#!/bin/sh ## Boot Script for firewall # # thanks and acknowledgements for examples and explanations to # barijaona # (see http://homepage.mac.com/barijaona/macintosh/osxpb4.html) # daniel co^te' # (http://www3.sympatico.ca/dccote/firewall.html) # and brian hill # (see http://personalpages.tds.net/~brian_hill/brickhouse.html), # I recommend brian's brickhouse for purchase if you're going to # do a lot of firewall configuration, it's a great product # # Also see http://www.macdevcenter.com/pub/a/mac/2002/12/27/macosx_firewall.html # for additional information # # Finally, ipfw uses the /subnet mask denotation for declaring network ranges # For example, 152.2.0.0/16 is the same as 152.2.0.0 with a 255.255.0.0, the # /16 means that 16 bits of the 32 possible bits are masked. # Basically, the smaller the /index, the larger the range of addresses encompassed # This system is somewhat confusing to some folks, but there's a good online # subnet calculator you can use to figure out what ranges are covered # http://ccna.exampointers.com/subnet.htm ######## # Enable Logging ######## # # Logged entries go into /var/log/system.log # But there's no point in logging unless you're going to check the # entries. In this script, all deny are tagged with a log #if [ `/usr/sbin/sysctl -n net.inet.ip.fw.verbose` == 0 ] ; then # /usr/sbin/sysctl -w net.inet.ip.fw.verbose=1 #fi ## To disable logging, use # /usr/sbin/sysctl -w net.inet.ip.fw.verbose=0 # Purge existing rules /sbin/ipfw -f flush #Start with the default rules from Apple's configuration #Some standard services are listed, you can uncomment these #to enable the service, or use them as examples to tailor your #machine's settings ######## # Localhost Settings ######## # Allow everything on the localhost (127.0.0.1) # This way the machine can connect to itself via the ethernet interface /sbin/ipfw -f add 2000 allow ip from any to any via lo0 # Now check for spoofing attacks via localhost, and deny them /sbin/ipfw -f add 02010 deny log ip from 127.0.0.0/8 to any in /sbin/ipfw -f add 02020 deny log ip from any to 127.0.0.0/8 in /sbin/ipfw -f add 02030 deny log ip from 224.0.0.0/3 to any in /sbin/ipfw -f add 02040 deny log tcp from any to 224.0.0.0/3 in ######## # Meat and Potatos ######## # Allow all outbound. # This means your machine can try to # connect to any other machine out there /sbin/ipfw -f add 02050 allow tcp from any to any out # Allow all established connections # Any connections already in progress can be continued. # (so you don't have to open all dynamic ports) /sbin/ipfw -f add 02060 allow tcp from any to any established ######## # Network Related Rules to enable troubleshooting ######## # Allow ICMP (ping and traceroute) /sbin/ipfw -f add 3000 allow icmp from any to any ######## # Standard Services ######## # Don't open these unless you want to run the service. # Also consider who would need access, for example, it's very unlikely # you'll need to allow ssh from the entire internet. # Allow web service from anywhere #/sbin/ipfw -f add 4000 allow tcp from any to any 80 setup # Allow ftp # (BUT you shouldn't need to do this--if you enable remote login # in the preferences, you're turning on sftp as well as ssh, and # sftp is much more secure than ftp!) # /sbin/ipfw -f add 4010 allow tcp from any to any 20-21 setup # Allow ssh from unc.edu hosts /sbin/ipfw -f add 4020 allow tcp from 152.2.0.0/16 to any 22 setup /sbin/ipfw -f add 4020 allow tcp from 152.19.0.0/16 to any 22 setup # Allow AppleShare File Sharing from unc hosts /sbin/ipfw -f add 4150 allow tcp from 152.2.0.0/16 to any 548 setup /sbin/ipfw -f add 4150 allow tcp from 152.2.0.0/16 to any 427 setup /sbin/ipfw -f add 4150 allow tcp from 152.19.0.0/16 to any 548 setup /sbin/ipfw -f add 4150 allow tcp from 152.19.0.0/16 to any 427 setup # Allow SMB/CIFS (windows networking) from unc hosts /sbin/ipfw -f add 4100 allow tcp from 152.2.0.0/16 to any 139 setup /sbin/ipfw -f add 4100 allow tcp from 152.19.0.0/16 to any 139 setup #Or just from cs.unc.edu hosts #/sbin/ipfw -f add 4100 allow tcp from 152.2.128.0/20 to any 139 setup ####### # Closing up ####### /sbin/ipfw -f add 60000 deny log tcp from any to any /sbin/ipfw -f add 60010 allow ip from any to any