UNIX for Dummies Questions & Answers

ipfw add pass tcp from any to any established
ipfw add pass tcp from any to me 80 via {$ext_if} keep-state

[Ss][Ii][Mm][Pp][Ll][Ee])
        ############
        # This is a prototype setup for a simple firewall.  Configure this
        # machine as a named server and ntp server, and point all the machines
        # on the inside at this machine for those services.
        ############

        dont_deny="my_very_best_friend"

        # set these to your outside interface network and netmask and ip
        oif="rl1"
        onet="outside_net_address"
        omask="255.255.255.240"
        oip="outside_ip_addr"

        # set these to your inside interface network and netmask and ip
        iif="rl0"
        inet="internal_net_address"
        imask="255.255.255.0"
        iip="internal_ip"

        # Stop spoofing
        ${fwcmd} add deny all from ${inet}:${imask} to any in via ${oif}
        ${fwcmd} add deny all from ${onet}:${omask} to any in via ${iif}

        # Stop RFC1918 nets on the outside interface
        ${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
        ${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
        ${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}

        # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
        # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
        # on the outside interface
        ${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
        ${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
        ${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
        ${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
        ${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}


        #########       RULES BEFORE NAT      ######################

        # Allow access for iserver
        #${fwcmd} add pass tcp from 192.168.10.10 to any out setup
        # Allow access for SIMM-3
        #${fwcmd} add pass tcp from 192.168.10.20 to any out setup
        # Deny everything else
        #${fwcmd} add deny all from 192.168.0.0/24 to any setup
        #

        #######################################################################

        # Network Address Translation.  This rule is placed here deliberately
        # so that it does not interfere with the surrounding address-checking
        # rules.  If for example one of your internal LAN machines had its IP
        # address set to 192.0.2.1 then an incoming packet for it after being
        # translated by natd(8) would match the `deny' rule above.  Similarly
        # an outgoing packet originated from it before being translated would
        # match the `deny' rule below.
        case ${natd_enable} in
        [Yy][Ee][Ss])
                if [ -n "${natd_interface}" ]; then
                        ${fwcmd} add divert natd all from any to any via ${natd_interface}
                fi
                ;;
        esac

        # Stop RFC1918 nets on the outside interface
        ${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
        ${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
        ${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}

        # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
        # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
        # on the outside interface
        ${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
        ${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
        ${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
        ${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
        ${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}

        ####    RULES AFTER NAT       ##########################

        ${fwcmd} add pass tcp from any to me 113
        ${fwcmd} add pass tcp from me 113 to any

        # ${fwcmd} add pass tcp from me to any via ${iif} keep-state

        ##################################################################

        # Don't deny address[es]
        ${fwcmd} add pass all from ${dont_deny} to any
        ${fwcmd} add pass all from any to ${dont_deny}

        # Allow TCP through if setup succeeded
        ${fwcmd} add pass tcp from any to any established

        # Allow IP fragments to pass through
        ${fwcmd} add pass all from any to any frag

        # Allow setup of incoming email
        ${fwcmd} add pass tcp from any to ${oip} 25 setup

        # Allow access to our DNS
        ${fwcmd} add pass tcp from any to ${oip} 53 setup
        ${fwcmd} add pass udp from any to ${oip} 53
        ${fwcmd} add pass udp from ${oip} 53 to any

        # Allow access to our WWW
        ${fwcmd} add pass tcp from any to ${oip} 80 setup

        # Allow access to Webmin
        ${fwcmd} add pass tcp from any to ${oip} 3129 setup

        # SSH
        ${fwcmd} add pass tcp from any to ${oip} 22 setup

        # FTP
        ${fwcmd} add pass tcp from any to ${oip} 21 setup

        # FTP-data
        ${fwcmd} add pass tcp from any to ${oip} 20 setup

        # SMTP
        ${fwcmd} add pass tcp from any to ${oip} 25 setup

        # POP3
        ${fwcmd} add pass tcp from any to ${oip} 110 setup

        # Reject&Log all setup of incoming connections from the outside
        ${fwcmd} add deny log tcp from any to any in via ${oif} setup

        # Allow setup of any other TCP connection
        ${fwcmd} add pass tcp from any to any setup

        # Allow DNS queries out in the world
        ${fwcmd} add pass udp from ${oip} to any 53 keep-state

        # Allow NTP queries out in the world
        ${fwcmd} add pass udp from ${oip} to any 123 keep-state

        # Everything else is denied by default, unless the
        # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
        # config file.
        ;;