Difference between revisions of "Firewall"

Revision as of 08:27, 18 October 2020

Welcome to Firewall.

Introduction

IPFW or ipfirewall is an internet-protocol-firewall written for FreeBSD. The ipfw system facility allows filtering, redirecting, and other operations on IP packets travelling through network interfaces. A firewall configuration, or ruleset, is made of a list of rules numbered from 1 to 65535. Packets are passed to the firewall from a number of different places in the protocol stack (depending on the source and destination of the packet, it is possible for the firewall to be invoked multiple times on the same packet). The packet passed to the firewall is compared against each of the rules in the ruleset, in rule-number order (multiple rules with the same number are permitted, in which case they are processed in order of insertion). When a match is found, the action corresponding to the matching rule is performed.

IPFW on GhostBSD

On GhostBSD ipfw is managed by OpenRC.

Attention: Please do not use FreeBSD firewall guidance on the FreeBSD handbook.

IPFW is already setup to default: Set ipfw to default accept
If you run rc-update it shows all running services, ipfw included.

OpenRC manages how ipfw (/etc/init.d/ipfw) configuration is initialized.

The old way defined by TrueOS allows you to define the firewall rules via a /etc/ipfw.conf file. You have to create that file as it does not exist by default.

However, OpenRC (main branch) defines the firewall rules within the /etc/ipfw.rules file itself.
If the file does not exist on GhostBSD you have to create it. See exanple

See: ipfw on OpenRC

IPFW Script

#!/sbin/openrc-run
name="ipfw"
description="Firewall, traffic shaper, packet scheduler, in-kernel NAT"
firewall_coscripts="natd ${firewall_coscripts}"
SYSCTL="/sbin/sysctl"
. /etc/network.subr
depend() 
{
before net
provide firewall
keyword -jail -stop -shutdown
}
load_kld()
{
kldload -nq $1
}
start_pre()
{
load_kld ipfw
if yesno dummynet_enable; then
load_kld "dummynet"
fi
if yesno natd_enable; then
load_kld "ipdivert"
fi
if yesno firewall_nat_enable; then
load_kld "ipfw_nat"
fi
}
start()
{
local   _firewall_type
_firewall_type=$1
ebegin "Starting $name"
# set the firewall rules script if none was specified
[ -z "${firewall_script}" ] && firewall_script=/etc/ipfw.rules
if [ -r "${firewall_script}" ]; then
/bin/sh "${firewall_script}" "${_firewall_type}"
elif [ "`ipfw list 65535`" = "65535 deny ip from any to any" ]; then
ewarn 'Warning: kernel has firewall functionality, but' \
' firewall rules are not enabled.' ewarn '           All ip services are disabled.'
fi
# Firewall logging
#
if yesno firewall_logging; then
sysctl net.inet.ip.fw.verbose=1 >/dev/null
fi
if yesno firewall_logif; then
ifconfig ipfw0 create
fi
eend 0
}
start_post()
{
local	_coscript
# Start firewall coscripts
#
for _coscript in ${firewall_coscripts} ; do
if [ -f "${_coscript}" ]; then
service ${_coscript} start >/dev/null 2>/dev/null
fi
done
# Enable the firewall
#
if ! ${SYSCTL} net.inet.ip.fw.enable=1 1>/dev/null 2>&1; then
ewarn "failed to enable IPv4 firewall"
fi
if afexists inet6; then
if ! ${SYSCTL} net.inet6.ip6.fw.enable=1 1>/dev/null 2>&1
then
ewarn "failed to enable IPv6 firewall"
fi
fi
}
reverse_list()
{
_revlist=
for _revfile; do
_revlist="$_revfile $_revlist"
done
echo $_revlist
}
stop()
{
local	_coscript
# Disable the firewall
#
ebegin "Stopping $name"
${SYSCTL} net.inet.ip.fw.enable=0
if afexists inet6; then
${SYSCTL} net.inet6.ip6.fw.enable=0
fi
# Stop firewall coscripts
#
for _coscript in `reverse_list ${firewall_coscripts}` ; do
if [ -f "${_coscript}" ]; then
service ${_coscript} stop >/dev/null 2>/dev/null
fi
done
eend 0
}

Some ideas about Firewalls

An interesting article about firewalls you will find on the Gentoo wiki.

Back to the Wiki