Better RFC1918 network protection
PR: 6278 Reviewed by: phk Submitted by: Ruslan Ermilov <ru@ucb.crimea.ua>
This commit is contained in:
parent
5a85f025f8
commit
3d10253c7d
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=35207
@ -1,6 +1,6 @@
|
||||
############
|
||||
# Setup system for firewall service.
|
||||
# $Id: rc.firewall,v 1.15 1997/10/21 00:54:08 danny Exp $
|
||||
# $Id: rc.firewall,v 1.16 1998/02/10 01:45:47 adam Exp $
|
||||
|
||||
if [ -f /etc/rc.conf ]; then
|
||||
. /etc/rc.conf
|
||||
@ -140,8 +140,11 @@ elif [ "${firewall_type}" = "simple" ]; then
|
||||
|
||||
# Stop RFC1918 nets on the outside interface
|
||||
$fwcmd add deny all from 192.168.0.0:255.255.0.0 to any via ${oif}
|
||||
$fwcmd add deny all from any to 192.168.0.0:255.255.0.0 via ${oif}
|
||||
$fwcmd add deny all from 172.16.0.0:255.240.0.0 to any via ${oif}
|
||||
$fwcmd add deny all from any to 172.16.0.0:255.240.0.0 via ${oif}
|
||||
$fwcmd add deny all from 10.0.0.0:255.0.0.0 to any via ${oif}
|
||||
$fwcmd add deny all from any to 10.0.0.0:255.0.0.0 via ${oif}
|
||||
|
||||
# Allow TCP through if setup succeeded
|
||||
$fwcmd add pass tcp from any to any established
|
||||
|
Loading…
Reference in New Issue
Block a user