Professional Web Applications Themes

ipfilter problems - FreeBSD

Two days ago I've switched the firewall on my FreeBSD 5.3 RELEASE router from ipfw to ipfilter. The firewalls are not my speciality and ipfilter looked simplier way to do NAT with firewall, because it separates NAT rules from filtering rules. The router has two interfaces rl0 (192.168.0.254/24) and rl1 (82.137.64.106/29, 192.168.5.1/24, 10.1.6.2/24). The ipfilter is compiled in kernel: ====================== options IPFILTER options IPFILTER_LOG options IPFILTER_DEFAULT_BLOCK /etc/ipnat.conf ============ map rl1 192.168.0.1/27 -> 82.137.64.106/32 /etc/ipf.rules ============ pass in quick on lo0 pass out quick on lo0 pass out quick on rl0 all pass in quick on rl0 all pass in quick ...

  1. #1

    Default ipfilter problems

    Two days ago I've switched the firewall on my FreeBSD 5.3 RELEASE
    router from ipfw to ipfilter. The firewalls are not my speciality
    and ipfilter looked simplier way to do NAT with firewall, because
    it separates NAT rules from filtering rules.

    The router has two interfaces rl0 (192.168.0.254/24) and rl1
    (82.137.64.106/29, 192.168.5.1/24, 10.1.6.2/24).
    The ipfilter is compiled in kernel:
    ======================
    options IPFILTER
    options IPFILTER_LOG
    options IPFILTER_DEFAULT_BLOCK

    /etc/ipnat.conf
    ============
    map rl1 192.168.0.1/27 -> 82.137.64.106/32

    /etc/ipf.rules
    ============
    pass in quick on lo0
    pass out quick on lo0
    pass out quick on rl0 all
    pass in quick on rl0 all
    pass in quick on rl1 proto tcp from 192.168.5.1/24 to 192.168.5.1 port =
    80 flags S keep state
    pass in quick on rl1 proto tcp from 192.168.5.1/24 to 192.168.5.1 port =
    3128 flags S keep state
    # local counter-strike server. No NAT.
    pass in quick on rl1 from 192.168.5.1/24 to 192.168.0.50 keep state
    block in quick on rl1 from 192.168.5.1/24 to any
    pass out quick on rl1 all keep state

    The problem
    ========
    On 192.168.0.0/24 network I have 6 machines. The router itself is an old
    166 MHz Pentium box, but load averages are not bigger than 10%. When one
    of the machins makes dns lookup (the dns server is on outside -
    62.73.78.2) it fails with timeout in about 9 of 10 times.
    ipfstat -t shows that a rule is created - something like this:
    Source IP Dest IP ST PR
    pkts. bytes
    192.168.0.4,1029 62.73.78.2,53 0/0 udp 165 9992

    Any help will be appreciated.
    Angelin Guest

  2. #2

    Default Re: ipfilter problems

    Angelin Lalev wrote: 

    Well, the short answer is: there is no keep state in the line

    pass in quick on rl0 all

    the dns reply you get back times out because your default rule is block
    and there is nowhere in the "in" rules for rl1 that allows the reply back.

    Some recomendations:

    1) I have a bit of dificulty understanding your network setup - why do
    you have two private networks on your external interface? May scetch in
    a diagram.

    2) Having default block can be done by adding the rules

    block in all
    block out all

    in the op of the ruleset rather than compile in the kernel. It makes
    it explicit. It also means that you can connect if no rules are
    pressent - this is usefull for installing while the machine is behind
    a gateway.

    Anyway, with your pass in all rules, you have almost effectively
    disabled the default block anyway.

    2) For your security, in all pass rules, state "from" and "to" even if
    it is "any" it makes it more explicit. Split on protocols for
    security and control.

    3) At least when setting up your firewall, use "log" in all block rules
    and enable ipmon, then you can see where your packets are blocked.

    4) Use groups to structure your rules, and group them accordingly
    visually. It makes them easier to manage and for large rulesets
    optimises the firewall.

    5) Always keep state! Doing so, all "out" rules only apply to the
    gateway itself, it makes the ruleset shorter and firewall faster.

    6) You probably want to enable the ftp-proxy in your nat-rule and define
    which port-ranges are used for nat'ed connections.

    and a lot more you'll learn along the way :-)

    Erik



    --
    Ph: +34.666334818 web: http://www.locolomo.org
    S/MIME Certificate: http://www.locolomo.org/crt/2004071206.crt
    Subject ID: A9:76:7A:ED:06:95:2B:8D:48:97:CE:F2:3F:42:C8:F2:22 :DE:4C:B9
    Fingerprint: 4A:E8:63:38:46:F6:9A:5D:B4:DC:29:41:3F:62:D3:0A:73 :25:67:C2
    Erik Guest

  3. #3

    Default Re: ipfilter problems

    Thank You very much!
     
    This makes sense... And I probably have done huge mistake...

    I thought that these rules are applied two times - once when the packet
    is about to enter
    "routing logic" and once when it exits "routing logic"
    the machine and once when the packet exits the machine (like ipfw).
    If that was the case the
    rule pass out quick on rl1 all keep state
    would do...
     


    rl0 is connected to an internet caffe with some game servers. It has
    only one IP address
    192.168.0.0/24.
    rl1 is connected via ethernet to a wireless bridge.

    The management address of the wireless bridge (provider's property)
    is 10.1.6.1. I added alias addr. 10.1.6.2/24 to the rl1, so I can ping
    it to test connectivity.

    Recently we have connected some outer clients to the same ethernet
    network on wich is the wireless bridge. They have addresses
    192.168.5.0/24 and have for gateway the our freebsd machine. They use
    squid server on the machine (like the machines on rl0 do) and need
    access to some game servers.


    Angelin Guest

Similar Threads

  1. Vim and NFS and ipfilter(strange problem)
    By HENCHOZ Daniel in forum FreeBSD
    Replies: 0
    Last Post: February 21st, 11:07 AM
  2. ipfilter outgoing
    By Sandy Rutherford in forum FreeBSD
    Replies: 0
    Last Post: February 17th, 12:34 AM
  3. ipfilter "flags s keep state" question
    By dick hoogendijk in forum FreeBSD
    Replies: 2
    Last Post: February 16th, 04:11 PM
  4. Sunscreen 3.2 or Ipfilter
    By Chris in forum Sun Solaris
    Replies: 3
    Last Post: August 7th, 05:03 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139