directadmin example of configuring IPFW under the FreeBSD system

Make sure you have a smooth access to your server, whether it is local access, VM console, or Telnet, to ensure that the firewall does not cause the system to be inaccessible because of an unexpected error configuration.

Here is the applicable condition of this article:
1.FreeBSD 7.x, 8.x or 9.x; x86 or x64
2.IPFW + Tables Support
3.DirectAdmin ' s Brute Force Monitor (version 1.40 required)

Following the setup of this article you will get the following features:
1. Through the directadmin BFM (strong monitoring) module automatically banned IP.
2. Cancel the IP ban associated with the specified time interval set in the directadmin background BFM.
3. A powerful firewall.
4. Have a clean and regular table of firewall rules.
5. Minimal system modifications.

1. Open the IPFW on the FreeBSD

First modify the rc.conf file and open the IPFW

The code is as follows	Copy Code
# ee/etc/rc.conf

Add the following content to the rc.conf

The code is as follows	Copy Code
Firewall_enable= "YES"

Reboot the system to open the firewall
Once the system is enabled, modify the Rc.conf file again and add the following content to the firewall_enable= "YES":

The code is as follows	Copy Code
Firewall_type= "Simple" firewall_script= "/etc/ipfw.rules" Firewall_logging= "YES"

Given the firewall's maximum rule limitations, additional changes may require sysctl, and if your server is busy, you may get the following error message:

The code is as follows	Copy Code
Ipfw:install_state:Too many dynamic rules Www.111cn.net

If you want to avoid this in the future, use the following command to add content to the sysctl.conf (default value 4096), allowing FreeBSD to have permission to create and obtain dynamic rules in IPFW.

The code is as follows	Copy Code
# echo "net.inet.ip.fw.dyn_max=65536" >>/etc/sysctl.conf

Alternatively, you can edit the sysctl.conf file manually and add "net.inet.ip.fw.dyn_max=65536", where the maximum value is 65535.

2. Add some basic rules to your firewall

The following can be customized settings, where we add standard service ports to the firewall: FTP, SSH, POP, Smtp/exim, DNS, HTTP, SSL, and DirectAdmin 2222 ports, you can modify the relevant settings according to their actual situation.

The command "Setup limit src-addr <X>" is used to limit the number of IP connections to the host, which is a very secure method that has been successfully used for many years on a very large number of servers.

First modify the/etc/ipfw.rules file, using the command:

The code is as follows	Copy Code
# Ee/etc/ipfw.rules

Add the content to the file:

The code is as follows

Copy Code

#!/bin/sh ################################################# # IPFW Firewall Commands ################################################# cmd= "Ipfw-q Add" Ipfw-q-F Flush pif= "Em0" ################################################# # Allow Loopback and Deny loopback spoofing ################################################# $cmd allow all from the any via Lo0 $cmd deny all 127.0.0.0/8 $cmd deny all from 127.0.0.0/8 to any $cmd deny TCP from the any Frag ################################################# # Stateful Rules ################################################# $cmd check-state $cmd deny TCP from the any established $cmd Allow all keep-state $cmd allow ICMP from the Any ################################################# # Table for IP blocks ################################################# Ipfw-q table Add 127.0.0.2 IPFW-Q add 900 deny IP from ' table ################################################# # incoming/outgoing Services ################################################# $cmd 60001 allow TCP limit src-addr 10 $cmd 60002 allow TCP/limit SRC-ADDR 8 $cmd 60003 allow TCP limit src-addr 10 $cmd 60004 allow TCP/587 Setup limit src-addr 20 $cmd 60005 allow TCP limit src-addr 3 $cmd 60006 allow UDP limit src-addr 3 $cmd 60007 allow TCP limit src-addr 20 $cmd 60008 allow TCP/limit SRC-ADDR 20 $cmd 60009 allow TCP/143 setup limit src-addr 10 $cmd 60010 allow TCP/443 setup limit src-addr 10 $cmd 60011 allow TCP/2222 Setup limit src-addr 12 $cmd 60012 allow TCP/35000-35999 in Setup limit src-addr 10 $cmd 60013 allow TCP/993 Setup limit src-addr 10 $cmd 60014 allow TCP/995 Setup limit src-addr 10 $cmd 60015 allow TCP/465 setup limit src-addr 10 $cmd 60016 allow TCP/585 Setup limit src-addr 10 ################################################# # Deny Port scanning (Nmap) ################################################# $cmd 00600 deny log logamount IP from the any ipoptions RR $cmd 00610 deny log logamount IP from No to any ipoptions TS $cmd 00620 deny log logamount IP from all ipoptions LSRR $cmd 00630 deny log logamount IP from all ipoptions SSRR $cmd 00640 deny log logamount TCP/Tcpflags Syn,fin $cmd 00650 deny log logamount TCP/Tcpflags Syn,rst ################################################# # Deny and Log ################################################# $cmd Deny log all

3. Create the necessary directadmin to block and unblock scripts and give permissions to execute:

The code is as follows	Copy Code
# Cd/usr/local/directadmin/scripts/custom # Touch block_ip.sh unblock_ip.sh brute_force_notice_ip.sh show_blocked_ips.sh # chmod 755 block_ip.sh unblock_ip.sh brute_force_notice_ip.sh show_blocked_ips.sh

4. Copy and paste the following when the file is ready:

Block_ip.sh:

The code is as follows

Copy Code

#!/bin/sh &NBSP Echo "Blocking IP: $ip <br>";   /sbin/ipfw-q table add $ip   Echo <br> ; <br>result: "; echo "<br><br><textarea cols=160 rows=60>";   /SBIN/IPFW table list   echo "</textarea>www.111cn.net";   Exit 0; Unblock_ip.sh:   #!/bin/sh   Echo "unblocking IP: $ip <br>";   /sbin/ipfw-q Table Delete $ IP   Exit 0; Brute_force_notice_ip.sh:   <pre>#!/bin/sh   script=/usr/local/directadmin/scripts/custom/block_ip.sh &NBSP ip= $value $SCRIPT   Exit $?; </pre> show_blocked_ips.sh:   <pre>#!/bin/sh   /sbin/ipfw Table List | Sed ' s//32 0//g '   exit 0;</pre>

Verify now that DirectAdmin has provided the block IPs functionality in the BFM module, you can restart the service to ensure that it is still available after the system restarts, and then you can check for additional services one at a time.