d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

remove 16 rules and replace by 2 by using a table

Browse Source 
I've been doing this ever since there were tables
coudl make more efficient by using "in recv"  and "out xmit" instead of via
but I'll leave that.

MFC after:	1 week
This commit is contained in:
julian 2015-06-22 04:25:41 +00:00
parent 3cef8f432a
commit 667f7507fb
1 changed files with 14 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
etc/rc.firewall
View File

@ -266,6 +266,7 @@ case ${firewall_type} in
# firewall_simple_oif_ipv6: Outside IPv6 network interface.
# firewall_simple_onet_ipv6: Outside IPv6 network prefix.
############
BAD_ADDR_TBL=13
# set these to your outside interface network
oif="$firewall_simple_oif"
@ -290,19 +291,23 @@ case ${firewall_type} in
fi
fi
# define stuff we should never send out or receive in
# Stop RFC1918 nets on the outside interface
${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
${fwcmd} table ${BAD_ADDR_TBL} flush
${fwcmd} table ${BAD_ADDR_TBL} add 10.0.0.0/8
${fwcmd} table ${BAD_ADDR_TBL} add 172.16.0.0/12
${fwcmd} table ${BAD_ADDR_TBL} add 192.168.0.0/16
# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
${fwcmd} table ${BAD_ADDR_TBL} add 0.0.0.0/8
${fwcmd} table ${BAD_ADDR_TBL} add 169.254.0.0/16
${fwcmd} table ${BAD_ADDR_TBL} add 192.0.2.0/24
${fwcmd} table ${BAD_ADDR_TBL} add 224.0.0.0/4
${fwcmd} table ${BAD_ADDR_TBL} add 240.0.0.0/4
${fwcmd} add deny all from any to "table($BAD_ADDR_TBL)" via ${oif}
# Network Address Translation. This rule is placed here deliberately
# so that it does not interfere with the surrounding address-checking
@ -319,20 +324,7 @@ case ${firewall_type} in
;;
esac
# Stop RFC1918 nets on the outside interface
${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}
# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}
${fwcmd} add deny all from "table($BAD_ADDR_TBL)" to any via ${oif}
if [ -n "$inet6" ]; then
# Stop unique local unicast address on the outside interface
${fwcmd} add deny all from fc00::/7 to any via ${oif6}