download

Network Configuration—FirewallsThe very last rule in a ruleset is either a DENY ALL (default behavior), or a PERMITALL rule. In normal mode, if a packet does not match with any of the rules, it willbe matched with the last rule in the ruleset. Depending on your configuration, thepacket may be permitted (or be allowed) to pass.The next keyword in the rule (in this case permit) is the "action" that you want toperform on the matching packet. If you want to actually permit the packet, youshould choose either allow, or accept, or pass, or permit keyword. Use the one youare more comfortable with, as they are all the same. If you want to drop the matchingpacket, you should use either the drop or deny keyword. We will discuss morekeywords later in this chapter.After the "action", the actual packet-matching pattern is placed. In this case—permitip from 192.168.1.0/24 to any—we are trying to match all IP traffic comingfrom subnet 192.168.1.0/24 to any host on the network.In this case, only IP headers are looked into, hence we should use the ip keyword.IPFW can look into layer2 (for MAC addresses), layer3 (for IPv4 and IPv6 addresses),and layer4 (for TCP/UDP port numbers) to match the packet.After the from keyword, the source address should be specified. This can be doneby specifying the subnet, or host information (since we are looking into layer3header) using a very flexible syntax. You can use a CIDR notation (like we did in thisexample) or use traditional subnet mask style (for example 192.168.1.0:255.255.255.0, note the colon character between the address and the mask).There are also a few special keywords that are used instead of the actual address, likethe keyword any that we used after the to keyword, to specify thedestination address.The keyword, any, matches any IP address, while the me keyword matchesIP addresses that are configured on any of the interfaces of our host.To add this sample rule to active firewall configuration from command line, thefollowing syntax is used:# ipfw add 100 permit ip from 192.168.1.0/24 to any[ 186 ]