firewalls on CoderOnline

pfctl cheat sheet

Sat, 03 Oct 2015 19:09:40 +0200

Generic #

Only those commands, which you will probably require for setting pf up.

pfctl -s Tables              ;# lists all tables currently loaded
pfctl -t [TABLENAME] -T show ;# shows content of table [TABLENAME]

tcpdump -n -e -ttt -r /var/log/pflog
tcpdump -n -e -ttt -i pflog0

Anchors #

Fail2ban has recently switched to using anchors to avoid unnecessary reloading of the whole rule set. That was the first time I had to do with anchors and since I could not figure out a simple way to display the contents of all private tables (which can be described as subtables of anchors), I came up with this solution for my collectd monitoring:

ipfw configuration

Thu, 27 Aug 2015 21:51:26 +0200

Here comes an ipfw-configuration on which I was working on. It should redirect some ports to the host system, others into jails and on top of that limit on which ports jails and host are allowed to communicate with outside. Additionally I have configured a one second delay for the initial SSH connection, which is supposed to render brute force attacks less attractive.

# /usr/local/etc/2015-10-01.ipfw
# ================================================================================
# clean up/ reset everything...
flush
queue flush
pipe flush
table all flush
resetlog

# ================================================================================
# table 1: dns
table 1 add 213.133.99.99   
table 1 add 213.133.100.100 
table 1 add 213.133.98.98   

# table 2: jails
table 2 add 10.0.0.0/24

# nat 
nat 1 config if vtnet0 redirect_port tcp 10.0.0.100:8080 172.31.1.100:80

# pipes (requires kldload dummynet)
pipe 1 config delay 1000
pipe 2 config delay  200

# ================================================================================
add 100 pass all from any to any via lo0
add 200 deny all from any to 127.0.0.0/8
add 300 deny ip  from 127.0.0.0/8 to any    // ipv4 lo0 oubound
add 400 deny all from any to ::1            // ipv6 lo0 inbound
add 500 deny all from ::1 to any            // ipv6 lo0 outbound

add 1000 set 0 allow icmp      from any to me  in via vtnet0 // icmp4 incoming
add 1100 set 1 allow ipv6-icmp from any to me6 in via vtnet0 // icmp6 incoming 
add 1200 set 0 allow icmp      from me to any out via vtnet0 // icmp4 outgoing

# ================================================================================
add 1400 allow udp from me to table(1) 53 out   // allow dns

# slow down first ssh connection (setup) by using pipe 1...
add 1500 allow  tcp from me 22 to any           // ssh->any
add 1600 allow  tcp from any to me 22 not setup // any->me(22), not setup
add 1700 pipe 1 tcp from any to me 22 setup     // any->me(22), setup

# ================================================================================
add 2000 check-state
add 2100 allow ip from me to any setup keep-state out // outgoing connections

# ================================================================================
add 64000 nat 1 udp from any to any                  // udp->nat
add 64000 nat 1 tcp from any to me dst-port 80  in   // tcp->nat
add 64000 nat 1 tcp from me to any              out  // nat->any

# ================================================================================
add 65000 deny log ip from any to any // deny everything else, but log it

iptables

Thu, 26 Mar 2015 05:14:26 +0100

iptables is used to configure the linux kernel based firewall. Quite substatial is its ability to open and close ports, which I will discuss here. One should also be aware that iptables can be used to route traffic as well.

View active rules #

To view the rules in action watch can be used like so:

watch -d -n.1 iptables -L -v -n --line-numbers

This will output a number of tables, called CHAIN, which are usually named INPUT, OUTPUT and FORWARD. As that name suggests these indicate the direction the traffic comes from or goes to.