Use IPFILTER to set up a small enterprise firewall in FreeBSD4.7 Environment

In FreeBSD4.7, use IPFILTER to set up a small-sized enterprise firewall-Linux Enterprise Application-Linux server application. The following is a detailed description. I. Network Environment
1. host a: Install freebsd4.7 and install three NICs, fxp0, xl0, and xl1.
Fxp0 is an external Nic, IP Address: IP address provided by x. x. x ISP for me
Xl0 is an internal public area Nic, IP: 192.168.0.1
Xl1 provides a regional Nic for internal services, IP Address: 192.168.80.1
2. Host B: provides the www Service host. The IP address is 192.168.80.80.
3. Host C: provides the ftp service host, ip Address: 192.168.80.3.
4. N other workstations.
Ii. Compile the kernel

1,


# Cd/sys/i386/conf
# Cp GENERIC kernel_IPF


2. Compile kernel_IPF and add the following options:

Options IPFILTER
Options IPFILTER_LOG
Options IPFILTER_DEFAULT_BLOCK


3,
#/Usr/sbin/config kernel_IPF
# Cd.../compile/kernel_IPF
# Make kepend
# Make
# Make install


4. edit/etc/rc. rc. conf and enable the following options:

Defaultrouter = "x. x. x.1" x. x. x.1 is the gateway provided by the ISP.
Gateway_enable = "YES"
Ipfilter_enable = "YES"
Ipnat_enable = "YES"

5. restart the system: reboot
3. configure the firewall

1. Set IP address translation. Create the file ipnat. rules in/etc with the following content:

Map fxp0 192.168.0.0/16-& gt; 0/32 proxy port ftp/tcp
Map fxp0 192.168.0.0/24-> 0/32 portmap tcp/udp
Map fxp0 192.168.0.0/24-> 0/32
Map fxp0 192.168.80.0/24-> 0/32 portmap tcp/udp 300001: 60000
Map fxp0 192.168.80.0/24-& gt; 0/32 portmap
Rdr fxp0 x. x/32 port 80-> 192.168.0.2 port 80
Rdr fxp0 x. x/32 port ftp-> 192.168.0.3 port ftp
Rdr fxp0 x. x/32 port 30001-50000-> 192.168.80.3 port 30001 tcp


2. Set the packet filtering ipfilter. Create the file ipf. rules in/etc with the following content:

Block in log quick all with short
Block in log quick all with ipopts
Block in log quick all with frag
Block in log quick all with opt lsrr
Block in log quick all with opt ssrr


The preceding five statements filter out short packets or packets with routing information that may cause security problems and prevent unauthorized server scanning.


Pass out on xl0 all
Pass in on xlo all
Pass out on xl1 all
Pass in on xl1 all
Pass out quick on lo0 all
Pass in quick on lo0 all

The above shows the internal network interface and loopback network interface, which can freely send and accept data packets.


Block out on fxp0 all

The above code shields external data packets from the external network interface.


Block out log on fxp0 from any to 192.168.0.0/16
Block out log quick on fxp0 from any to 0.0.0.0/8
Block out log quick on fxp0 from any to 169.254.0.0/8
Block out log quick on fxp0 from any to 10.0.0.0/8
Block out log quick on fxp0 from any to 127.16.0.0/12
Block out log quick on fxp0 from any to 127.0.0.0/8
Block out log quick on fxp0 from any to 192.0.2.0/24
Block out log quick on fxp0 from any to 204.152.64.0/23
Block out log quick on fxp0 from any to 224.0.0.0/3

The output data of the Invalid Address is blocked.


Pass out log on fxp0 proto tcp/udp from any to any keep state
Pass out log on fxp0 proto icmp all keep state

The preceding rules allow TCP, UDP, and ICMP data packets to be sent out, and allow response data packets to be sent back to the internal network.


Block in log on fxp0 from 192.168.0.0/16 to any
Block in log quick on fxp0 from 10.0.0.0/8 to any
Block in log quick on fxp0 from 172.16.0.0/12 to any
Block in log quick on fxp0 from 127.0.0.0/8 to any
Block in log quick on fxp0 from 192.0.2.0/24 to any
Block in log quick on fxp0 from 169.254.0.0/16 to any
Block in log quick on fxp0 from 224.0.0.0/3 to any
Block in log quick on fxp0 from 204.152.64.0/23 to any
Block in log quick on fxp0 from x. x/32 to any
Block in log quick on fxp0 from any to x. x. x.0/32
Block in log quick on fxp0 from any to x. x. x.255/32

The preceding Code shields packets with internal network addresses from being forwarded to the external network.


Pass in quick on fxp0 proto tcp from any to any port = 80 flags S/SA keep state
Pass in quick on fxp0 proto tcp from any to any port = ftp flags S/SA keep state
Pass in quick on fxp0 proto tcp from any to any port = ftp-data flags S/SA keep state
Pass in quick on fxp0 proto tcp from any to any port 30000> <50001 flags S/SA keep state

The above Code allows www and ftp access and allows data forwarding on the ftp data port.


Block in quick on fxp0 all

Prohibit other connections from accessing fxp0


Block in log quick on fxp0 proto icmp from any to any icmp-type redir
Block in log quick on fxp0 proto icmp from any to any
Block in log quick on fxp0 proto icmp from any to any icmp-type echo

The above is to prohibit others from pinging my network


Block return-rst in log on fxp0 proto tcp from any to any flags S/SA
Block return-icmp (net-unr) in log on fxp0 proto udp from any to any

For other tcp requests, the firewall responds to an RST packet to close the connection. For UDP requests, the firewall responds to ICMP packets that cannot be reached by the network.
Or Add the following to/etc/sysctl. conf:

Net. inet. tcp. blackhole = 2
Net. inet. udp. blackhole = 1

Effectively prevents port scanning

3. edit/etc/rc. conf and add the following command so that ipfilter and ipnat can be automatically loaded when the system starts:

Ipfilter_enables = "YES"
Ipf? C? F/etc/ipf. rules
Ipfilter_flags = "-E"

Ipnat_enable = "YES"
Ipnat_program = "/sbin/ipnat? CF-f"
Ipnat_rules = "/etc/ipnat. rules"

Ipmon_enable = "YES"
Ipmon_flags = "-D/var/log/ipfilter. log"

4. Create an ipfilter file in/usr/log. log, and change its attribute to 755, so that your firewall logs will be recorded in/var/log/ipfilter. log File, you can view it at any time.

4. Set up the FTP server to support passive connection (pasv)
1. Proftpd: edit your proftpd configuration file proftpd. conf and add the following content:

MasqueradeAddress x. x
PassivePorts 30001 50000

2. Pure-ftpd: edit your FTP configuration file and add the following content:

PassivePortRange 30001 50000
ForcePassiveIP x. x

3. Serv-U:

A. "Local server" in serv-U "???" Set "???" Advanced "???" PASV port range: "input 30001 50000
B. In the "Domain" ??? "of serv-U "???" Your own domain "???" Set "???" Advanced select "allow passive transmission" and "use IP" input: x. x