xref: /illumos-gate/usr/src/cmd/ipf/examples/BASIC_1.FW (revision 7c478bd9)
1#!/sbin/ipf -f -
2#
3# SAMPLE: RESTRICTIVE FILTER RULES
4#
5# THIS EXAMPLE IS WRITTEN FOR IP FILTER 3.3
6#
7# ppp0 - (external) PPP connection to ISP, address a.b.c.d/32
8#
9# ed0 - (internal) network interface, address w.x.y.z/32
10#
11# This file contains the basic rules needed to construct a firewall for the
12# above situation.
13#
14#-------------------------------------------------------
15# *Nasty* packets we don't want to allow near us at all!
16# short packets which are packets fragmented too short to be real.
17block in log quick all with short
18#-------------------------------------------------------
19# Group setup.
20# ============
21# By default, block and log everything.  This maybe too much logging
22# (especially for ed0) and needs to be further refined.
23#
24block in log on ppp0 all head 100
25block in log proto tcp all flags S/SA head 101 group 100
26block out log on ppp0 all head 150
27block in log on ed0 from w.x.y.z/24 to any head 200
28block in log proto tcp all flags S/SA head 201 group 200
29block in log proto udp all head 202 group 200
30block out log on ed0 all head 250
31#-------------------------------------------------------
32# Localhost packets.
33# ==================
34# packets going in/out of network interfaces that aren't on the loopback
35# interface should *NOT* exist.
36block in log quick from 127.0.0.0/8 to any group 100
37block in log quick from any to 127.0.0.0/8 group 100
38block in log quick from 127.0.0.0/8 to any group 200
39block in log quick from any to 127.0.0.0/8 group 200
40# And of course, make sure the loopback allows packets to traverse it.
41pass in quick on lo0 all
42pass out quick on lo0 all
43#-------------------------------------------------------
44# Invalid Internet packets.
45# =========================
46#
47# Deny reserved addresses.
48#
49block in log quick from 10.0.0.0/8 to any group 100
50block in log quick from 192.168.0.0/16 to any group 100
51block in log quick from 172.16.0.0/12 to any group 100
52#
53# Prevent IP spoofing.
54#
55block in log quick from a.b.c.d/24 to any group 100
56#
57#-------------------------------------------------------
58# Allow outgoing DNS requests (no named on firewall)
59#
60pass in quick proto udp from any to any port = 53 keep state group 202
61#
62# If we were running named on the firewall and all internal hosts talked to
63# it, we'd use the following:
64#
65#pass in quick proto udp from any to w.x.y.z/32 port = 53 keep state group 202
66#pass out quick on ppp0 proto udp from a.b.c.d/32 to any port = 53 keep state
67#
68# Allow outgoing FTP from any internal host to any external FTP server.
69#
70pass in quick proto tcp from any to any port = ftp keep state group 201
71pass in quick proto tcp from any to any port = ftp-data keep state group 201
72pass in quick proto tcp from any port = ftp-data to any port > 1023 keep state group 101
73#
74# Allow NTP from any internal host to any external NTP server.
75#
76pass in quick proto udp from any to any port = ntp keep state group 202
77#
78# Allow outgoing connections: SSH, TELNET, WWW
79#
80pass in quick proto tcp from any to any port = 22 keep state group 201
81pass in quick proto tcp from any to any port = telnet keep state group 201
82pass in quick proto tcp from any to any port = www keep state group 201
83#
84#-------------------------------------------------------
85block in log proto tcp from any to a.b.c.d/32 flags S/SA head 110 group 100
86#
87# Allow incoming to the external firewall interface: mail, WWW, DNS
88#
89pass in log quick proto tcp from any to any port = smtp keep state group 110
90pass in log quick proto tcp from any to any port = www keep state group 110
91pass in log quick proto tcp from any to any port = 53 keep state group 110
92pass in log quick proto udp from any to any port = 53 keep state group 100
93#-------------------------------------------------------
94# Log these:
95# ==========
96# * return RST packets for invalid SYN packets to help the other end close
97block return-rst in log proto tcp from any to any flags S/SA group 100
98# * return ICMP error packets for invalid UDP packets
99block return-icmp(net-unr) in proto udp all group 100
100