Changeset 8734


Ignore:
Timestamp:
Jan 26, 2011, 9:49:24 PM (14 years ago)
Author:
rick
Message:
  • Less restrictive Firewall in internal port
  • Support for inbound NAT to use the proxy as router from PRIVATE NETWORK -> WL NETWORK
File:
1 edited

Legend:

Unmodified
Added
Removed

  • 2.0/nanobsd/nanobsd/files/etc/ipfw.sh

    r8419 r8734  
    11#!/bin/sh -
    22# Based on /etc/rc.firewall
    3 
    4 allowed2internet="80,443"
    5 maxconnections="10"
     3#
     4# Firewall for use at Wireless Leiden Proxy. Rules:
     5# - Fully exposed internal interface.
     6# - Allow private networks connected to IFACE_INET to connected to WL NETWORK (NAT).
     7# - Limited set of outbound NAT for WL connections.
     8#
     9# Richard van Mansom <richard@vanmansom.net>
     10# Rick van der Zwet <info@rickvanderzwet.nl>
    611
    712# Suck in the configuration variables.
    … …  
    1419        fi
    1520fi
     21
     22IFACE_INET=${IFACE_INET:-sis0}
     23IFACE_WL=${IFACE_WL:-sis1}
     24PRIVATE_NETWORKS=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8
     25# MAX_CONN allowed via Outbound NAT to ONP ports
     26ONP=http,https
     27MAX_CONN=10
     28
    1629
    1730setup_loopback () {
    … …  
    3649esac
    3750
    38 ###########
    39 # Set Internal/External Interface
    40 #
    41 driver=`echo ${internalif} | sed 's/[0-9]*//g'`
    42 seq=`echo ${internalif} | sed 's/[a-zA-Z]*//g'`
    43 
    44 if [ ${seq} = 0 ]; then
    45   seq=`expr ${seq} \+ 1`
    46 else
    47   seq=`expr ${seq} \- 1`
    48 fi
    49 
    50 externalif="$driver$seq"
    51 
    52 # Get public ip
    53 externalip=`ifconfig $externalif | awk '/inet/ { print $2 }'`
    5451############
    5552# Flush out the list before we begin.
    … …  
    5956setup_loopback
    6057
     58${fwcmd} add 400 check-state
     59
    6160
    6261############
    63 # Block the hosters network (and maybe others)
     62# Allow all outgoing connections from this system
     63${fwcmd} add 500 allow all from me to any keep-state
    6464
    65 for IP in ${firewall_block}
    66 do
    67   ${fwcmd} add deny ip from any to ${IP} in via $internalif
    68 done
     65############
     66# Default services on External Interface (firewalled)
     67${fwcmd} add 501 allow tcp from any to me ssh via ${IFACE_INET} keep-state
     68# Default services on Internal Interface (allow all)
     69${fwcmd} add 502 allow ip from any to me via ${IFACE_WL} keep-state
    6970
    70 #############
    71 # Outbound NAT setup
    7271
    73 ${fwcmd} add nat 100 all from 172.16.0.0/12 to any out via $externalif
    74 ${fwcmd} add nat 100 all from any to $externalip in via $externalif
    75 ${fwcmd} nat 100 config if $externalif
     72############
     73# Inbound NAT setup (External -> WL Network, all ports allowed
     74# Used to allow external network to use WL Network
     75${fwcmd} add 1000 nat 1 ip from ${PRIVATE_NETWORKS} to 172.16.0.0/12 out xmit ${IFACE_WL} setup established
     76${fwcmd} add 1001 nat 1 ip from 172.16.0.0/12 to ${PRIVATE_NETWORKS} in recv ${IFACE_WL} established
     77${fwcmd} nat 1 config if ${IFACE_WL}
     78#
     79${fwcmd} add 1010 allow all from ${PRIVATE_NETWORKS} to 172.16.0.0/12 in via ${IFACE_INET} keep-state
    7680
    77 #############
    78 # WL -> Internet
    79 # Stateful firewalling
    80 
    81 ${fwcmd} add 3000 check-state
    82 # HTTP
    83 ${fwcmd} add 3001 allow tcp from 172.16.0.0/12 to any $allowed2internet in via $internalif setup limit src-addr $maxconnections
    84 # HTTPS
    85 
    86 # Allow anything originating from me
    87 ${fwcmd} add 4001 allow ip from me to any keep-state
    88 
    89 # Allow on any interface
    90 # Allow SSH
    91 ${fwcmd} add 5001 allow tcp from any to me 22 keep-state
    92 
    93 # Allow on internal interface
    94 # DNS
    95 ${fwcmd} add 6001 allow ip from any to me 53 via $internalif keep-state
    96 
    97 # NTP
    98 ${fwcmd} add 6002 allow udp from any to me 123 via $internalif keep-state
    99 
    100 # HTTP-PROXY
    101 ${fwcmd} add 6003 allow tcp from any to me 3128 via $internalif keep-state
    102 
    103 # lvrouted
    104 ${fwcmd} add 6004 allow udp from 172.16.0.0/12 to me 12345 via $internalif keep-state
    105 
    106 # SNMP
    107 ${fwcmd} add 6005 allow udp from any to me 161 via $internalif keep-state
     81############
     82# Outbound NAT setup (WL Network -> External, limited portset)
     83${fwcmd} add 2000 nat 2 ip from 172.16.0.0/12 to any ${ONP} out xmit ${IFACE_INET} setup established
     84${fwcmd} add 2001 nat 2 ip from any ${ONP} to 172.16.0.0/12 in recv ${IFACE_INET} established
     85${fwcmd} nat 2 config if ${IFACE_INET}
     86#
     87# Block any communication private network at external interface,
     88# to ensure you cannot reach the (private network in between). (extra security)
     89${fwcmd} add 2010 deny all from any to ${PRIVATE_NETWORKS} in recv ${IFACE_WL}
     90#
     91# Allow communication to allowed ports.
     92${fwcmd} add 2011 allow all from 172.16.0.0/12 to any ${ONP} in via ${IFACE_WL} setup limit src-addr ${MAX_CONN}
    10893
    10994
    11095
    111 # Block anything else
    112 ${fwcmd} add 65000 deny ip from any to any
     96############
     97# Transproxy/WLportal/Captive portal
     98# ${fwcmd} add 10000 allow tcp from any to localhost 80
     99# ${fwcmd} add 10001 allow tcp from any to me 80
    113100
     101############
     102# Reserved: WLPortal rule numbers
     103# 10010 - 10099
     104
     105# Forward rules work without a base address, so needed a loop over all inet4 adresses
     106# for IP in `ifconfig -a | awk '/inet / {print $2}'`; do
     107#   ${fwcmd} add 10100 fwd $IP,8081 tcp from any to not 172.16.0.0/12 80
     108# done
     109
     110############
     111# By default DENY everything.
     112${fwcmd} add 65000 deny log logamount 500 all from any to any
Note: See TracChangeset for help on using the changeset viewer.