FreeBSD Setting up Firewall using IPFW

Here is my script..

# Set this to your ip address.
        ip="192.168.1.5"
        fwcmd="ipfw"
        setup_loopback

        # Allow anything outbound from this address.
        ${fwcmd} add allow all from ${ip} to any out

        # Deny anything outbound from other addresses.
        ${fwcmd} add deny log all from any to any out

        # Allow TCP through if setup succeeded.
        ${fwcmd} add allow tcp from any to any established

        # Allow IP fragments to pass through.
        ${fwcmd} add allow all from any to any frag

        # Allow all IPv6 packets through - they are handled by the separate
        # ipv6 firewall rules in rc.firewall6.
        ${fwcmd} add allow ipv6 from any to any

        # Allow inbound ftp, ssh, email, tcp-dns, http, https, imap, imaps,
        # pop3, pop3s.
        ${fwcmd} add allow tcp from any to ${ip} 21 setup
        ${fwcmd} add allow tcp from any to ${ip} 22 setup
        ${fwcmd} add allow tcp from any to ${ip} 222 setup
        ${fwcmd} add allow tcp from any to ${ip} 25 setup
        ${fwcmd} add allow tcp from any to ${ip} 53 setup
        ${fwcmd} add allow tcp from any to ${ip} 80 setup
        ${fwcmd} add allow tcp from any to ${ip} 443 setup
        ${fwcmd} add allow tcp from any to ${ip} 143 setup
        ${fwcmd} add allow tcp from any to ${ip} 993 setup
        ${fwcmd} add allow tcp from any to ${ip} 110 setup
        ${fwcmd} add allow tcp from any to ${ip} 995 setup

        # Deny inbound auth, netbios, ldap, and Microsoft's DB protocol
        # without logging.
        ${fwcmd} add reset tcp from any to ${ip} 113 setup
        ${fwcmd} add reset tcp from any to ${ip} 139 setup
        ${fwcmd} add reset tcp from any to ${ip} 389 setup
        ${fwcmd} add reset tcp from any to ${ip} 445 setup

        # Deny some chatty UDP broadcast protocols without logging.
        ${fwcmd} add deny udp from any 137 to any
        ${fwcmd} add deny udp from any to any 137
        ${fwcmd} add deny udp from any 138 to any
        ${fwcmd} add deny udp from any 513 to any
        ${fwcmd} add deny udp from any 525 to any

        # Allow inbound DNS and NTP replies.  This is somewhat of a hole,
        # since we're looking at the incoming port number, which can be
        # faked, but that's just the way DNS and NTP work.
        ${fwcmd} add allow udp from any 53 to ${ip}
        ${fwcmd} add allow udp from any 123 to ${ip}

        # Allow inbound DNS queries.
        ${fwcmd} add allow udp from any to ${ip} 53

        # Allow inbound NTP queries.
        ${fwcmd} add allow udp from any to ${ip} 123

        # Allow traceroute to function, but not to get in.
        ${fwcmd} add unreach port udp from any to ${ip} 33435-33524

        # Allow some inbound icmps - echo reply, dest unreach, source quench,
        # echo, ttl exceeded.
        ${fwcmd} add allow icmp from any to any icmptypes 0,3,4,8,11

        # Everything else is denied and logged.
        ${fwcmd} add deny log all from any to any

Have a fun :D

Two previous posters mention you might want to compile the firewall into the kernel to allow NAT. For beginners, the reason you might want NAT is if your firewall is protecting a LAN. If your FreeBSD machine is a stand-alone machine, or you have another computer or black-box device protecting your lan, then you don’t need this feature. (The two example firewall config scripts assume this state of affairs!)

If you do have a LAN you need to protect, look at the example firewall script that comes with FreeBSD in /etc/rc.firewall and examine the “Simple” configuration… that’s a good starting point for a firewall protecting a LAN.

hi all, i want to ask

fbsdguru, is you ip 192.168.1.5 facing the internet? mine have 2 ether, 1 assigned ip from NAP, and 1 assigned ip for main router of my network (ISP). is your script compatible for my network design? assume that ether which facing public is dc0 and ether for main router is vr0, any suggestion for best firewall on my machine?

thanks before, sorry for bad english.

What about blocking Nmap?

01100 deny ip from any to any ipoptions rr
01110 deny ip from any to any ipoptions ts
01120 deny ip from any to any ipoptions lsrr
01130 deny ip from any to any ipoptions ssrr
01140 deny tcp from any to any tcpflags syn,fin
01150 deny tcp from any to any tcpflags syn,rst

hi! I need help regarding ipfw. i’m a newbie to freebsd. I want my freebsd to be the gateway of my WLAN to the internet. I also want to authenticate each user through a database. Can anyone help me?
I just need it for my case study in school.

here’s my email for those who want to help:

relch2k7@yahoo.com

thanks!

more useful..

Thanks a lot

Nice firewall, how about blocking by means of MC Address, I set-up a proxy server
and allow only specific IP’s, but the problem is that some users knows how to change
their IP address and knows what are the IP’s that are allowed to surf the Internet. So
I think blocking by means of MC Address solve my problem here in out company.
Can you help me?

Thank you and more power.

How do I modify the script to NAT my traffic from my OpenVPN interface tun0 to my external interface vr0 (it has a direct connection to internet, no router between)?

OpenVPN—->vr0—->INTERNET

Have added the DEFAULT_TO_ACCEPT option and removed /etc/rc.conf enables and am still locket out.
Outstanding article.