Re: blocking port 22 with ipfw

From: dD (daisy_ysiad@hotmail.com)
Date: 01/09/02 

From: dD <daisy_ysiad@hotmail.com>
Date: Wed, 09 Jan 2002 16:14:27 GMT

"Theresa Tucker" <tatucker@tc.umn.edu> wrote in
news:uRZ_7.32$za2.8660@news7.onvoy.net:

> I am trying to block port 22, sshd, to everyone but a select few on a
> unix server.
>
> This is the command line I am using but it doesn't work
>
> ipfw add 100 deny log all from any to 22
ipfw add 100 deny log tcp from any to any 22
or like
ipfw add 100 deny log tcp from any to UR_IP_HERE 22

> ipfw add 200 allow all from xxx.xxx.xxx.0/24 to 22

ipfw add 200 allow tcp from xxx.xxx.xxx.0/24 to any/UR_IP_HERE 22

i think, been awhile since i've used ipfw

and i think u need to put them the other way around, allow first, then the
deny

Relevant Pages

  • Re: too many dynamic rules
    ... I myself use ipf/ipnat so I'm not so familliar with ipfw ruleset, ... > add 00202 deny log all from any to 10.0.0.0/8 ... > add 00600 allow icmp from any to any icmptypes 3 ...
    (FreeBSD-Security)
  • Re: Whats the point of not allowing all outgoing traffic by default?
    ... Outbound traffic is normally disallowed by default, and you have to setup an explicit rule that you want it. ... ipfw add 3 deny log ip from any to me out ... ipfw add 9 deny log tcp from me to any smtp out ...
    (comp.security.firewalls)
  • Re: IPFW Problems
    ... I doing this over an SSH connection, ... there seems to be something odd with ipfw. ... ipfw add 00299 deny log all from any to any out via bge0 ... ipfw add 0430 allow log tcp from any to me 22 in via bge0 setup limit ...
    (freebsd-questions)
  • Re: ipfw configuration to connect to localhost
    ... listeners on your box, are they bound to *, or just to on ... Use ipfw show to display more accurate information about ... on the lo0 rule? ... ipfw 65500 deny log ip from any to any via lo0 ...
    (comp.security.unix)
  • Re: ipfw questions
    ... ipfw configurations I've found use "from any to any," which doesn't ... deny log ip from 127.0.0.0/8 to any in ... The TCP/IP stack denies packets from/to 127/8 coming from a wire, ... I would feel safe without such firewall rules on a personal FreeBSD box. ...
    (freebsd-questions)