download

Network Configuration—FirewallsYou can use one of the following five templates (or create your owncustomized ruleset):Ruleset nameopenclosedclientsimpleworkstationDescriptionSimply permits all IP traffic from any interface.Disallows all traffic except on the loopback interface.Protects the host with some basic firewall rules and prevents allincoming connections, as this host is a client( tweak the /etc/rc.firewall file to set up your network information).Considers your host to be a router with two interfaces, and installssome basic firewall rules to prevent IP spoofing and also blocksinappropriate traffic such as RFC 1918 and other reserved addresseson the outside interface. Also permits HTTP, DNS and SMTP trafficfrom the outside world to the host. (tweak /etc/rc.firewall forappropriate network setup)..Typical workstation setup where a connection from the host to theoutside world is allowed and a few types of incoming traffic (such asicmp) are permitted. This template can be customized by setting upappropriate variables in the /etc/rc.conf file.Using any of the above templates is achieved by adding appropriate variables in/etc/rc.conf. For example, in order to use the open template, you should add thefirewall_type variable to the /etc/rc.conf file:firewall_enable="YES"firewall_type="open"This will load and apply the open profile from /etc/rc.firewall.Customized RulesetsIn case you want to create your own ruleset, disregarding the default system firewalltemplates, you should create a configuration file containing your ruleset. After this,load it from rc.conf by specifying the ruleset filename, instead of the templatename. For example, if you have created a configuration file called /etc/myrules.conf, you should add the following line to /etc/rc.conf:firewall_type="/etc/myrules.conf"This will load your firewall ruleset when the /etc/rc.d/ipfw script is called (eithermanually or during system startup).The file should contain one or more lines each containing a single IPFW rule, just likethe command line syntax.[ 188 ]