head	1.1;
branch	1.1.1;
access;
symbols
	RELENG_8_4:1.1.1.2.0.76
	RELENG_9_1_0_RELEASE:1.1.1.2
	RELENG_9_1:1.1.1.2.0.74
	RELENG_9_1_BP:1.1.1.2
	RELENG_8_3_0_RELEASE:1.1.1.2
	RELENG_8_3:1.1.1.2.0.72
	RELENG_8_3_BP:1.1.1.2
	RELENG_9_0_0_RELEASE:1.1.1.2
	RELENG_9_0:1.1.1.2.0.70
	RELENG_9_0_BP:1.1.1.2
	RELENG_9:1.1.1.2.0.68
	RELENG_9_BP:1.1.1.2
	RELENG_7_4_0_RELEASE:1.1.1.2
	RELENG_8_2_0_RELEASE:1.1.1.2
	RELENG_7_4:1.1.1.2.0.66
	RELENG_7_4_BP:1.1.1.2
	RELENG_8_2:1.1.1.2.0.64
	RELENG_8_2_BP:1.1.1.2
	RELENG_8_1_0_RELEASE:1.1.1.2
	RELENG_8_1:1.1.1.2.0.62
	RELENG_8_1_BP:1.1.1.2
	RELENG_7_3_0_RELEASE:1.1.1.2
	RELENG_7_3:1.1.1.2.0.60
	RELENG_7_3_BP:1.1.1.2
	RELENG_8_0_0_RELEASE:1.1.1.2
	RELENG_8_0:1.1.1.2.0.58
	RELENG_8_0_BP:1.1.1.2
	RELENG_8:1.1.1.2.0.56
	RELENG_8_BP:1.1.1.2
	RELENG_7_2_0_RELEASE:1.1.1.2
	RELENG_7_2:1.1.1.2.0.54
	RELENG_7_2_BP:1.1.1.2
	RELENG_7_1_0_RELEASE:1.1.1.2
	RELENG_6_4_0_RELEASE:1.1.1.2
	RELENG_7_1:1.1.1.2.0.52
	RELENG_7_1_BP:1.1.1.2
	RELENG_6_4:1.1.1.2.0.50
	RELENG_6_4_BP:1.1.1.2
	RELENG_7_0_0_RELEASE:1.1.1.2
	RELENG_6_3_0_RELEASE:1.1.1.2
	RELENG_7_0:1.1.1.2.0.48
	RELENG_7_0_BP:1.1.1.2
	RELENG_6_3:1.1.1.2.0.46
	RELENG_6_3_BP:1.1.1.2
	v4-1-28:1.1.1.2
	RELENG_7:1.1.1.2.0.44
	RELENG_7_BP:1.1.1.2
	v4-1-23:1.1.1.2
	RELENG_6_2_0_RELEASE:1.1.1.2
	RELENG_6_2:1.1.1.2.0.42
	RELENG_6_2_BP:1.1.1.2
	v4-1-13:1.1.1.2
	RELENG_5_5_0_RELEASE:1.1.1.2
	RELENG_5_5:1.1.1.2.0.40
	RELENG_5_5_BP:1.1.1.2
	RELENG_6_1_0_RELEASE:1.1.1.2
	RELENG_6_1:1.1.1.2.0.38
	RELENG_6_1_BP:1.1.1.2
	v4-1-10:1.1.1.2
	RELENG_6_0_0_RELEASE:1.1.1.2
	RELENG_6_0:1.1.1.2.0.36
	RELENG_6_0_BP:1.1.1.2
	RELENG_6:1.1.1.2.0.34
	RELENG_6_BP:1.1.1.2
	RELENG_5_4_0_RELEASE:1.1.1.2
	v4-1-8:1.1.1.2
	RELENG_5_4:1.1.1.2.0.32
	RELENG_5_4_BP:1.1.1.2
	RELENG_4_11_0_RELEASE:1.1.1.2
	RELENG_4_11:1.1.1.2.0.30
	RELENG_4_11_BP:1.1.1.2
	RELENG_5_3_0_RELEASE:1.1.1.2
	RELENG_5_3:1.1.1.2.0.28
	RELENG_5_3_BP:1.1.1.2
	RELENG_5:1.1.1.2.0.26
	RELENG_5_BP:1.1.1.2
	v3-4-35:1.1.1.2
	RELENG_4_10_0_RELEASE:1.1.1.2
	RELENG_4_10:1.1.1.2.0.24
	RELENG_4_10_BP:1.1.1.2
	RELENG_5_2_1_RELEASE:1.1.1.2
	RELENG_5_2_0_RELEASE:1.1.1.2
	RELENG_5_2:1.1.1.2.0.22
	RELENG_5_2_BP:1.1.1.2
	RELENG_4_9_0_RELEASE:1.1.1.2
	RELENG_4_9:1.1.1.2.0.20
	RELENG_4_9_BP:1.1.1.2
	RELENG_5_1_0_RELEASE:1.1.1.2
	RELENG_5_1:1.1.1.2.0.18
	RELENG_5_1_BP:1.1.1.2
	RELENG_4_8_0_RELEASE:1.1.1.2
	RELENG_4_8:1.1.1.2.0.16
	RELENG_4_8_BP:1.1.1.2
	v3-4-31:1.1.1.2
	RELENG_5_0_0_RELEASE:1.1.1.2
	RELENG_5_0:1.1.1.2.0.14
	RELENG_5_0_BP:1.1.1.2
	RELENG_4_7_0_RELEASE:1.1.1.2
	RELENG_4_7:1.1.1.2.0.12
	RELENG_4_7_BP:1.1.1.2
	v3-4-29:1.1.1.2
	RELENG_4_6_2_RELEASE:1.1.1.2
	RELENG_4_6_1_RELEASE:1.1.1.2
	RELENG_4_6_0_RELEASE:1.1.1.2
	v3-4-28:1.1.1.2
	RELENG_4_6:1.1.1.2.0.10
	RELENG_4_6_BP:1.1.1.2
	v3-4-27:1.1.1.2
	v3-4-26:1.1.1.2
	v3-4-25:1.1.1.2
	RELENG_4_5_0_RELEASE:1.1.1.2
	RELENG_4_5:1.1.1.2.0.8
	RELENG_4_5_BP:1.1.1.2
	RELENG_4_4_0_RELEASE:1.1.1.2
	RELENG_4_4:1.1.1.2.0.6
	RELENG_4_4_BP:1.1.1.2
	v3-4-20:1.1.1.2
	RELENG_4_3_0_RELEASE:1.1.1.2
	RELENG_4_3:1.1.1.2.0.4
	RELENG_4_3_BP:1.1.1.2
	v3-4-16:1.1.1.2
	rev:1.1.1.2
	RELENG_4_2_0_RELEASE:1.1.1.2
	v3-4-13:1.1.1.2
	v3-4-12:1.1.1.2
	RELENG_4_1_1_RELEASE:1.1.1.2
	PRE_SMPNG:1.1.1.2
	v3-4-9:1.1.1.2
	RELENG_4_1_0_RELEASE:1.1.1.2
	v3-4-8:1.1.1.2
	RELENG_3_5_0_RELEASE:1.1.1.1
	v3_4_4:1.1.1.2
	RELENG_4_0_0_RELEASE:1.1.1.2
	RELENG_4:1.1.1.2.0.2
	RELENG_4_BP:1.1.1.2
	v3_3_8:1.1.1.2
	v3_3_6:1.1.1.2
	RELENG_3_4_0_RELEASE:1.1.1.1
	v3_3_3:1.1.1.2
	RELENG_3_3_0_RELEASE:1.1.1.1
	RELENG_3_2_PAO:1.1.1.1.0.4
	RELENG_3_2_PAO_BP:1.1.1.1
	RELENG_3_2_0_RELEASE:1.1.1.1
	RELENG_3_1_0_RELEASE:1.1.1.1
	RELENG_3:1.1.1.1.0.2
	RELENG_3_BP:1.1.1.1
	RELENG_3_0_0_RELEASE:1.1.1.1
	v3_2_7:1.1.1.1
	v3_2_3:1.1.1.1
	v3_2_1:1.1.1.1
	DARRENR:1.1.1;
locks; strict;
comment	@# @;


1.1
date	97.11.16.04.52.09;	author peter;	state Exp;
branches
	1.1.1.1;
next	;

1.1.1.1
date	97.11.16.04.52.09;	author peter;	state Exp;
branches;
next	1.1.1.2;

1.1.1.2
date	99.11.08.20.51.13;	author guido;	state Exp;
branches
	1.1.1.2.76.1;
next	;

1.1.1.2.76.1
date	99.11.08.20.51.13;	author svnexp;	state dead;
branches;
next	1.1.1.2.76.2;

1.1.1.2.76.2
date	2013.03.28.13.01.21;	author svnexp;	state Exp;
branches;
next	;


desc
@@


1.1
log
@Initial revision
@
text
@Configuring IP Filter for firewall usage.
=========================================

Step 1 - Block out "bad" IP packets.
------------------------------------

Run the perl script "mkfilters".  This will generate a list of blocking
rules which:
	a) blocks all packets which might belong to an IP Spoofing attack;
	b) blocks all packets with IP options;
	c) blocks all packets which have a length which is too short for
	   any legal packet;

Step 2 - Convert Network Security Policy to filter rules.
---------------------------------------------------------

Draw up a list of which services you want to allow users to use on the
Internet (e.g. WWW, ftp, etc).  Draw up a separate list for what you
want each host that is part of your firewall to be allowed to do, including
communication with internal hosts.

Step 3 - Create TCP "keep state" rules.
---------------------------------------

For each service that uses TCP, create a rule as follows:

pass in on <int-a> proto tcp from <int-net> to any port <ext-service> flags S/SA keep state

where
* "int-a" is the internal interface of the firewall.  That is, it is the
  closest to your internal network in terms of network hops.

* "int-net" is the internal network IP# subnet address range.  This might
   be something like 10.1.0.0/16, or 128.33.1.0/24 

* "ext-service" is the service to which you which to connect or if it doesn't
  have a proper name, a number can be used.  The translation of "ext-service"
  as a name to a number is controlled with the /etc/services file.

@


1.1.1.1
log
@Import ipfilter 3.2.1 (update from 3.1.8)
@
text
@@


1.1.1.2
log
@Import of ipfilter 3.3.3  in anticipation of its revival.
More to come in the next days.
@
text
@d36 1
a36 1
* "ext-service" is the service to which you wish to connect or if it doesn't
@


1.1.1.2.76.1
log
@file firewall was added on branch RELENG_8_4 on 2013-03-28 13:01:21 +0000
@
text
@d1 39
@


1.1.1.2.76.2
log
@## SVN ## Exported commit - http://svnweb.freebsd.org/changeset/base/248810
## SVN ## CVS IS DEPRECATED: http://wiki.freebsd.org/CvsIsDeprecated
@
text
@a0 39
Configuring IP Filter for firewall usage.
=========================================

Step 1 - Block out "bad" IP packets.
------------------------------------

Run the perl script "mkfilters".  This will generate a list of blocking
rules which:
	a) blocks all packets which might belong to an IP Spoofing attack;
	b) blocks all packets with IP options;
	c) blocks all packets which have a length which is too short for
	   any legal packet;

Step 2 - Convert Network Security Policy to filter rules.
---------------------------------------------------------

Draw up a list of which services you want to allow users to use on the
Internet (e.g. WWW, ftp, etc).  Draw up a separate list for what you
want each host that is part of your firewall to be allowed to do, including
communication with internal hosts.

Step 3 - Create TCP "keep state" rules.
---------------------------------------

For each service that uses TCP, create a rule as follows:

pass in on <int-a> proto tcp from <int-net> to any port <ext-service> flags S/SA keep state

where
* "int-a" is the internal interface of the firewall.  That is, it is the
  closest to your internal network in terms of network hops.

* "int-net" is the internal network IP# subnet address range.  This might
   be something like 10.1.0.0/16, or 128.33.1.0/24 

* "ext-service" is the service to which you wish to connect or if it doesn't
  have a proper name, a number can be used.  The translation of "ext-service"
  as a name to a number is controlled with the /etc/services file.

@


