From 2c7b8e0e6b331ff9048bc365dbfbdfb9e7c64909 Mon Sep 17 00:00:00 2001 From: Giorgos Keramidas Date: Fri, 21 Jan 2005 14:33:01 +0000 Subject: [PATCH] + Many punctuation and wording fixes: - Whitespace before punctuation was removed. - Numbers below 10 are spelled out as words. - Reworded some sentences and added missing words. + Added a note about periodically flushing firewall rules to make sure one is not locked out while tinkering with rulesets. PR: docs/76533 Submitted by: Brad Davis --- .../books/handbook/firewalls/chapter.sgml | 74 ++++++++++--------- 1 file changed, 38 insertions(+), 36 deletions(-) diff --git a/en_US.ISO8859-1/books/handbook/firewalls/chapter.sgml b/en_US.ISO8859-1/books/handbook/firewalls/chapter.sgml index fb0a2594b9..5dc392aace 100644 --- a/en_US.ISO8859-1/books/handbook/firewalls/chapter.sgml +++ b/en_US.ISO8859-1/books/handbook/firewalls/chapter.sgml @@ -336,8 +336,7 @@ pflog_flags="" # additional flags for pflogd startup and - . + url="http://coombs.anu.edu.au/~avalon/ip-filter.html">. The IPF FAQ is at . @@ -350,8 +349,8 @@ pflog_flags="" # additional flags for pflogd startup is used. The loadable module was created with logging enabled and the default pass all options. You do not need to compile IPF into - the &os; kernel just to change the default to block all - , you can do that by just coding a block all rule at + the &os; kernel just to change the default to block + all, you can do that by just coding a block all rule at the end of your rule set. @@ -521,7 +520,7 @@ ipnat_rules="/etc/ipnat.rules" # rules definition file for ipnatIPMON In order for ipmon to work properly, the kernel option IPFILTER_LOG must be turned on. This command has - 2 different modes that it can be used in. Native mode is the default + two different modes that it can be used in. Native mode is the default mode when you type the command on the command line without the flag. @@ -595,11 +594,8 @@ LOG_ERR - packets which have been logged and which can be considered shortTo activate the changes to /etc/syslog.conf you can reboot or bump the syslog task into re-reading /etc/syslog.conf by running - /etc/rc.d/syslogd restart ( - kill -HUP PID in &os; 4.x. You get the PID (i.e. process - identifier) by listing the tasks with the ps -ax - command. Find syslog in the display and the PID is the number - in the left column). + /etc/rc.d/syslogd restart + (killall -HUP syslogd in &os; 4.X). Do not forget to change /etc/newsyslog.conf to rotate the new log you just created above. @@ -708,7 +704,7 @@ LOG_ERR - packets which have been logged and which can be considered short############# Start of IPF rules script ######################## oif="dc0" # name of the outbound interface -odns="192.0.2.11" # ISP's dns server IP address +odns="192.0.2.11" # ISP's DNS server IP address myip="192.0.2.7" # my static IP address from ISP ks="keep state" fks="flags S keep state" @@ -777,7 +773,7 @@ sh /etc/ipf.rules.script packets based on the values contained in the packet. The bi-directional exchange of packets between hosts comprises a session conversation. The firewall rule set processes the - packet 2 times, once on its arrival from the public Internet + packet two times, once on its arrival from the public Internet host and again as it leaves for its return trip back to the public Internet host. Each TCP/IP service (i.e. telnet, www, mail, etc.) is predefined by its protocol, source and @@ -808,8 +804,12 @@ sh /etc/ipf.rules.script Warning, when working with the firewall rules, always, - always do it from the root console of the system running the - firewall or you can end up locking your self out. + always do it on the console of the system running the + firewall or you can end up locking your self out. + Alternatively, you may setup a cronjob to flush the + firewall rules say every five minutes. + This may not be acceptable for a corporate firewall, + but should be ok for a home firewall. @@ -820,7 +820,8 @@ sh /etc/ipf.rules.script rule wins logic. For the complete legacy rule syntax description see the &man.ipf.8; manual page. - # is used to mark the start of a comment and may appear at + A # character is used to mark the + start of a comment and may appear at the end of a rule line or on its own line. Blank lines are ignored. @@ -1376,13 +1377,13 @@ block in log first quick on dc0 all get assigned a different IP address. This IP address is how you are known to the public Internet. - Now lets say you have 5 PCs at home and each one needs + Now lets say you have five PCs at home and each one needs Internet access. You would have to pay your ISP for an - individual Internet account for each PC and have 5 phone + individual Internet account for each PC and have five phone lines. With NAT you only need a single account - with your ISP, then cable your other 4 PCs to a switch and + with your ISP, then cable your other four PCs to a switch and the switch to the NIC in your &os; system which is going to service your LAN as a gateway. NAT will automatically translate the private LAN IP address for each @@ -1444,7 +1445,7 @@ block in log first quick on dc0 all NAT rules are loaded by using the ipnat command. Typically the NAT rules are stored - in /etc/ipnat.rules . See &man.ipnat.1 + in /etc/ipnat.rules. See &man.ipnat.1 for details. When changing the NAT rules after @@ -1535,7 +1536,7 @@ block in log first quick on dc0 all Enabling IP<acronym>NAT</acronym> To enable IPNAT add these statements to - /etc/rc.conf + /etc/rc.conf. To enable your machine to route traffic between interfaces: @@ -1561,12 +1562,14 @@ block in log first quick on dc0 all becomes a resource problem that may cause problems with the same port numbers being used many times across many NATed LAN PC's, causing collisions. There - are 2 ways to relieve this resource problem. + are two ways to relieve this resource problem. Assigning Ports to Use - XXXBLAH + + A normal NAT rule would look like: map dc0 192.168.1.0/24 -> 0.32 @@ -1672,12 +1675,12 @@ block in log first quick on dc0 all map dc0 10.0.10.0/29 -> 0/32 proxy port 21 ftp/tcp - This rule handles the FTP traffic from the gateway. + This rule handles the FTP traffic from the gateway: map dc0 0.0.0.0/0 -> 0/32 proxy port 21 ftp/tcp This rule handles all non-FTP traffic from the internal - LAN. + LAN: map dc0 10.0.10.0/29 -> 0/32 @@ -1701,7 +1704,7 @@ block in log first quick on dc0 all NAT FTP proxy is used. Without the FTP Proxy you will need the following three - rules + rules: # Allow out LAN PC client FTP to public Internet # Active and passive modes @@ -1724,14 +1727,13 @@ pass in quick on rl0 proto tcp from any to any port = 20 flags S keep stateNAT FTP/proxy appears to remove its temp rules prematurely, before receiving the response from the remote FTP server - acknowledging the close. Posted problem report to ipf - mailing list. + acknowledging the close. A problem report was posted to the + IPF mailing list. - Solution is to add filter rule like this one to get rid + The solution is to add a filter rule to get rid of these unwanted log messages or do nothing and ignore FTP - inbound error messages in your log. Not like you do FTP - session to the public Internet all the time, so this is not - a big deal. + inbound error messages in your log. Most people do not use + outbound FTP too often. block in quick on rl0 proto tcp from any to any port = 21 @@ -1758,7 +1760,7 @@ pass in quick on rl0 proto tcp from any to any port = 20 flags S keep state - IPFW is composed of 7 components, the primary component is + IPFW is composed of seven components, the primary component is the kernel firewall filter rule processor and its integrated packet accounting facility, the logging facility, the 'divert' rule which triggers the NAT facility, and the @@ -1820,7 +1822,7 @@ pass in quick on rl0 proto tcp from any to any port = 20 flags S keep state5 is the number of consecutive times to log evidence of this unique occurrence. @@ -1932,7 +1934,7 @@ options IPV6FIREWALL_DEFAULT_TO_ACCEPT packets based on the values contained in the packet. The bi-directional exchange of packets between hosts comprises a session conversation. The firewall rule set processes the - packet 2 times, once on its arrival from the public Internet + packet twice: once on its arrival from the public Internet host and again as it leaves for its return trip back to the public Internet host. Each tcp/ip service (i.e. telnet, www, mail, etc.) is predefined by its protocol, and port number. @@ -2207,7 +2209,7 @@ options IPV6FIREWALL_DEFAULT_TO_ACCEPT the kernel, the number of consecutive messages concerning a particular rule is capped at the number specified. There is nothing to be gained from 200 log messages saying the - same identical thing. For instance, 5 consecutive messages + same identical thing. For instance, five consecutive messages concerning a particular rule would be logged to syslogd, the remainder identical consecutive messages would be counted and posted to the syslogd with a phrase like @@ -2334,7 +2336,7 @@ ipfw -q add 00611 allow udp from any to 192.0.2.11 53 out via tun0 keep-state

The Inbound section has all the blocking of undesirable - packets first for 2 different reasons. First is these things + packets first for two different reasons. First is these things being blocked may be part of an otherwise valid packet which may be allowed in by the later authorized service rules. Second reason is that by having a rule that explicitly