My Personal Firewall and IP Masquerading Howto first read the official IP masq HOWTO resp. Firewall HOWTO here are simply scripts that I use First script is about my ppp connection to my ISP #!/bin/sh #this funny script requires RedHat Linux network config scheme and #hw/sw: lo eth0 and ppp0 devices #applic: sleep sed awk ipfwadm uname ifconfig case "$1" in 1) echo "Enabling packet filtering firewall" sleep 38 #Variable declarations . /etc/sysconfig/network-scripts/ifcfg-eth0 IFINTERN=`/sbin/ifconfig eth0 |sed -n -e 's/inet addr://p'|awk '{print $1}'` IFEXTERN=`/sbin/ifconfig ppp0 |sed -n -e 's/inet addr://p'|awk '{print $1}'` IFLOOP=`/sbin/ifconfig lo |sed -n -e 's/inet addr://p'|awk '{print $1}'` UNPRIVPORTS="1024:65535" ANYWHERE="any/0" LOCALHOST=`uname -n` #Select default policies ipfwadm -F -p deny ipfwadm -I -p deny ipfwadm -O -p deny #Flush (get rid of) other policies ipfwadm -F -f ipfwadm -I -f ipfwadm -O -f #disable spoofed packets ipfwadm -I -a deny -V $IFEXTERN -S $NETWORK ipfwadm -I -a deny -V $IFEXTERN -S $IFEXTERN #allow any trafic within local network ipfwadm -I -a accept -V $IFINTERN ipfwadm -O -a accept -V $IFINTERN #allow any trafic within loopback device ipfwadm -I -a accept -V $IFLOOP ipfwadm -O -a accept -V $IFLOOP #accessing of internet from this machine #outgoing packets ipfwadm -O -a accept -P tcp -S $IFEXTERN $UNPRIVPORTS \ -D $ANYWHERE nntp ftp ftp-data http domain telnet ipfwadm -O -a accept -P udp -S $IFEXTERN $UNPRIVPORTS \ -D $ANYWHERE domain #incoming packets ipfwadm -I -a accept -k -P tcp \ -S $ANYWHERE nntp ftp http domain telnet \ -D $IFEXTERN $UNPRIVPORTS ipfwadm -I -a accept -P tcp \ -S $ANYWHERE ftp-data -D $IFEXTERN $UNPRIVPORTS ipfwadm -I -a accept -P udp \ -S $ANYWHERE domain -D $IFEXTERN $UNPRIVPORTS ;; 0) echo "Disabling packet filtering firewall" ipfwadm -F -f ipfwadm -I -f ipfwadm -O -f ipfwadm -F -p accept ipfwadm -I -p accept ipfwadm -O -p accept ipfwadm -F -l ipfwadm -I -l ipfwadm -O -l ;; *) echo "Usage: $0 {1|0}" exit 0 esac Second script contains setting for a forwarding machine a'la router #!/bin/sh #tento firewall pusta vsetko zadefinovane z lok siete ale nie #zo samotneho firewallu LOCALHOST="intranet.nova2" LOCALNET="199.100.199.0/24" IFEXTERN="192.1.1.1" IFINTERN="199.100.199.4" ANYWHERE="any/0" UNPRIVPORTS="1024:65535" # ====== Basic rules. # Sure we're paranoid, but are we paranoid enough? ipfwadm -I -p deny ipfwadm -O -p deny ipfwadm -F -p deny #Flush all other rules ipfwadm -I -f ipfwadm -O -f ipfwadm -F -f # Refuse spoofed packets. ipfwadm -I -a deny -V $IFEXTERN -S $LOCALNET ipfwadm -I -a deny -V $IFEXTERN -S $IFEXTERN # Unlimited traffic within the local network. ipfwadm -I -a accept -V $IFINTERN ipfwadm -O -a accept -V $IFINTERN # Unlimited ICMP traffic (not recommended). #ipfwadm -I -a accept -P icmp #ipfwadm -O -a accept -P icmp #ipfwadm -F -a accept -P icmp # ====== External use of our system. # # Public access for e-mail, ftp, WWW, and DNS. #ipfwadm -I -a accept -P tcp \ # -D $LOCALHOST smtp ftp www domain #ipfwadm -I -a accept -P udp -D $LOCALHOST domain #ipfwadm -I -a accept -k -P tcp \ # -D $LOCALHOST ftp-data #ipfwadm -O -a accept -P tcp -S $LOCALHOST smtp ftp \ # ftp-data www domain #ipfwadm -O -a accept -P udp -S $LOCALHOST domain # # ====== Internal use of the Internet. # # Outgoing packets. ipfwadm -O -a accept -P tcp -S $LOCALNET $UNPRIVPORTS \ -D $ANYWHERE ftp ftp-data www telnet domain ipfwadm -O -a accept -P udp -S $LOCALNET $UNPRIVPORTS \ -D $ANYWHERE domain ipfwadm -F -a accept -P tcp -S $LOCALNET $UNPRIVPORTS \ -D $ANYWHERE ftp ftp-data www telnet domain ipfwadm -F -a accept -P udp -S $LOCALNET $UNPRIVPORTS \ -D $ANYWHERE domain # Incoming packets. ipfwadm -I -a accept -k -P tcp \ -S $ANYWHERE ftp www telnet domain \ -D $LOCALNET $UNPRIVPORTS ipfwadm -I -a accept -P tcp \ -S $ANYWHERE ftp-data -D $LOCALNET $UNPRIVPORTS ipfwadm -I -a accept -P udp \ -S $ANYWHERE domain -D $LOCALNET $UNPRIVPORTS ipfwadm -F -a accept -k -P tcp \ -S $ANYWHERE ftp www telnet \ -D $LOCALNET $UNPRIVPORTS ipfwadm -F -a accept -P tcp \ -S $ANYWHERE ftp-data -D $LOCALNET $UNPRIVPORTS ipfwadm -F -a accept -P udp \ -S $ANYWHERE domain -D $LOCALNET $UNPRIVPORTS Third scripts is the one with IP Masq instead of Forward #!/bin/sh #this funny script requires RedHat Linux network config scheme and #hw/sw: lo eth0 and eth1 devices #applic: sleep sed awk ipfwadm uname ifconfig case "$1" in 1) echo "Enabling packet filtering firewall" #sleep 30 #load module for masq ftp JUNK=`lsmod |grep ip_masq_ftp` if [ "${JUNK}" = "" ];then insmod ip_masq_ftp fi #Variable declarations . /etc/sysconfig/network-scripts/ifcfg-eth0 IFINTERN=`/sbin/ifconfig eth0 |sed -n -e 's/inet addr://p'|awk '{print $1}'` IFEXTERN=`/sbin/ifconfig eth1 |sed -n -e 's/inet addr://p'|awk '{print $1}'` IFLOOP=`/sbin/ifconfig lo |sed -n -e 's/inet addr://p'|awk '{print $1}'` UNPRIVPORTS="1024:65535" ANYWHERE="any/0" LOCALHOST=`uname -n` #Select default policies ipfwadm -F -p deny ipfwadm -I -p deny ipfwadm -O -p deny #Flush (get rid of) other policies ipfwadm -F -f ipfwadm -I -f ipfwadm -O -f #disable spoofed packets ipfwadm -I -a deny -V $IFEXTERN -S $NETWORK/$NETMASK ipfwadm -I -a deny -V $IFEXTERN -S $IFEXTERN #allow any trafic within local network ipfwadm -I -a accept -V $IFINTERN ipfwadm -O -a accept -V $IFINTERN #allow any trafic within loopback device ipfwadm -I -a accept -V $IFLOOP ipfwadm -O -a accept -V $IFLOOP #accessing of internet from this machine #outgoing packets ipfwadm -O -a accept -P tcp -S $IFEXTERN $UNPRIVPORTS \ -D $ANYWHERE \ nntp ftp ftp-data http domain telnet smtp pop ipfwadm -O -a accept -P udp -S $IFEXTERN $UNPRIVPORTS \ -D $ANYWHERE domain #incoming packets ipfwadm -I -a accept -k -P tcp \ -S $ANYWHERE nntp ftp http domain telnet smtp pop\ -D $IFEXTERN $UNPRIVPORTS ipfwadm -I -a accept -P tcp \ -S $ANYWHERE ftp-data -D $IFEXTERN $UNPRIVPORTS ipfwadm -I -a accept -P udp \ -S $ANYWHERE domain -D $IFEXTERN $UNPRIVPORTS #forwarding masquerading section ipfwadm -F -a accept -m -P tcp -S $NETWORK/$NETMASK \ -D $ANYWHERE \ nntp ftp ftp-data http domain telnet smtp pop ipfwadm -F -a accept -m -P udp -S $NETWORK/$NETMASK \ -D $ANYWHERE domain ;; 0) echo "Disabling packet filtering firewall" ipfwadm -F -f ipfwadm -I -f ipfwadm -O -f ipfwadm -F -p accept ipfwadm -I -p accept ipfwadm -O -p accept ipfwadm -F -l ipfwadm -I -l ipfwadm -O -l #unload module for masq_ftp if free JUNK=`lsmod |grep ip_masq_ftp.*0` if [ ! "${JUNK}" = "" ];then rmmod ip_masq_ftp fi ;; *) echo "Usage: $0 {1|0}" exit 1 esac Some user friendly version of IP Masq #!/bin/sh #this funny script requires RedHat Linux network config scheme and #hw/sw: lo eth0 and ppp0 devices #applic: sleep sed awk ipfwadm uname ifconfig grep case "$1" in 1) echo "Enabling packet filtering firewall" sleep 38 #load module for masq ftp JUNK=`lsmod |grep ip_masq_ftp` if [ "${JUNK}" = "" ];then insmod ip_masq_ftp fi #Variable declarations . /etc/sysconfig/network-scripts/ifcfg-eth0 IFINTERN=`/sbin/ifconfig eth0 |sed -n -e 's/inet addr://p'|awk '{print $1}'` IFEXTERN=`/sbin/ifconfig ppp0 |sed -n -e 's/inet addr://p'|awk '{print $1}'` IFLOOP=`/sbin/ifconfig lo |sed -n -e 's/inet addr://p'|awk '{print $1}'` UNPRIVPORTS="1024:65535" ANYWHERE="any/0" LOCALHOST=`uname -n` #Select default policies ipfwadm -F -p deny ipfwadm -I -p deny ipfwadm -O -p deny #Flush (get rid of) other policies ipfwadm -F -f ipfwadm -I -f ipfwadm -O -f #disable spoofed packets ipfwadm -I -a deny -V $IFEXTERN -S $NETWORK/$NETMASK ipfwadm -I -a deny -V $IFEXTERN -S $IFEXTERN ipfwadm -I -a deny -P tcp -V $IFEXTERN -S $ANYWHERE -D $ANYWHERE 6000 #allow any trafic within local network ipfwadm -I -a accept -V $IFINTERN ipfwadm -O -a accept -V $IFINTERN #allow any trafic within loopback device ipfwadm -I -a accept -V $IFLOOP ipfwadm -O -a accept -V $IFLOOP #accessing of internet from this machine #outgoing packets ipfwadm -O -a accept -P tcp -S $IFEXTERN $UNPRIVPORTS \ -D $ANYWHERE \ nntp ftp ftp-data http domain telnet smtp pop #spec http ipfwadm -O -a accept -P tcp -S $IFEXTERN $UNPRIVPORTS \ -D $ANYWHERE $UNPRIVPORTS ipfwadm -O -a accept -P udp -S $IFEXTERN $UNPRIVPORTS \ -D $ANYWHERE domain #incoming packets ipfwadm -I -a accept -k -P tcp \ -S $ANYWHERE nntp ftp http domain telnet smtp pop\ -D $IFEXTERN $UNPRIVPORTS #spec http ipfwadm -I -a accept -k -P tcp \ -S $ANYWHERE $UNPRIVPORTS \ -D $IFEXTERN $UNPRIVPORTS ipfwadm -I -a accept -P tcp \ -S $ANYWHERE ftp-data -D $IFEXTERN $UNPRIVPORTS ipfwadm -I -a accept -P udp \ -S $ANYWHERE domain -D $IFEXTERN $UNPRIVPORTS #forwarding masquerading section ipfwadm -F -a accept -m -P tcp -S $NETWORK/$NETMASK \ -D $ANYWHERE \ nntp ftp ftp-data http domain telnet smtp pop $UNPRIVPORTS ipfwadm -F -a accept -m -P udp -S $NETWORK/$NETMASK \ -D $ANYWHERE domain ;; 0) echo "Disabling packet filtering firewall" ipfwadm -F -f ipfwadm -I -f ipfwadm -O -f ipfwadm -F -p accept ipfwadm -I -p accept ipfwadm -O -p accept ipfwadm -F -l ipfwadm -I -l ipfwadm -O -l #unload module for masq_ftp if free JUNK=`lsmod |grep ip_masq_ftp.*0` if [ ! "${JUNK}" = "" ];then rmmod ip_masq_ftp fi ;; *) echo "Usage: $0 {1|0}" exit 1 esac