#!/bin/sh ## Boot Script for firewall # # thanks and acknowledgements for examples and explanations to # barijaona # (see http://homepage.mac.com/barijaona/macintosh/osxpb4.html) # daniel co^te' # (http://www3.sympatico.ca/dccote/firewall.html) # Dru Lavigne # (http://www.onlamp.com/pub/a/bsd/2001/04/25/FreeBSD_Basics.html) # and brian hill # (see http://personalpages.tds.net/~brian_hill/brickhouse.html), # I recommend brian's brickhouse for purchase if you're going to # do a lot of firewall configuration, it's a great product # # Also see # http://www.macdevcenter.com/pub/a/mac/2002/12/27/macosx_firewall.html # for additional information # # Finally, ipfw uses the /subnet mask denotation for declaring network ranges # For example, 152.2.0.0/16 is the same as 152.2.0.0 with a 255.255.0.0, the # /16 means that 16 bits of the 32 possible bits are masked. # Basically, the smaller the /index, the larger the range of addresses encompassed # This system is somewhat confusing to some folks, but there's a good online # subnet calculator you can use to figure out what ranges are covered # http://ccna.exampointers.com/subnet.htm ######## # Enable Logging ######## # # Logged entries go into /var/log/system.log # But there's no point in logging unless you're going to check the # entries. In this script, all deny are tagged with a log if [ `/usr/sbin/sysctl -n net.inet.ip.fw.verbose` == 0 ] ; then /usr/sbin/sysctl -w net.inet.ip.fw.verbose=1 fi ## To disable logging, comment out the above lines and uncomment the following: # /usr/sbin/sysctl -w net.inet.ip.fw.verbose=0 # Purge existing rules, this blanks any existing rules /sbin/ipfw -f flush #Some standard services are listed, you can uncomment these #to enable the service, or use them as examples to tailor your #machine's settings ######## # Localhost Settings ######## # Allow everything on the localhost (127.0.0.1) # This way the machine can connect to itself via the localhost interface # This also sets the start of the rule sequence /sbin/ipfw -f add 00100 allow ip from any to any via lo0 # Now check for spoofing attacks via localhost, and deny them # Also log the denial /sbin/ipfw -f add 00110 deny log ip from 127.0.0.0/8 to any in /sbin/ipfw -f add 00120 deny log ip from any to 127.0.0.0/8 in /sbin/ipfw -f add 00130 deny log ip from 224.0.0.0/3 to any in /sbin/ipfw -f add 00140 deny log tcp from any to 224.0.0.0/3 in ######## # Minimal Requirements ######## # First, tell ipfw to track states # Also, I'm inserting a rule number here, since what I've set the rules # for basic networking, and now I'm opening services. # So by setting a new rule number here, I can create a block in the center # where I can dynamically insert rules as needed to block bad guys # with a blocker script such as TimeLox, see: # http://wwwx.cs.unc.edu/~hays/dev/timelox_and_TheHand/ # # /sbin/ipfw -f add 25000 check-state # Allow established connections # This rule matches tcp packets that have the ack or rst bits set # It shouldn't be needed for a stateful firewall, but # in practice with 10.3 I've found connections to be flaky # if you don't use this, seems like the connection tracker # times out too soon. /sbin/ipfw -f add allow tcp from any to any established # Allow all outbound, and tell ipfw to track state of outbound connections /sbin/ipfw -f add allow tcp from any to any out setup keep-state # Allow outbound icmp and udp /sbin/ipfw -f add allow udp from any to any out keep-state /sbin/ipfw -f add allow icmp from any to any out # DHCP Settings # Shouldn't be needed since we're checking state, but left in the file in # case anyone has problems. If you boot, and can't get an IP number, # try uncommenting this. # # Allow DHCP from any server #/sbin/ipfw -f add allow udp from any 67 to any 68 in # If you know what server you use for DHCP, you can refine this a bit, # which reduces the chance of getting the wrong number. It also reduces # the chance of getting any number, especially if you are mobile. # 1021 and 1022 are set up for computer science affiliates registered with our # DHCP server. #/sbin/ipfw -f add allow udp from 152.2.131.228 67 to any 68 in #/sbin/ipfw -f add allow udp from 152.2.131.227 67 to any 68 in # If the above doesn't work, you might need to uncomment these #/sbin/ipfw -f add allow udp from any 68 to 255.255.255.255 67 out #/sbin/ipfw -f add allow udp from any 67 to 255.255.255.255 68 in # DNS Settings # Shouldn't be needed since we're checking state, but left in the file in # case anyone has problems. If you boot, and can't get host or nslookup to # resolve names, try uncommenting this. # This rule opens the firewall to any DNS server, so if you have a laptop that # moves from network to network, this may be the best rule to use. #/sbin/ipfw -f add allow udp from any 53 to any in # These rules allow DNS only from known servers. The first two lines are the dns servers for CS. # Users outside of CS should use the main unc servers, 152.2.21.1 and 152.2.253.100 #/sbin/ipfw -f add allow udp from 152.2.131.228 53 to any in #/sbin/ipfw -f add allow udp from 152.2.131.227 53 to any in #/sbin/ipfw -f add allow udp from 152.2.21.1 53 to any in #/sbin/ipfw -f add allow udp from 152.2.253.100 53 to any in # NTP (Network Time) # Again, this shouldn't be needed since we're tracking state, but # if you can't get a time server to work, uncomment this. # This rule allows this machine to use any NTP server # /sbin/ipfw -f add allow udp from any to any 123 in # Or if you what the time server is, you can restrict it. #/sbin/ipfw -f add allow udp from 152.2.21.1 to any 53 in ######## # ICMP ######## # If you want to allow anyone to ping you, or run a tracroute to you # uncomment this #/sbin/ipfw -f add allow icmp from any to any in # ICMP settings, this rules allow ICMP from any of the main unc network ranges. # Allow ICMP (ping and traceroute) from main unc hosts # For unc folks this is a good way to limit it. /sbin/ipfw -f add allow icmp from 152.2.0.0/16 to any in /sbin/ipfw -f add allow icmp from 152.23.0.0/16 to any in /sbin/ipfw -f add allow icmp from 152.19.0.0/16 to any in # Allow iperf from cs machines # Most users won't run iperf, but this is here as an example. # Iperf is used to generate lots of network traffic to test throughput on # network connections. Use iperf with caution, it's a Denial of Service Attack # just waiting to happen! #/sbin/ipfw -f add allow tcp from 152.2.128.0/20 to any 5001 ######## # Standard Services ######## # Don't open these unless you want to run the service. # Also consider who would need access, for example, it's very unlikely # you'll need to allow ssh from the entire internet. But most # folks want the web server wide open # Allow ftp # (BUT you shouldn't need to do this--if you enable remote login # in the preferences, you're turning on sftp as well as ssh, and # sftp is much more secure than ftp!) #/sbin/ipfw -f add 3010 allow tcp from any to any 20-21 setup # Allow active ftp clients to work. If the ftp server can't call back # in, you can get an ftp connection. #/sbin/ipfw -f 3011 add allow tcp from any 20-21 to any 49152-65535 in via en0 # SSH # Allow ssh from unc.edu hosts /sbin/ipfw -f add allow tcp from 152.2.0.0/16 to any 22 keep-state setup /sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 22 keep-state setup /sbin/ipfw -f add allow tcp from 152.23.0.0/16 to any 22 keep-state setup # HTTP and HTTPS # Allow web service from anywhere, and track the state of the connection #/sbin/ipfw -f add allow tcp from any to any 80 keep-state setup #/sbin/ipfw -f add allow tcp from any to any 443 keep-state setup # AFP # Allow AppleShare File Sharing from UNC hosts /sbin/ipfw -f add allow tcp from 152.2.0.0/16 to any 548 keep-state setup /sbin/ipfw -f add allow tcp from 152.2.0.0/16 to any 427 keep-state setup /sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 548 keep-state setup /sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 427 keep-state setup /sbin/ipfw -f add allow tcp from 152.23.0.0/16 to any 548 keep-state setup /sbin/ipfw -f add allow tcp from 152.23.0.0/16 to any 427 keep-state setup # Or, restrict to just CS #/sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 548 keep-state setup #/sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 427 keep-state setup # Allow SMB/CIFS (windows networking) from unc hosts /sbin/ipfw -f add allow tcp from 152.2.0.0/16 to any 139 keep-state setup /sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 139 keep-state setup /sbin/ipfw -f add allow tcp from 152.23.0.0/16 to any 139 keep-state setup #Or just from cs.unc.edu hosts #/sbin/ipfw -f add allow tcp from 152.2.128.0/20 to any 139 keep-state setup # LDAP (in case you run an ldap server) #/sbin/ipfw -f add allow tcp from 152.2.128.0/20 to any 389 setup #/sbin/ipfw -f add allow udp from 152.2.128.0/20 to any 389 keep-state # Retrospect Backups # This example allows the cs backup server to back up this machine. /sbin/ipfw -f add allow udp from 152.2.131.176 to any 497 /sbin/ipfw -f add allow tcp from 152.2.131.176 to any 497 keep-state setup # Quicktime Streaming Service # Allow QTSS from anywhere #/sbin/ipfw -f add allow tcp from any to any 545 keep-state setup # Allow RTSP from anywhere (part of QTSS) #/sbin/ipfw -f add allow tcp from any to any 554 keep-state setup # Allow UDP RTSP data #/sbin/ipfw -f add allow udp from any to any keep-state 6970-6999 # Allow SWAT from cs.unc.edu # SWAT is the samba configuration tool, if you don't know what that means, # you don't need to enable this. #/sbin/ipfw -f add allow tcp from 152.2.128.0/20 to any 901 setup # iTunes # Allow iTunes sharing from unc.edu addresses #/sbin/ipfw -f add 4400 allow udp from 152.2.0.0/16 to any 3689 keep-state #/sbin/ipfw -f add 4410 allow udp from 152.19.0.0/16 to any 3689 keep-state #/sbin/ipfw -f add 4420 allow udp from 152.23.0.0/16 to any 3689 keep-state #/sbin/ipfw -f add allow tcp from 152.2.0.0/16 to any 3689 setup #/sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 3689 setup #/sbin/ipfw -f add allow tcp from 152.23.0.0/16 to any 3689 setup # Allow Rendevous /sbin/ipfw -f add allow udp from any to any keep-state 5353 ####### # Closing up ####### # /sbin/ipfw -f add 65533 reject log udp from any to any in # # This should block all ip packets not matched by a prior rule. Anything # caught here gets logged. /sbin/ipfw -f add 65534 deny log ip from any to any in