pf firewall for a workstation (III)

And another update on the firewall script.


## /etc/pf.conf

if="dc0"

my_nets="{ 1.2.3.4, 4.3.2.1, 4.3.2.1/27, 5.6.7.8/28 }"
my_lan="{ 10.120.10.0/29 }"

tcp_pass_universe= "{ 80 }"
tcp_pass_nets= "{ 22 }"
tcp_pass_lan= "{ 22 53 113 123 }"
udp_pass_lan="{ 53 123 }"
icmp_types="echoreq"

set skip on lo0

set block-policy return

scrub in

block in
pass out

antispoof for lo0
antispoof for ($if) inet

pass in on $if inet proto tcp from $my_lan to ($if) port $tcp_pass_lan
pass in on $if inet proto udp from $my_lan to ($if) port $udp_pass_lan

pass in on $if inet proto tcp from $my_nets to ($if) port $tcp_pass_nets
pass in on $if inet proto tcp from any to ($if) port $tcp_pass_universe

pass in on $if inet proto icmp from any to ($if) icmp-type $icmp_types

# EoF #

pf firewall for a workstation (II)

An update on the pf.conf firewall rules/ script.
I have modified it to allow everything on the loopback interface, as well as having a aggressive block, actually denying actively everything that is not specifically enabled.
Other than that, the file is basically the same.


## /etc/pf.conf

if="dc0"
universe="{ 0/0 }"
my_nets="{ 1.2.3.4, 4.3.2.1, 4.3.2.1/27, 5.6.7.8/28 }"
my_lan="{ 10.120.10.0/29 }"

tcp_pass_universe= "{ 80 }"
tcp_pass_nets= "{ 22 }"
tcp_pass_lan= "{ 22 53 113 123 }"
udp_pass_lan="{ 53 123 }"
icmp_types="echoreq"

set skip on lo

set block-policy return

block in
pass out

pass in on $if inet proto tcp from $my_lan to ($if) port $tcp_pass_lan
pass in on $if inet proto udp from $my_lan to ($if) port $udp_pass_lan

pass in on $if inet proto tcp from $my_nets to ($if) port $tcp_pass_nets
pass in on $if inet proto tcp from $universe to ($if) port $tcp_pass_universe

pass in on $if inet proto icmp from $universe to ($if) icmp-type $icmp_types

# EoF #

pf firewall for a workstation

That is, for a box with only one NIC and no NATing involved.
I have already setup (on the previous Judith incarnation) a pf firewall, but that was a 'regular one', with 2 NICs, NATing addresses and working as the gateway for my home LAN (link 1 link2 )

But for the moment, I'm not using judith as the gateway/ firewall, so I wanted to enable a plain vanilla firewall that would allow access only to a limited services, and to differentiate services for internet hosts (public HTTP. for instance) and others limited to some of the networks I have control.

This site A Beginner's Guide To Firewalling with pf has some very good tips, specially the one regarding howto enable the cron that would, eventually, work as a fail safe access, if the worst happens.
One thing, tho, you do load the rules with:

sudo /sbin/pfctl -f /etc/pf.conf

Or whatever the path to the config file is, but, at least on OpenBSD 4.2, pf it is not enabled, so, on top of loading the rules, you have to enable the firewall, like this:

sudo /sbin/pfctl -e


Here is the script, and it is a work in progress actually:



## /etc/pf.conf

if="dc0"
universe="{ 0/0 }"
my_nets="{ 1.2.3.4, 4.3.2.1, 4.3.2.1/27, 5.6.7.8/28 }"
my_lan="{ 10.120.10.0/29 }"

tcp_pass_universe= "{ 80 }"
tcp_pass_nets= "{ 22 }"
tcp_pass_lan= "{ 22 53 113 123 }"
udp_pass_lan="{ 53 123 }"
udp_pass_lo="{ 161 }"
icmp_types="echoreq"


block in
pass out


pass in on lo inet proto udp from lo to lo port $udp_pass_lo

pass in on $if inet proto tcp from $my_lan to ($if) port $tcp_pass_lan
pass in on $if inet proto udp from $my_lan to ($if) port $udp_pass_lan

pass in on $if inet proto tcp from $my_nets to ($if) port $tcp_pass_nets
pass in on $if inet proto tcp from $universe to ($if) port $tcp_pass_universe

pass in on $if inet proto icmp all icmp-type $icmp_types

# EoF #

PF: Going a little farther & tighter

As I said before I have installed an OpenBSD box on my LAN, to work as firewall, for the setup and rules, I have used one of the built-in example scripts supplied with the distro, the one called 'faq-example1', there are many other examples listed on the same OpenBSD installed box, under the '/usr/share/pf/' directory; or you can take a look at it on this page: Firewall for Home or Small Office.
What this sample script does exactly is this:

In this example, PF is running on an OpenBSD machine acting as a firewall and NAT gateway for a small network in a home or office. The overall objective is to provide Internet access to the network and to allow limited access to the firewall machine from the Internet, and expose an internal web server to the external Internet.

The thing is, I don't want to serve any site from my LAN, and also, I don't want the SSH port to be open to the public internet... So I have modified the script, to close those things up.
Here is a copy of how the edited file looks like:

# macros
ext_if="ne3"
int_if="dc0"
icmp_types="echoreq"

# options
set block-policy return
set loginterface $ext_if

set skip on lo

# scrub
scrub in

# nat/rdr
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021

# filter rules
block in

pass out

anchor "ftp-proxy/*"
antispoof quick for { lo $int_if }

pass in inet proto icmp all icmp-type $icmp_types

pass quick on $int_if no state


After editing and saving it, execute this, to make it active:

sudo pfctl -f /etc/pf.conf


This will block anything & everything coming from the outside, except for ping, which you'll get a reply from the external, the public, IP address of the OpenBSD's server; you can certainly close that as well, but I like to be able to know from any location if my ISP is working or not.

So long Belkin and thanks for all the airwaves

My beloved and trusty (so far) Belkin wireless router died today, it got fried when plugged to 220V, it runs on 110V...
So, it was an excellent opportunity to get my newly built incarnation of Goliath, as the main router and firewall for the setup.
It wasn't that hard to setup, it might have taken me a couple of hours, right now Goliath is working as the firewall, DHCP server, caching DNS server & NTPD server.
On top of that, since that box has a huge 80 GB drive on it, I'm using it to download BitTorrents, right now I'm running 6 torrents, on 6 screens, and the load of the OpenBSD barely scratches 1 dot something. I love this OpenBSD stuff! Specially how things are geared towards "getting things done", no bullshit, simple results, as an example, the explanation on how to make your OpenBSD box onto a DHCP Server is amazing, is somehow like a haiku.

For the whole setup, used the FAQs on the OpenBSD site, the firewall at the moment is the plain vanilla example for the Firewall for Home or Small Office, the DNS server setup, a caching only one, it is like the setup of a regular one, except that Bind does not server any zone, but the built-in ones.