freebsd stable - Aug 2006 - IPFW rules

I'm trying to setup IPFW to block all ports except those I specify.
For starters I'm just opening SSH.

# ipfw list
00050 divert 8668 ip4 from any to any via rl0
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00301 allow log tcp from any to any dst-port 22
00399 deny ip from any to any
65000 allow ip from any to any
65535 deny ip from any to any

Traffic is still blocked on port 22 -- I can't login via SSH.  What am
I doing wrong, and what rule should I be using to allow SSH in and
through?

SigmaX

SigmaX asdf wrote:
> I'm trying to setup IPFW to block all ports except those I specify.
> For starters I'm just opening SSH.
> 
> # ipfw list
> 00050 divert 8668 ip4 from any to any via rl0
> 00100 allow ip from any to any via lo0
> 00200 deny ip from any to 127.0.0.0/8
> 00300 deny ip from 127.0.0.0/8 to any
> 00301 allow log tcp from any to any dst-port 22
> 00399 deny ip from any to any
> 65000 allow ip from any to any
> 65535 deny ip from any to any
> 
> Traffic is still blocked on port 22 -- I can't login via SSH.  What am
> I doing wrong, and what rule should I be using to allow SSH in and
> through?
> 
You need to allow the return traffic. Either something like:

ipfw add 1 allow tcp from any to any established

or:

ipfw add 1 check-state

and change your port 22 rule to read

ipfw allow log tcp from any to any port 22 keep-state


(check the ipfw(8) man page to be sure, I haven't touched ipfw rules in
a long time and my above syntax may be a bit buggy)


-Proto

SigmaX asdf wrote:
 > I'm trying to setup IPFW to block all ports except those I specify.
 > For starters I'm just opening SSH.
 > 
 > # ipfw list
 > 00050 divert 8668 ip4 from any to any via rl0
 > 00100 allow ip from any to any via lo0
 > 00200 deny ip from any to 127.0.0.0/8
 > 00300 deny ip from 127.0.0.0/8 to any
 > 00301 allow log tcp from any to any dst-port 22
 > 00399 deny ip from any to any
 > 65000 allow ip from any to any
 > 65535 deny ip from any to any
 > 
 > Traffic is still blocked on port 22 -- I can't login via SSH.  What am
 > I doing wrong, and what rule should I be using to allow SSH in and
 > through?

TCP connections are always 2-way (i.e. they require both
ingoing and outgoing packets).  But your rules allow only
one way.  There are three possibilities:

(1)  Sdd a rule "allow log tcp from any to any src-port 22"
     (not very efficient, but works).
(2)  Add "setup" to the dst-port 22 rule and add a rule
     that allows established connections.
(3)  Use "keep-state".

See the ipfw(8) manual page for details.  You should also
read a good book on TCP/IP and packet filter configuration.

By the way, you probably should also allow name server
traffic (port 53, UDP and TCP) and ICMP packets.

Best regards
   Oliver

-- 
Oliver Fromme,  secnetix GmbH & Co. KG, Marktplatz 29, 85567 Grafing
Dienstleistungen mit Schwerpunkt FreeBSD: http://www.secnetix.de/bsd
Any opinions expressed in this message may be personal to the author
and may not necessarily reflect the opinions of secnetix in any way.

"That's what I love about GUIs: They make simple tasks easier,
and complex tasks impossible."
        -- John William Chambless