1*7c478bd9Sstevel@tonic-gateConfiguring IP Filter for firewall usage. 2*7c478bd9Sstevel@tonic-gate========================================= 3*7c478bd9Sstevel@tonic-gate 4*7c478bd9Sstevel@tonic-gateStep 1 - Block out "bad" IP packets. 5*7c478bd9Sstevel@tonic-gate------------------------------------ 6*7c478bd9Sstevel@tonic-gate 7*7c478bd9Sstevel@tonic-gateRun the perl script "mkfilters". This will generate a list of blocking 8*7c478bd9Sstevel@tonic-gaterules which: 9*7c478bd9Sstevel@tonic-gate a) blocks all packets which might belong to an IP Spoofing attack; 10*7c478bd9Sstevel@tonic-gate b) blocks all packets with IP options; 11*7c478bd9Sstevel@tonic-gate c) blocks all packets which have a length which is too short for 12*7c478bd9Sstevel@tonic-gate any legal packet; 13*7c478bd9Sstevel@tonic-gate 14*7c478bd9Sstevel@tonic-gateStep 2 - Convert Network Security Policy to filter rules. 15*7c478bd9Sstevel@tonic-gate--------------------------------------------------------- 16*7c478bd9Sstevel@tonic-gate 17*7c478bd9Sstevel@tonic-gateDraw up a list of which services you want to allow users to use on the 18*7c478bd9Sstevel@tonic-gateInternet (e.g. WWW, ftp, etc). Draw up a separate list for what you 19*7c478bd9Sstevel@tonic-gatewant each host that is part of your firewall to be allowed to do, including 20*7c478bd9Sstevel@tonic-gatecommunication with internal hosts. 21*7c478bd9Sstevel@tonic-gate 22*7c478bd9Sstevel@tonic-gateStep 3 - Create TCP "keep state" rules. 23*7c478bd9Sstevel@tonic-gate--------------------------------------- 24*7c478bd9Sstevel@tonic-gate 25*7c478bd9Sstevel@tonic-gateFor each service that uses TCP, create a rule as follows: 26*7c478bd9Sstevel@tonic-gate 27*7c478bd9Sstevel@tonic-gatepass in on <int-a> proto tcp from <int-net> to any port <ext-service> flags S/SA keep state 28*7c478bd9Sstevel@tonic-gate 29*7c478bd9Sstevel@tonic-gatewhere 30*7c478bd9Sstevel@tonic-gate* "int-a" is the internal interface of the firewall. That is, it is the 31*7c478bd9Sstevel@tonic-gate closest to your internal network in terms of network hops. 32*7c478bd9Sstevel@tonic-gate 33*7c478bd9Sstevel@tonic-gate* "int-net" is the internal network IP# subnet address range. This might 34*7c478bd9Sstevel@tonic-gate be something like 10.1.0.0/16, or 128.33.1.0/24 35*7c478bd9Sstevel@tonic-gate 36*7c478bd9Sstevel@tonic-gate* "ext-service" is the service to which you wish to connect or if it doesn't 37*7c478bd9Sstevel@tonic-gate have a proper name, a number can be used. The translation of "ext-service" 38*7c478bd9Sstevel@tonic-gate as a name to a number is controlled with the /etc/services file. 39*7c478bd9Sstevel@tonic-gate 40