003 File Manager
Current Path:
/usr/src/contrib/ipfilter/rules
usr
/
src
/
contrib
/
ipfilter
/
rules
/
📁
..
📄
BASIC.NAT
(1.58 KB)
📄
BASIC_1.FW
(3.92 KB)
📄
BASIC_2.FW
(2.51 KB)
📄
example.1
(133 B)
📄
example.10
(431 B)
📄
example.11
(820 B)
📄
example.12
(376 B)
📄
example.13
(468 B)
📄
example.2
(149 B)
📄
example.3
(990 B)
📄
example.4
(66 B)
📄
example.5
(689 B)
📄
example.6
(186 B)
📄
example.7
(362 B)
📄
example.8
(326 B)
📄
example.9
(291 B)
📄
example.sr
(2.04 KB)
📄
firewall
(1.5 KB)
📄
ftp-proxy
(1.24 KB)
📄
ftppxy
(272 B)
📄
ip_rules
(76 B)
📄
ipmon.conf
(685 B)
📄
nat-setup
(2.78 KB)
📄
nat.eg
(596 B)
📄
pool.conf
(161 B)
📄
server
(471 B)
📄
tcpstate
(453 B)
Editing: firewall
Configuring IP Filter for firewall usage. ========================================= Step 1 - Block out "bad" IP packets. ------------------------------------ Run the perl script "mkfilters". This will generate a list of blocking rules which: a) blocks all packets which might belong to an IP Spoofing attack; b) blocks all packets with IP options; c) blocks all packets which have a length which is too short for any legal packet; Step 2 - Convert Network Security Policy to filter rules. --------------------------------------------------------- Draw up a list of which services you want to allow users to use on the Internet (e.g. WWW, ftp, etc). Draw up a separate list for what you want each host that is part of your firewall to be allowed to do, including communication with internal hosts. Step 3 - Create TCP "keep state" rules. --------------------------------------- For each service that uses TCP, create a rule as follows: pass in on <int-a> proto tcp from <int-net> to any port <ext-service> flags S/SA keep state where * "int-a" is the internal interface of the firewall. That is, it is the closest to your internal network in terms of network hops. * "int-net" is the internal network IP# subnet address range. This might be something like 10.1.0.0/16, or 128.33.1.0/24 * "ext-service" is the service to which you wish to connect or if it doesn't have a proper name, a number can be used. The translation of "ext-service" as a name to a number is controlled with the /etc/services file.
Upload File
Create Folder