in general!):



Subject: Good ipnat.conf and ipf.conf for OpenServer 5.0.6a
Date: Wed, 24 Oct 2001 04:39:44 GMT
From: Boyd Lynn Gerber <gerberb@zenez.com>

Sorry for the post I let my following of the packects confuse me.  Below
is a good ipnat.conf and ipf.conf set of rules that do work with
OpenServer ipnat and ipf.

I hope this helps someone else.



Good Luck,

--
Boyd Gerber <gerberb@zenez.com>
ZENEZ   3748 Valley Forge Road, Magna Utah  84044
Office 801-250-0795 FAX 801-250-7975

---------------------------Cut
Here--------------------------------------
#
#       NAT rules
#
# NAT rules below are in /usr/local/bin/natsetup and these are all run
# from /etc/rc2.d/S99aroute
#
# flush all nat rules
ipnat -F
ipnat -C
ipnat -f - <<EOF
map net1 192.168.1.0/24 -> 0.0.0.0/32
EOF
#
---------------------------Cut
Here--------------------------------------

---------------------------Cut
Here--------------------------------------
#!/bin/sh
#
#       ipf rules
#
# NAT rules below are in /usr/local/bin/firewallsetup and these are all
# run from my /etc/rc2.d/S99aroute
#
#       Firewall for ppp0 when connected via ppp0 to internet.
#       Firewall for net1 when connected via cable modem/dsl to
internet.
#
#       Note I have a personal Class C on net0 with IP X.X.X.X
#       I will use the same 20.20.20.0/24
#       IPF-How-to from <http://www.obfuscation.org/ipf/>
#
#              IP Filter Based Firewalls HOWTO
#
#              Brendan Conoboy <synk@swcp.com>
#            Erik Fichtner <emf@obfuscation.org>
#
#
#       and a ISP sub Class C on net0 with IP 166.70.1.0/28
#
#       Private Network Numbers
#       10.0.0.0/8      Class A
#       172.16.0.0/12   Class B
#       192.168.0.0/16  Class C
#
#
#
#       Block Multicast Class D and E # 224.0.0.0/3
#
#       IANA assigned auto-configuration for not assigned DHCP
#       169.254.0.0/16
#
#
#block in log quick all with ipopts
#block in log quick all with short
#block in log quick all with frag
#block in log all
#
#MYIP is the fixed IP address I got for a cable modem.
#MYIP=65.1.1.110
#
# 192.168.1.0/24 is the private non routeable IP I am using with NAT
#
#MYNET0 is the Routeable Class C I got many years ago and my ISP
assigned
# IP with subnet of 16 IP numbers. Note I mine start a 0.
#MYNET0=20.20.20.0/24 and 166.70.1.0/28
#
# 20.20.20.0 is the Class C with a netmask of 255.255.255.0
# 166.70.1.0 is a subnetted Class C from ISP with a netmask of
255.255.255.240
#
# NAT rules below are in /usr/local/bin/natsetup and these are all run
# from /etc/rc2.d/S99aroute
#
# flush all nat rules
#ipnat -F
#ipnat -C
#ipnat -f - <<EOF1
#map net1 192.168.1.0/24 -> 0.0.0.0/32
#EOF1
#
# IPF filter rules
#
# Port Number           Service Type
# 20/21                 ftp
# 22                    ssh
# 23                    telnet
# 25                    smtp
# 37                    timeserver
# 42                    nameserver
# 43                    whois
# 53                    domain nameserver
# 79                    finger
# 80                    http
# 110                   pop3
# 113                   auth
# 119                   nntp
# 123                   ntp
# 143                   imap
# 443                   SSL (http)
# 517                   talk
# 518                   ntalk
# 540                   tcp over IP
#
# flush all ipf rules
ipf -F a
ipf -f - <<EOF
block in ppp0 all
block in net1 all
pass in quick on lo0 proto tcp/udp from 127.0.0.1 to 127.0.0.1
pass in quick on lo0 proto icmp from 127.0.0.1 to 127.0.0.1
pass out quick on lo0 proto tcp/udp from 127.0.0.1 to 127.0.0.1
pass out quick on lo0 proto icmp from 127.0.0.1 to 127.0.0.1
pass in quick on atl0 all
pass out quick on atl0 all
pass in quick on net0 all
pass out quick on net0 all
pass in quick on lo0 from any to any
pass out quick on lo0 from any to any
pass out quick on ppp0 all
pass out quick on net1 all

# ppp0 starts here
#
#block in ppp0 all
pass out quick on ppp0 proto tcp/udp from 20.20.20.0 to any keep state
pass out quick on ppp0 proto tcp/udp from 166.70.1.0 to any keep state
pass out quick on ppp0 proto icmp from 20.20.20.0 to any keep state
pass out quick on ppp0 proto icmp from 166.70.1.0 to any keep state

block in quick on ppp0 all with ipopts
block in quick on ppp0 all with short
block in quick on ppp0 all with frag
block in quick on ppp0 proto tcp all flags FUP
block in quick on ppp0 from 255.255.255.255/32 to any
block in quick on ppp0 from 192.168.0.0/16 to any
block in quick on ppp0 from 172.16.0.0/12 to any
block in quick on ppp0 from 127.0.0.0/8 to any
block in quick on ppp0 from 10.0.0.0/8 to any
block in quick on ppp0 from 0.0.0.0/32 to any
block in quick on ppp0 from 169.254.0.0/16 to any
block in quick on ppp0 from 192.0.2.0/24 to any
block in quick on ppp0 from 204.152.64.0/23 to any
block in quick on ppp0 from 224.0.0.0/3 to any
block in quick on ppp0 from any to 1.1.1.0/29
block in quick on ppp0 from any to 1.1.1.255/29
#pass out quick on ppp0 proto tcp/udp from 20.20.20.0/24 to any keep
state
#pass out quick on ppp0 proto icmp from 20.20.20.0/24 to any keep state
#pass out quick on ppp0 proto tcp/udp from 166.70.1.0/28 to any keep
state
#pass out quick on ppp0 proto icmp from 166.70.1.0/28 to any keep state
pass in quick on ppp0 proto icmp from any to 20.20.20.0/24 icmp-type 0
pass in quick on ppp0 proto icmp from any to 20.20.20.0/24 icmp-type 3
pass in quick on ppp0 proto icmp from any to 20.20.20.0/24 icmp-type 8
pass in quick on ppp0 proto icmp from any to 20.20.20.0/24 icmp-type 11
pass in quick on ppp0 proto icmp from any to 166.70.1.0/28 icmp-type 0
pass in quick on ppp0 proto icmp from any to 166.70.1.0/28 icmp-type 3
pass in quick on ppp0 proto icmp from any to 166.70.1.0/28 icmp-type 8
pass in quick on ppp0 proto icmp from any to 166.70.1.0/28 icmp-type 11
block in log quick on ppp0 proto icmp from any to any
pass out quick on ppp0 proto tcp from any to any keep state
pass out quick on ppp0 proto udp from any to any keep state
pass out quick on ppp0 proto icmp from any to any keep state
pass in on ppp0 proto tcp from any port = ftp-data to any port 20
pass in quick on ppp0 proto tcp from any to any port = 21 flags S keep
state
pass in quick proto tcp from any to any port 60000 >< 65535 flags S keep
state
pass in quick on ppp0 proto tcp from any to any port = 20
pass in quick on ppp0 proto tcp from any to any port = 21 flags S
pass in quick on ppp0 proto tcp from any to any port = 21 flags S keep
state
pass in quick on ppp0 proto tcp from any to any port = 22 flags S keep
state
pass in quick on ppp0 proto tcp from any to any port = 23 flags S keep
state
pass in quick on ppp0 proto tcp from any to any port = 25 flags S keep
state
pass in quick on ppp0 proto tcp/udp from any to any port = 37 keep state
pass in quick on ppp0 proto tcp/udp from any to any port = 42 keep state
pass in quick on ppp0 proto tcp/udp from any to any port = 43 keep state
pass in quick on ppp0 proto tcp from any to any port = 53 flags S keep
state
pass in quick on ppp0 proto udp from any to any port = 53 keep state
pass in quick on ppp0 proto udp from any to any port = 161 keep state
pass in quick on ppp0 proto udp from any to any port = 162 keep state
pass in quick on ppp0 proto tcp from any to any port = 79 flags S keep
state
pass in quick on ppp0 proto tcp from any to any port = 80 flags S keep
state
pass in quick on ppp0 proto tcp from any to any port = 119 flags S keep
state
pass in quick on ppp0 proto tcp/udp from any to any port = 123 keep
state
pass in quick on ppp0 proto tcp from any to any port = 443 flags S keep
state
pass in quick on ppp0 proto tcp from any to any port = 540 flags S keep
state
pass in quick on ppp0 proto udp from any to any port = 517 keep state
pass in quick on ppp0 proto udp from any to any port = 518 keep state
block return-rst in on ppp0 proto tcp from any to any port = 113
block return-icmp(net-unr) in on ppp0 proto udp from any to any
block return-icmp-as-dest(port-unr) in quick on ppp0 from any to any
port = 110
block return-icmp-as-dest(port-unr) in quick on ppp0 from any to any
port = 143
pass in on ppp0 proto udp from any port = 53 to any



# Net1 starts here
#
#block in net1 all
pass out quick on net1 proto tcp/udp from 65.1.1.110/32 to any keep
state
pass out quick on net1 proto icmp from 65.1.1.110/32 to any keep state

block in quick on net1 all with ipopts
block in quick on net1 all with short
block in quick on net1 all with frag

#pass in quick on net1 proto tcp/udp from 65.1.1.110 to any keep state
#pass in quick on net1 proto icmp from 65.1.1.110 to any keep state

block in quick on net1 proto tcp all flags FUP
block in quick on net1 from 255.255.255.255/32 to any
block in quick on net1 from 192.168.0.0/16 to any
block in quick on net1 from 172.16.0.0/12 to any
block in quick on net1 from 127.0.0.0/8 to any
block in quick on net1 from 10.0.0.0/8 to any
block in quick on net1 from 0.0.0.0/32 to any
block in quick on net1 from 169.254.0.0/16 to any
block in quick on net1 from 192.0.2.0/24 to any
block in quick on net1 from 204.152.64.0/23 to any
block in quick on net1 from 224.0.0.0/3 to any
block in quick on net1 from any to 1.1.1.0/29
block in quick on net1 from any to 1.1.1.255/29
#pass in quick on net1 proto icmp from any to 65.1.1.110/32 to any keep
state
pass in quick on net1 proto icmp from any to 65.1.1.110/32 icmp-type 0
pass in quick on net1 proto icmp from any to 65.1.1.110/32 icmp-type 3
pass in quick on net1 proto icmp from any to 65.1.1.110/32 icmp-type 8
pass in quick on net1 proto icmp from any to 65.1.1.110/32 icmp-type 11
#pass in quick on net1 proto icmp from any to 65.1.1.110/32 to icmp-type
0
#pass in quick on net1 proto icmp from any to 65.1.1.110/32 to icmp-type
3
#pass in quick on net1 proto icmp from any to 65.1.1.110/32 to icmp-type
8
#pass in quick on net1 proto icmp from any to 65.1.1.110/32 to icmp-type
11
#pass in quick on net1 proto icmp from 0.0.0.0/8 to 65.1.1.110/32 to any
keep state
pass in quick on net1 proto icmp from 0.0.0.0/8 to 65.1.1.110/32
icmp-type 0
pass in quick on net1 proto icmp from 0.0.0.0/8 to 65.1.1.110/32
icmp-type 3
pass in quick on net1 proto icmp from 0.0.0.0/8 to 65.1.1.110/32
icmp-type 8
pass in quick on net1 proto icmp from 0.0.0.0/8 to 65.1.1.110/32
icmp-type 11
block in log quick on net1 proto icmp from any to any
pass out quick on net1 proto tcp from any to any keep state
pass out quick on net1 proto udp from any to any keep state
pass out quick on net1 proto icmp from any to any keep state
pass in on net1 proto tcp from any port = ftp-data to any port 20
pass in quick on net1 proto tcp from any to any port = 21 flags S keep
state
#pass in quick proto tcp from any to any port 60000 >< 65535 flags S
keep state
pass in quick on net1 proto tcp from any to any port = 20
pass in quick on net1 proto tcp from any to any port = 21 flags S
pass in quick on net1 proto tcp from any to any port = 21 flags S keep
state
pass in quick on net1 proto tcp from any to any port = 22 flags S keep
state
#pass in quick on net1 proto tcp from any to any port = 23 flags S keep
state
pass in quick on net1 proto tcp from any to any port = 25 flags S keep
state
pass in quick on net1 proto tcp/udp from any to any port = 37 keep state
pass in quick on net1 proto tcp/udp from any to any port = 42 keep state
#pass in quick on net1 proto tcp/udp from any to any port = 43 keep
state
pass in quick on net1 proto tcp from any to any port = 53 flags S keep
state
pass in quick on net1 proto udp from any to any port = 53 keep state
pass in quick on net1 proto udp from any to any port = 161 keep state
pass in quick on net1 proto udp from any to any port = 162 keep state
pass in quick on net1 proto tcp from any to any port = 79 flags S keep
state
pass in quick on net1 proto tcp from any to any port = 80 flags S keep
state
#pass in quick on net1 proto tcp from any to any port = 119 flags S keep
state
pass in quick on net1 proto tcp/udp from any to any port = 123 keep
state
pass in quick on net1 proto tcp from any to any port = 443 flags S keep
state
pass in quick on net1 proto tcp from any to any port = 540 flags S keep
state
pass in quick on net1 proto udp from any to any port = 517 keep state
pass in quick on net1 proto udp from any to any port = 518 keep state
block return-rst in on net1 proto tcp from any to any port = 113
block return-icmp(net-unr) in on net1 proto udp from any to any
block return-icmp-as-dest(port-unr) in quick on net1 from any to any
port = 110
block return-icmp-as-dest(port-unr) in quick on net1 from any to any
port = 143
pass in on net1 proto udp from any port = 53 to any
EOF
ipmon > /var/adm/firewall &
#ipmon >> /var/adm/firewall &
---------------------------Cut
Here--------------------------------------



Got something to add? Send me email.





(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> -> ipnat ipfilter firewall example ––>Good ipnat.conf andipf.conf for OpenServer 5.0.6a



Increase ad revenue 50-250% with Ezoic

Kerio Samepage


Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us





Any problem in computer science can be solved with another level of indirection. (David Wheeler)





This post tagged: