[BACK]Return to example.14 CVS log [TXT][DIR] Up to [local] / src / share / ipf
File: [local] / src / share / ipf / Attic / example.14 (download)

Revision 1.2, Thu Jul 18 05:57:21 1996 UTC (27 years, 10 months ago) by dm
Branch: MAIN
CVS Tags: OPENBSD_2_9_BASE, OPENBSD_2_9, OPENBSD_2_8_BASE, OPENBSD_2_8, OPENBSD_2_7_BASE, OPENBSD_2_7, OPENBSD_2_6_BASE, OPENBSD_2_6, OPENBSD_2_5_BASE, OPENBSD_2_5, OPENBSD_2_4_BASE, OPENBSD_2_4, OPENBSD_2_3_BASE, OPENBSD_2_3, OPENBSD_2_2_BASE, OPENBSD_2_2, OPENBSD_2_1_BASE, OPENBSD_2_1, OPENBSD_2_0_BASE, OPENBSD_2_0
Changes since 1.1: +60 -9 lines 

added my two firewall examples, plus the stuff from the distribution

#
# log all inbound packet on le0 which has IP options present
#
log in on le0 from any to any with ipopts
#
# block any inbound packets on le0 which are fragmented and "too short" to
# do any meaningful comparison on.  This actually only applies to TCP
# packets which can be missing the flags/ports (depending on which part
# of the fragment you see).
#
block in log quick on le0 from any to any with short frag
#
# log all inbound TCP packets with the SYN flag (only) set
#  (NOTE: if it were an inbound TCP packet with the SYN flag set and it
#         had IP options present, this rule and the above would cause it
#         to be logged twice).
#
log in on le0 proto tcp from any to any flags S/SA
#
# block and log any inbound ICMP unreachables
#
block in log on le0 proto icmp from any to any icmp-type unreach
#
# block and log any inbound UDP packets on le0 which are going to port 2049
# (the NFS port).
#
block in log on le0 proto udp from any to any port = 2049
#
# quickly allow any packets to/from a particular pair of hosts
#
pass in quick from any to 10.1.3.2/32
pass in quick from any to 10.1.0.13/32
pass in quick from 10.1.3.2/32 to any
pass in quick from 10.1.0.13/32 to any
#
# block (and stop matching) any packet with IP options present.
#
block in quick on le0 from any to any with ipopts
#
# allow any packet through
#
pass in from any to any
#
# block any inbound UDP packets destined for these subnets.
#
block in on le0 proto udp from any to 10.1.3.0/24
block in on le0 proto udp from any to 10.1.1.0/24
block in on le0 proto udp from any to 10.1.2.0/24
#
# block any inbound TCP packets with only the SYN flag set that are
# destined for these subnets.
#
block in on le0 proto tcp from any to 10.1.3.0/24 flags S/SA
block in on le0 proto tcp from any to 10.1.2.0/24 flags S/SA
block in on le0 proto tcp from any to 10.1.1.0/24 flags S/SA
#
# block any inbound ICMP packets destined for these subnets.
#
block in on le0 proto icmp from any to 10.1.3.0/24
block in on le0 proto icmp from any to 10.1.1.0/24
block in on le0 proto icmp from any to 10.1.2.0/24