Building Firewalls With OpenBSD And PF, 2nd Edition (2003)

Appendix C

Rule Templates

for

Typical Firewall ConŒgurations

The following are starting points for Œrewall rulesets implementing Œrewall designs described in Chapter 2, Firewall Designs.

C.1 Bastion Host

A bastion host is a lone host connected to the Internet or a LAN. It is running pf(4) for protection from the external threats and does not allow any inbound connections unless they are in response to its own outbound connections. An example of a bastion host would be a machine connected to the Internet via a xDSL modem.

#Macros

#ext_if -- the interface to the outside world ext_if="ne0"

#Options

set require-order yes set block-policy drop set optimization normal set loginterface none

#Normalize packets scrub in all

scrub out all

#Filter packets

#block all incoming connections sent from the outside

288 Appendix C: Rule Templates for Typical Firewall ConŒgurations

#log all blocked packets block in log all

#pass all connections originating from the screened

#host

pass out quick on $ext_if inet \

from ($ext_if) to any flags S/SA keep state

# anitspoof rule on the external interface antispoof for $ext_if

C.2 Bastion Host II (Some Access Allowed)

A bastion host in this example is a lone host connected to the Internet or a LAN. It is running pf(4) for protection from the external threats and does allow some inbound connections. An example of this kind of a bastion host would be a WWW and mail server connected to the Internet via an xDSL modem. SSH connections are allowed for administrative purposes.

#Macros

#ext_if -- the interface to the outside world ext_if="ne0"

#Options

set require-order yes set block-policy drop set optimization normal set loginterface none

#Normalize packets scrub in all

scrub out all

#Filter packets

#block all incoming connections sent from the outside

#log all blocked packets

block in log all

#pass all connections originating from the bastion

#host

pass out quick on $ext_if inet \

from ($ext_if) to any flags S/SA keep state

289

# pass all connections originating from external hosts to port 80 (WWW) on the bastion host

pass in quick on $ext_if inet proto tcp \ from ($ext_if) \

to ($ext_if) port 80 \ flags S/SA synproxy state

# pass all connections originating from external hosts to port 22 (SSH) on the bastion host

pass in quick on $ext_if inet proto tcp \ from ($ext_if) \

to ($ext_if) port 22 \ flags S/SA synproxy state

# pass all connections originating from external hosts to port 25 (SMTP) on the bastion host

pass in quick on $ext_if inet proto tcp \ from ($ext_if) \

to ($ext_if) port 25 \ flags S/SA synproxy state

# anitspoof rule on the external interface antispoof for $ext_if

C.3 Screened Host/LAN (Public IP Addresses)

A screened host or LAN is a setup with the Œrewall host (the machine running pf(4)) sitting between the outside world and the screened hosts. In this example, the Œrewall's external and private interfaces are assumed to have public IP addresses. The private hosts are also assumed to have public IP addresses. No inbound connections are allowed unless they are in response to the outbound connections from the screened LAN or the Œrewall itself. The Œrewall doubles as a router. An example of such setup would be a private network with no external access allowed.

#Macros

#ext_if -- the interface to the outside world ext_if="ne0"

#prv_if -- the interface to the private hosts prv_if="ne1"

#prv_hosts -- the list of addresses of hosts on the

#screened LAN

292 Appendix C: Rule Templates for Typical Firewall ConŒgurations

pass in quick on $ext_if inet proto tcp \ from ($ext_if) \

to $prv_ad port 22 \ flags S/SA synproxy state

# pass all connections originating from external hosts to port 25 (SMTP) on one of the internal hosts

pass in quick on $ext_if inet proto tcp \ from ($ext_if) \

to $prv_smtp port 25 \ flags S/SA synproxy state

#anitspoof rule on the external interface antispoof for $ext_if

#anitspoof rule on the private interface antispoof for $prv_if

C.5 NAT + Screened LAN

This conŒguration is similar to a screened LAN with public IP addresses, but only the external interface on the Œrewall has a public IP address. Private hosts have private IP addresses. No inbound connections are passed unless they are in response to outbound connections from the Œrewall or the screened LAN. The Œrewall doubles as a router. An example of such conŒguration would be a private network hidden behind a single IP address.

#Macros

#ext_if -- the interface to the outside world ext_if="ne0"

#prv_if -- the interface to the private hosts prv_if="ne1"

#prv_hosts -- the list of addresses of hosts on the

#screened LAN

prv_hosts = "{192.168.1.1, 192.168.1.10, 10.3.1.5}"

# Options

set require-order yes set block-policy drop set optimization normal set loginterface none

295

pass out quick on $ext_if inet \

from ($ext_if) to any flags S/SA modulate state

#pass all connections originating from the screened LAN pass in quick on $prv_if from $prv_hosts to any flags S/SA

#pass all connections originating from the DMZ

pass in quick on $dmz_if from $dmz_hosts to any flags S/SA

#pass all connections to the WWW host in the DMZ pass in on $ext_if from any to $dmz_www \

port 80 flags S/SA synproxy state

#pass all connections to the SMTP host in the DMZ pass in on $ext_if from any to $dmz_smtp \

port 25 flags S/SA synproxy state

#pass all connections to the DNS host in the DMZ pass in on $ext_if from any to $dmz_dns \

port 53 flags S/SA keep state

#anitspoof rule on the external interface antispoof for $ext_if

#anitspoof rule on the private interface antispoof for $prv_if

C.7 Invisible Bridge

An invisible bridge is a host with no IP addresses assigned to it. Its general conŒguration is similar to the screened host/LAN setup, but the invisibility means that it cannot be easily hacked (there's no address to send malicious packets to).

#Macros

#ext_if -- the interface to the outside world ext_if="ne0"

#prv_if -- the interface to the private hosts prv_if="ne1"

#prv_hosts -- the list of addresses of hosts on the

#screened LAN

prv_hosts = "{x.x.x.1, x.x.x.10, x.x.x.5}"

# Options

set require-order yes set block-policy drop

296 Appendix C: Rule Templates for Typical Firewall ConŒgurations

set optimization normal set loginterface none

#Normalize packets scrub in all

scrub out all

#Filter packets

#block all incoming connections sent from the outside

#log all blocked packets

block in log on $ext_if all

#pass all connections originating from the screened LAN pass out quick on $ext_if inet \

from $prv_hosts to any flags S/SA modulate state

#anitspoof rule on the external interface

antispoof for $ext_if

# anitspoof rule on the private interface antispoof for $prv_if