File Manager

003 File Manager

Current Path: /usr/share/examples/ipfilter

📁 ..
📄 BASIC.NAT(1.58 KB)
📄 BASIC_1.FW(3.92 KB)
📄 BASIC_2.FW(2.51 KB)
📄 README(374 B)
📄 example.1(133 B)
📄 example.10(431 B)
📄 example.11(820 B)
📄 example.12(376 B)
📄 example.13(468 B)
📄 example.14(2.05 KB)
📄 example.2(149 B)
📄 example.3(990 B)
📄 example.4(66 B)
📄 example.5(689 B)
📄 example.6(186 B)
📄 example.7(362 B)
📄 example.8(326 B)
📄 example.9(291 B)
📄 example.sr(2.04 KB)
📄 examples.txt(18.47 KB)
📄 firewall(1.5 KB)
📄 firewall.1(1.36 KB)
📄 firewall.2(3.01 KB)
📄 ftp-proxy(1.24 KB)
📄 ftppxy(272 B)
📄 ipf-howto.txt(112.46 KB)
📄 ipf.conf.permissive(1.23 KB)
📄 ipf.conf.restrictive(3.99 KB)
📄 ipf.conf.sample(783 B)
📄 ipnat.conf.sample(126 B)
📄 mkfilters(2.62 KB)
📄 nat-setup(2.78 KB)
📄 nat.eg(596 B)
📄 rules.txt(5.1 KB)
📄 server(471 B)
📄 tcpstate(453 B)

Editing: firewall

Configuring IP Filter for firewall usage.
=========================================

Step 1 - Block out "bad" IP packets.
------------------------------------

Run the perl script "mkfilters".  This will generate a list of blocking
rules which:
	a) blocks all packets which might belong to an IP Spoofing attack;
	b) blocks all packets with IP options;
	c) blocks all packets which have a length which is too short for
	   any legal packet;

Step 2 - Convert Network Security Policy to filter rules.
---------------------------------------------------------

Draw up a list of which services you want to allow users to use on the
Internet (e.g. WWW, ftp, etc).  Draw up a separate list for what you
want each host that is part of your firewall to be allowed to do, including
communication with internal hosts.

Step 3 - Create TCP "keep state" rules.
---------------------------------------

For each service that uses TCP, create a rule as follows:

pass in on <int-a> proto tcp from <int-net> to any port <ext-service> flags S/SA keep state

where
* "int-a" is the internal interface of the firewall.  That is, it is the
  closest to your internal network in terms of network hops.

* "int-net" is the internal network IP# subnet address range.  This might
   be something like 10.1.0.0/16, or 128.33.1.0/24

* "ext-service" is the service to which you wish to connect or if it doesn't
  have a proper name, a number can be used.  The translation of "ext-service"
  as a name to a number is controlled with the /etc/services file.

003 File Manager

Editing: firewall

Upload File

Create Folder