FreeBSD firewall using IP Filter

from unixcircle
by
Hoang Q. Tran

It is really simple to build a FreeBSD gateway for a private network. You only need to do several tasks. Details are given below.

• 
  Lock down the box
  
  
• 
  Setup network interfaces
  
  
• 
  Customize the kernel
  
  
• 
  Enable packet forwarding, dhcp, firewall and network address translation
  
  
• 
  Configure machines behind NAT
  
  
• 
  Familiarize with IPFilter
  
  
• 
  Test the firewall
  
  
• 
  QoS
  
  
• 
  Reference
  

Lock down the box
The first step in setting up a firewall is to disable all running services that are not necessary. This helps minimize local and remote exploits. Edit /etc/rc.conf and make sure inetd, portmap, sendmail daemons are all disabled.
inetd_enable="NO"
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
check_quotas="NO"
Also comment out each service line in /etc/inetd.conf for extra precaution. If you need to remote logon, use ssh and add sshd_enable="YES" to /etc/rc.conf.
Once you disabled unnecessary services, go to
unixcircle.com portscan
to remotely port scan your own box
from the outside. Be careful when you do this behind a NAT/firewall box as the port scan script will scan the
NAT/firewall instead. If you have another box, use
nmap
to scan the box from the inside.
Get the latest FreeBSD security patches manually and apply them from here:
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/
or use CVSup to
synchronize
to stable release and build from source.
For more information on security vulnerabilities, read SANS
The Twenty Most Critical Internet Security Vulnerabilities (Updated)
Setup network interfaces
Assume this box has 2 3com 509B network cards and their FreeBSD driver are named as ep0 and
ep1 for first and second card. First network card will use the non-routable private address according to rfc1918.
The second will be assigned either static or dynamic via DHCP IP address.
Non-routable IP addresses for private networks:
10.0.0.1 - 10.255.255.254      netmask 255.0.0.0
172.16.0.1 - 172.31.255.254    netmask 255.240.0.0
192.168.0.1 - 192.168.255.254  netmask 255.255.0.0
Assume you choose 192.168.0.1 range, enable the first network interface in /etc/rc.conf:
ifconfig_ep0="inet 192.168.1.1 netmask 255.255.255.0"
If the second network card has static IP, enable it in /etc/rc.conf also:
ifconfig_ep1="inet xxx.xxx.xxx.xxx netmask xxx.xxx.xxx.xxx"
where xxx denotes your IP address and netmask provided by your ISP.
Be sure to indicate a correct IP address and netmask for both interfaces. Once you have chosen

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有