Get APLawrence.com by RSSipnat ipfilter firewall example
What is this stuff?
If this isn't exactly what you wanted, please try our Search (there's a LOT of techy and non-techy stuff here about Linux, Unix, Mac OS X and just computers in general!):
Subject: Good ipnat.conf and ipf.conf for OpenServer 5.0.6a Date: Wed, 24 Oct 2001 04:39:44 GMT From: Boyd Lynn Gerber <gerberb@zenez.com> Sorry for the post I let my following of the packects confuse me. Below is a good ipnat.conf and ipf.conf set of rules that do work with OpenServer ipnat and ipf. I hope this helps someone else.
Good Luck, -- Boyd Gerber <gerberb@zenez.com> ZENEZ 3748 Valley Forge Road, Magna Utah 84044 Office 801-250-0795 FAX 801-250-7975 ---------------------------Cut Here-------------------------------------- # # NAT rules # # NAT rules below are in /usr/local/bin/natsetup and these are all run # from /etc/rc2.d/S99aroute # # flush all nat rules ipnat -F ipnat -C ipnat -f - <<EOF map net1 192.168.1.0/24 -> 0.0.0.0/32 EOF # ---------------------------Cut Here-------------------------------------- ---------------------------Cut Here-------------------------------------- #!/bin/sh # # ipf rules # # NAT rules below are in /usr/local/bin/firewallsetup and these are all # run from my /etc/rc2.d/S99aroute # # Firewall for ppp0 when connected via ppp0 to internet. # Firewall for net1 when connected via cable modem/dsl to internet. # # Note I have a personal Class C on net0 with IP X.X.X.X # I will use the same 20.20.20.0/24 # IPF-How-to from <http://www.obfuscation.org/ipf/> # # IP Filter Based Firewalls HOWTO # # Brendan Conoboy <synk@swcp.com> # Erik Fichtner <emf@obfuscation.org> # # # and a ISP sub Class C on net0 with IP 166.70.1.0/28 # # Private Network Numbers # 10.0.0.0/8 Class A # 172.16.0.0/12 Class B # 192.168.0.0/16 Class C # # # # Block Multicast Class D and E # 224.0.0.0/3 # # IANA assigned auto-configuration for not assigned DHCP # 169.254.0.0/16 # # #block in log quick all with ipopts #block in log quick all with short #block in log quick all with frag #block in log all # #MYIP is the fixed IP address I got for a cable modem. #MYIP=65.1.1.110 # # 192.168.1.0/24 is the private non routeable IP I am using with NAT # #MYNET0 is the Routeable Class C I got many years ago and my ISP assigned # IP with subnet of 16 IP numbers. Note I mine start a 0. #MYNET0=20.20.20.0/24 and 166.70.1.0/28 # # 20.20.20.0 is the Class C with a netmask of 255.255.255.0 # 166.70.1.0 is a subnetted Class C from ISP with a netmask of 255.255.255.240 # # NAT rules below are in /usr/local/bin/natsetup and these are all run # from /etc/rc2.d/S99aroute # # flush all nat rules #ipnat -F #ipnat -C #ipnat -f - <<EOF1 #map net1 192.168.1.0/24 -> 0.0.0.0/32 #EOF1 # # IPF filter rules # # Port Number Service Type # 20/21 ftp # 22 ssh # 23 telnet # 25 smtp # 37 timeserver # 42 nameserver # 43 whois # 53 domain nameserver # 79 finger # 80 http # 110 pop3 # 113 auth # 119 nntp # 123 ntp # 143 imap # 443 SSL (http) # 517 talk # 518 ntalk # 540 tcp over IP # # flush all ipf rules ipf -F a ipf -f - <<EOF block in ppp0 all block in net1 all pass in quick on lo0 proto tcp/udp from 127.0.0.1 to 127.0.0.1 pass in quick on lo0 proto icmp from 127.0.0.1 to 127.0.0.1 pass out quick on lo0 proto tcp/udp from 127.0.0.1 to 127.0.0.1 pass out quick on lo0 proto icmp from 127.0.0.1 to 127.0.0.1 pass in quick on atl0 all pass out quick on atl0 all pass in quick on net0 all pass out quick on net0 all pass in quick on lo0 from any to any pass out quick on lo0 from any to any pass out quick on ppp0 all pass out quick on net1 all # ppp0 starts here # #block in ppp0 all pass out quick on ppp0 proto tcp/udp from 20.20.20.0 to any keep state pass out quick on ppp0 proto tcp/udp from 166.70.1.0 to any keep state pass out quick on ppp0 proto icmp from 20.20.20.0 to any keep state pass out quick on ppp0 proto icmp from 166.70.1.0 to any keep state block in quick on ppp0 all with ipopts block in quick on ppp0 all with short block in quick on ppp0 all with frag block in quick on ppp0 proto tcp all flags FUP block in quick on ppp0 from 255.255.255.255/32 to any block in quick on ppp0 from 192.168.0.0/16 to any block in quick on ppp0 from 172.16.0.0/12 to any block in quick on ppp0 from 127.0.0.0/8 to any block in quick on ppp0 from 10.0.0.0/8 to any block in quick on ppp0 from 0.0.0.0/32 to any block in quick on ppp0 from 169.254.0.0/16 to any block in quick on ppp0 from 192.0.2.0/24 to any block in quick on ppp0 from 204.152.64.0/23 to any block in quick on ppp0 from 224.0.0.0/3 to any block in quick on ppp0 from any to 1.1.1.0/29 block in quick on ppp0 from any to 1.1.1.255/29 #pass out quick on ppp0 proto tcp/udp from 20.20.20.0/24 to any keep state #pass out quick on ppp0 proto icmp from 20.20.20.0/24 to any keep state #pass out quick on ppp0 proto tcp/udp from 166.70.1.0/28 to any keep state #pass out quick on ppp0 proto icmp from 166.70.1.0/28 to any keep state pass in quick on ppp0 proto icmp from any to 20.20.20.0/24 icmp-type 0 pass in quick on ppp0 proto icmp from any to 20.20.20.0/24 icmp-type 3 pass in quick on ppp0 proto icmp from any to 20.20.20.0/24 icmp-type 8 pass in quick on ppp0 proto icmp from any to 20.20.20.0/24 icmp-type 11 pass in quick on ppp0 proto icmp from any to 166.70.1.0/28 icmp-type 0 pass in quick on ppp0 proto icmp from any to 166.70.1.0/28 icmp-type 3 pass in quick on ppp0 proto icmp from any to 166.70.1.0/28 icmp-type 8 pass in quick on ppp0 proto icmp from any to 166.70.1.0/28 icmp-type 11 block in log quick on ppp0 proto icmp from any to any pass out quick on ppp0 proto tcp from any to any keep state pass out quick on ppp0 proto udp from any to any keep state pass out quick on ppp0 proto icmp from any to any keep state pass in on ppp0 proto tcp from any port = ftp-data to any port 20 pass in quick on ppp0 proto tcp from any to any port = 21 flags S keep state pass in quick proto tcp from any to any port 60000 >< 65535 flags S keep state pass in quick on ppp0 proto tcp from any to any port = 20 pass in quick on ppp0 proto tcp from any to any port = 21 flags S pass in quick on ppp0 proto tcp from any to any port = 21 flags S keep state pass in quick on ppp0 proto tcp from any to any port = 22 flags S keep state pass in quick on ppp0 proto tcp from any to any port = 23 flags S keep state pass in quick on ppp0 proto tcp from any to any port = 25 flags S keep state pass in quick on ppp0 proto tcp/udp from any to any port = 37 keep state pass in quick on ppp0 proto tcp/udp from any to any port = 42 keep state pass in quick on ppp0 proto tcp/udp from any to any port = 43 keep state pass in quick on ppp0 proto tcp from any to any port = 53 flags S keep state pass in quick on ppp0 proto udp from any to any port = 53 keep state pass in quick on ppp0 proto udp from any to any port = 161 keep state pass in quick on ppp0 proto udp from any to any port = 162 keep state pass in quick on ppp0 proto tcp from any to any port = 79 flags S keep state pass in quick on ppp0 proto tcp from any to any port = 80 flags S keep state pass in quick on ppp0 proto tcp from any to any port = 119 flags S keep state pass in quick on ppp0 proto tcp/udp from any to any port = 123 keep state pass in quick on ppp0 proto tcp from any to any port = 443 flags S keep state pass in quick on ppp0 proto tcp from any to any port = 540 flags S keep state pass in quick on ppp0 proto udp from any to any port = 517 keep state pass in quick on ppp0 proto udp from any to any port = 518 keep state block return-rst in on ppp0 proto tcp from any to any port = 113 block return-icmp(net-unr) in on ppp0 proto udp from any to any block return-icmp-as-dest(port-unr) in quick on ppp0 from any to any port = 110 block return-icmp-as-dest(port-unr) in quick on ppp0 from any to any port = 143 pass in on ppp0 proto udp from any port = 53 to any
# Net1 starts here # #block in net1 all pass out quick on net1 proto tcp/udp from 65.1.1.110/32 to any keep state pass out quick on net1 proto icmp from 65.1.1.110/32 to any keep state block in quick on net1 all with ipopts block in quick on net1 all with short block in quick on net1 all with frag #pass in quick on net1 proto tcp/udp from 65.1.1.110 to any keep state #pass in quick on net1 proto icmp from 65.1.1.110 to any keep state block in quick on net1 proto tcp all flags FUP block in quick on net1 from 255.255.255.255/32 to any block in quick on net1 from 192.168.0.0/16 to any block in quick on net1 from 172.16.0.0/12 to any block in quick on net1 from 127.0.0.0/8 to any block in quick on net1 from 10.0.0.0/8 to any block in quick on net1 from 0.0.0.0/32 to any block in quick on net1 from 169.254.0.0/16 to any block in quick on net1 from 192.0.2.0/24 to any block in quick on net1 from 204.152.64.0/23 to any block in quick on net1 from 224.0.0.0/3 to any block in quick on net1 from any to 1.1.1.0/29 block in quick on net1 from any to 1.1.1.255/29 #pass in quick on net1 proto icmp from any to 65.1.1.110/32 to any keep state pass in quick on net1 proto icmp from any to 65.1.1.110/32 icmp-type 0 pass in quick on net1 proto icmp from any to 65.1.1.110/32 icmp-type 3 pass in quick on net1 proto icmp from any to 65.1.1.110/32 icmp-type 8 pass in quick on net1 proto icmp from any to 65.1.1.110/32 icmp-type 11 #pass in quick on net1 proto icmp from any to 65.1.1.110/32 to icmp-type 0 #pass in quick on net1 proto icmp from any to 65.1.1.110/32 to icmp-type 3 #pass in quick on net1 proto icmp from any to 65.1.1.110/32 to icmp-type 8 #pass in quick on net1 proto icmp from any to 65.1.1.110/32 to icmp-type 11 #pass in quick on net1 proto icmp from 0.0.0.0/8 to 65.1.1.110/32 to any keep state pass in quick on net1 proto icmp from 0.0.0.0/8 to 65.1.1.110/32 icmp-type 0 pass in quick on net1 proto icmp from 0.0.0.0/8 to 65.1.1.110/32 icmp-type 3 pass in quick on net1 proto icmp from 0.0.0.0/8 to 65.1.1.110/32 icmp-type 8 pass in quick on net1 proto icmp from 0.0.0.0/8 to 65.1.1.110/32 icmp-type 11 block in log quick on net1 proto icmp from any to any pass out quick on net1 proto tcp from any to any keep state pass out quick on net1 proto udp from any to any keep state pass out quick on net1 proto icmp from any to any keep state pass in on net1 proto tcp from any port = ftp-data to any port 20 pass in quick on net1 proto tcp from any to any port = 21 flags S keep state #pass in quick proto tcp from any to any port 60000 >< 65535 flags S keep state pass in quick on net1 proto tcp from any to any port = 20 pass in quick on net1 proto tcp from any to any port = 21 flags S pass in quick on net1 proto tcp from any to any port = 21 flags S keep state pass in quick on net1 proto tcp from any to any port = 22 flags S keep state #pass in quick on net1 proto tcp from any to any port = 23 flags S keep state pass in quick on net1 proto tcp from any to any port = 25 flags S keep state pass in quick on net1 proto tcp/udp from any to any port = 37 keep state pass in quick on net1 proto tcp/udp from any to any port = 42 keep state #pass in quick on net1 proto tcp/udp from any to any port = 43 keep state pass in quick on net1 proto tcp from any to any port = 53 flags S keep state pass in quick on net1 proto udp from any to any port = 53 keep state pass in quick on net1 proto udp from any to any port = 161 keep state pass in quick on net1 proto udp from any to any port = 162 keep state pass in quick on net1 proto tcp from any to any port = 79 flags S keep state pass in quick on net1 proto tcp from any to any port = 80 flags S keep state #pass in quick on net1 proto tcp from any to any port = 119 flags S keep state pass in quick on net1 proto tcp/udp from any to any port = 123 keep state pass in quick on net1 proto tcp from any to any port = 443 flags S keep state pass in quick on net1 proto tcp from any to any port = 540 flags S keep state pass in quick on net1 proto udp from any to any port = 517 keep state pass in quick on net1 proto udp from any to any port = 518 keep state block return-rst in on net1 proto tcp from any to any port = 113 block return-icmp(net-unr) in on net1 proto udp from any to any block return-icmp-as-dest(port-unr) in quick on net1 from any to any port = 110 block return-icmp-as-dest(port-unr) in quick on net1 from any to any port = 143 pass in on net1 proto udp from any port = 53 to any EOF ipmon > /var/adm/firewall & #ipmon >> /var/adm/firewall & ---------------------------Cut Here--------------------------------------
/Bofcusm/919.html copyright 1997-2004 (various authors) All Rights Reserved
Have you tried Searching this site?
Unix/Linux/Mac OS X support by phone, email or on-site: Support Rates
This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more. We appreciate comments and article submissions.
Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.
Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.
We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.
Click here to add your comments
Don't miss responses! Subscribe to Comments by RSS or by Email
Click here to add your comments
If you want a picture to show with your comment, go get a Gravatar