News Group Posts

ipnat ipfilter firewall example

From: Boyd Lynn Gerber <gerberb@zenez.com>
Subject: Re: Good ipnat.conf and ipf.conf for OpenServer 5.0.6a
Date: Wed, 24 Oct 2001 16:13:26 GMT

On Wed, 24 Oct 2001, Tom Parsons wrote:
> Boyd Lynn Gerber enscribed:
> | Sorry for the post I let my following of the packects confuse me.  Below
> | is a good ipnat.conf and ipf.conf set of rules that do work with
> | OpenServer ipnat and ipf.
> I damn sure wouldn't post my firewall rules to the net and neither will
> I comment about the large number of these rules or their accuracy
> EXCEPT for following which is a MAJOR hole.  I would suggest anyone
> study the ipf HOW-TO's and related documentation before implementing
> these.  They may not be what you want and they are certainly much more
> liberal that I would install.

What I should have said that these are a working set of rules to show how
you can open up any port or service and are a good example of such.  They
are a poor firewall.  They are very liberal.  They are only to demomstrate
each how to implement each type of service.

> | # flush all ipf rules
> | ipf -F a
> | ipf -f - <<EOF
>  <way too many rules>
> | EOF
>
> The above will leave the firewall wide open, possibly for a protracted
> length of time.  As a minimum, the ipf rules should be in /etc/ipf.conf
> (where the 5.0.6 expects them) and while not perfect, invoked with:
>
>   ipf -Fa -f /etc/ipf.conf

I thought that may be the case.  But I was not sure that putting them
there with those names would work.

> This is for logging and along with ipf should be started in an rc2.d script
> at the appropriate time in the startup procedure to avoid leaving the
> system open during boot.  Anyone with any amount of traffic will soon go
> nuts trying to follow this log.  Split it into 3.
>
> | ipmon > /var/adm/firewall &
>   :
>   # S84ipf - Start firewall.  This should run before external connections
>   #          are activated.
>   # start monitoring ipf and ipnat
>   /etc/ipmon -o S /usr/adm/state.log &
>   /etc/ipmon -o I /usr/adm/ipf.log &
>   /etc/ipmon -o N /usr/adm/nat.log &
>
>   # Start IP filters
>   /etc/ipf -f /etc/ipf.conf
>
>   # Kick off NAT
>   /etc/ipnat -f /etc/ipnat.conf
>   exit 0

I agree totally.  The purpose of this was not that these were good rules
but that they were good examples on how any one may use such a rule to
open the service.  I appologize for the bad use of the word good.  These
were only ment to help someone know how a service could be opened up.

I am sorry that I did not state things clear enough.  I was sick of all
the email I had received on how to open up services and to log things and
made way to general of an example.

Thanks, Tom for point out the error of my ways.

Sorry,

--
Boyd Gerber <gerberb@zenez.com>
ZENEZ   3748 Valley Forge Road, Magna Utah  84044
Office 801-250-0795 FAX 801-250-7975

Comments?

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.