Update Firewall Rules

Giorgos Keramidas keramida at linux.gr
Thu May 22 11:31:34 PDT 2003


Philip Payne wrote:
>>Thanks to all who replied, lots of food for thought!
>>
>>Maybe my setup is a little different than what people use 
>>because I have different rule sets in /etc/rc.firewall
 >>(which is the default with OPEN, SIMPLE and CLIENT)
 >>[...]
>>Good advice against lock-outs though. Is generally the 
>>preferred approach to use different files for different
 >>rules, rather than keep sets in /etc/rc.firewall?

I usually keep a bunch of ipfw rulesets around in files
named /etc/ipfw.xxxx or /etc/ipf.yyyy and then set my
firewall_type="" (or ipfilter_rules="" to the full path
(it *is* important to use the full path, at least for
ipfw rulesets) when switching among them:

	# ipfw -q /etc/ipfw.open
	# ipfw -q /etc/ipfw.paranoid

 >>And if so, how do you set this up in /etc/rc.conf, since
>>the firewall type by default looks at rc.firewall...

There is a post I made in -questions a while ago that explains
all this in a bit of detail.  Look at the archives, please..

Right now my ISP is having serious problems and I can't reach
google.com at all, but look at groups.google.com for something
like this:

	author:keramidas & group:*freebsd* & ipfw & firewall_type

and you shouldn't have trouble spotting the correct post.

> Using the same approach as writing a script to carry out the 
> sh /etc/rc.firewall command. 
> 
> You could either have different scripts to pass the
 > firewall_type variable and then do the firewall rules e.g.:
> 
> open-firewall.sh:
> ---
> #!/bin/sh
> FIREWALL_TYPE="OPEN"
> sh /etc/rc.firewall
> ---

Nope, that will probably not work...

Capitalization does matter.  It's firewall_type in all lowercase.
Not FIREWALL_TYPE.  But then, even if you get the capitalization
right, rc.firewall will load rc.conf and override this value from
the environment the script runs.

> I'm really not a shell scripting person (networking is my area),
 > so I can't say this will definitely work but... kind of sounds
 > right. Perhaps someone with more shell scripting experise can
 > comment.

It'll work fine if rc.conf doesn't override firewall_type :-)

> Let me know how you get on. Wouldn't mind knowing for sure what's the
> correct approach.

I tried to outline all possible ways of loading rules with the
rc.firewall script, without it, manually or whatever in the post
mentioned above.  Just search the archives.  I can't help you with
the searching ATM :-/

- Giorgos




More information about the freebsd-questions mailing list