ipfw rules help.

[Joe Lewis]

Marwan Sultan wrote:

> a)   lets say I want to deny everything except a range of IPs
>      starting from 192.168.1.1 to 192.168.1.50.
>      what rule set should be? how to set range of IPs? to pass
>      and deny rest of the C class. FreeBSD Doc's doesnot cover this?
>      or i didnot see.!

I would set a default to deny, then poke holes through it for the stuff 
you need, such as
add allow ip from 192.168.1.1/5 to any
add allow ip from any to 192.168.1.1/5

(which sets up to use 1.1 to 1.32).  That netmask is your best friend.

> b)   If i want to deny everything except ip 192.168.1.5 as follow
>      00400 allow all from 192.168.1.5 to any
>      01000 deny all from any to any.
> 
>      when ipfw reads the rules and pass by 00400 then comes to 01000
>      then it denies even the 192.168.1.5, althou i put this rule before the 
>      deny ? what im missing? how should i pass 1 ip and deny all?

It means something didn't even check it with rule 400.  This can be due 
to an IPDIVERT thing changing the address so it doesn't match, or 
something similar.

> c)   If I want rule 00400 to expire in 9PM and be active in 8AM.(EXAMPLE)
>      how do we do that? is it by set a cron job to delete and add
>      the ipfw rule? or there is something to do from the ipfw it self?

cron job.  ipfw doesn't have the capability of doing time-based 
rulesets.  Temporary ones are okay, but time based, it can't really handle.

> D)   Last Q: IF I restart the box all the rules will be reset,
>              and comes to default. which is reasonable.
>              How to keep it everytime I restart?
>              do i create a file somewhere, and i tell my rc.conf for it?
>              what the rc.conf line should be? and file format?

Create or edit the '/etc/rc.firewall'.  I would only make the changes to 
allow a firewall type of 'file', and then make rc.conf reference a file 
that contains the rules.  Or, you can add a startup script in 
/usr/local/etc/rc.d/ that adds the rules.

Joe