Re: ipf stopped working on 5.3

From: John Fitzgerald (jjfitzgerald_at_gmail.com)
Date: 10/26/05

  • Next message: John Fitzgerald: "Re: ipf stopped working on 5.3" 
    Date: Wed, 26 Oct 2005 13:01:20 -0400
To: "ray@redshift.com" <ray@redshift.com>

    Hi Ray,

    Here's a cleaned up version of ipf.rules:

    #--------------------------------------------------------------------------
    # block nasty packets
    #--------------------------------------------------------------------------
    block in log quick all with short
    block in log quick all with opt lsrr
    block in log quick all with opt ssrr

    #--------------------------------------------------------------------------
    # loopback packets left alone
    #--------------------------------------------------------------------------
    pass in log quick on lo0 all
    pass out log quick on lo0 all

    #--------------------------------------------------------------------------
    # 100 incoming bge0
    # 150 outgoing bge0
    #--------------------------------------------------------------------------
    block in log on bge0 all head 10
    block in log on bge0 all head 100
    block out log on bge0 all head 150

    #--------------------------------------------------------------------------
    # allow all traffic to 80 and 443
    #--------------------------------------------------------------------------
    pass in log quick proto tcp from any to any port = 80 flags S/SA keep state
    pass in log quick proto tcp from any to any port = 443 flags S/SA keep state

    #--------------------------------------------------------------------------
    # allow only traffic from known hosts to localhost:ssh
    #--------------------------------------------------------------------------
    pass in log quick proto tcp from MY_FIRST_HOST to any port = 22 flags S/SA
    keep state
    pass in log quick proto tcp from MY_SECOND_HOST to any port = 22 flags S/SA
    keep state

    #--------------------------------------------------------------------------
    # allow outgoing keystrokes and syslog to logger
    #--------------------------------------------------------------------------
    pass out log quick proto udp from any to MY_LOGGER port = 514 group 150

    #--------------------------------------------------------------------------
    # block all other outgoing traffic
    #--------------------------------------------------------------------------
    block out log quick from any to any group 100

    #--------------------------------------------------------------------------
    # block all
    #--------------------------------------------------------------------------
    block in log quick on bge0 all

    The group 10 is for my script to block ip's on the fly. I think someone from
    the FreeBSD Diary wrote a script that I use when attacks come in. I suppose
    I could use 100 for that, but I just used 10 to separate and I think that's
    what the example used. Probably not the best ipf.rules but it (seemed) to
    work.

    JJ

    On 10/26/05, ray@redshift.com <ray@redshift.com> wrote:
    >
    > At 01:32 PM 10/25/2005 -0400, John Fitzgerald wrote:
    > | I've had ipf working on a few 5.3 servers for quite awhile. Not too long
    > ago
    > | some developers had to do some coding work and were coming from dynamic
    > | IP's. I (reluctantly) opened up SSH to the world. Immediately I started
    > | seeing the attacks where bots of some sort would try to break in with a
    > | variety of different users.
    > |
    > | So, I (thought) I closed it up again and told the developers to use a
    > | dedicated proxy. They did, but I realized that I hadn't actually closed
    > | things off. I was still getting attacked. I had tried, but ipf suddenly
    > | wasn't working. Whenever I would change the firewall rules and ipf -D
    > and
    > | the ipf -E -f /etc/my.rules it would simply return:
    > |
    > | 1:ioctl(add/insert rule): No such process
    > |
    > | I didn't have the time to look into it at the time, but am now trying to
    > | figure it out. Ipf is obviously not working and I don't know why. I have
    > | tried recompiling the kernel a myriad of different ways. With/without
    > ipfw,
    > | with/without ipsec, etc. All to no avail. Is this a bug, did I get
    > hacked?
    > |
    > | I have googled this quite a bit and the only thing that I found was
    > possibly
    > | a buildworld scenario where something got updated and it doesn't work
    > now. I
    > | didn't install src so I'm a bit out of luck on that one.
    > |
    > | FreeBSD 5.3-RELEASE
    > | OpenSSH_3.8.1p1 FreeBSD-20040419, OpenSSL 0.9.7d 17 Mar 2004
    > |
    >
    > usually that means you are trying to run it without being root, or you
    > have a
    > rule that doesn't belong to a group/head.
    >
    > I ran into something else once that caused that, but now I can't remember
    > it.
    > Feel free to send your ipf.rules if it's not to sensitive.
    >
    > Ray
    >
    >
    _______________________________________________
    freebsd-security@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-security
    To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"

  • Next message: John Fitzgerald: "Re: ipf stopped working on 5.3"

    Relevant Pages

    • pf: nat+ssh only with ip, not dns
      ... altq on $ext_if priq bandwidth 380Kb queue {std_out ssh_im_out dns_out ... port $tcp_services flags S/SA keep state ... pass out quick on $ext_if proto tcp from $wifi_if:network flags S/SA ...
      (comp.unix.bsd.openbsd.misc)
    • My ungodly PF config - am I sane and brilliant, or just deluded and dangerous?
      ... pass out on $gif_if proto tcp all modulate state flags S/SA ... pass out on $gif_if proto tcp from any to any port 22 modulate state ...
      (freebsd-stable)
    • how to prevent fingerprint scan on OpenBSD 3.3
      ... Port State Service ... block drop in log quick on tun0 inet proto tcp all flags FPU/FPU ... pass out quick on tun0 proto tcp all flags S/SA keep state ...
      (comp.security.misc)
    • Re: ipfw natd forward port 80
      ... pass in quick on xl0 proto icmp all icmp-type 0 ... block in log on xl0 proto tcp all flags S/SA ... block in log on xl0 proto tcp all flags SA/SA ... pass in quick on xl0 proto tcp from any to any port = ...
      (freebsd-questions)
    • FTP server behind IPf/IPNAT
      ... server on port 420, but I also need to allow passive ... pass in quick on xl0 proto udp from any to any port = ... #pass in quick on xl0 proto tcp from any to any port = ... pass in quick on xl1 proto tcp from 192.168.1.0/24 to ...
      (freebsd-questions)