LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Other *NIX Forums > *BSD
User Name
Password
*BSD This forum is for the discussion of all BSD variants.
FreeBSD, OpenBSD, NetBSD, etc.

Notices

Reply
 
LinkBack Search this Thread
Old 09-27-2004, 03:08 PM   #1
jeempc
Member
 
Registered: Mar 2003
Location: Ann Arbor, MI
Distribution: Slackware 10.1
Posts: 119

Rep: Reputation: 15
simple firewall


Hello all. I would like to find out how to set up a simple firewall for my OpenBSD machine. Not NAT/Router or anything like that. Links and or advise is appreciated.

Jeempc
 
Old 09-27-2004, 04:25 PM   #2
sandboy6184
Member
 
Registered: Apr 2004
Posts: 40

Rep: Reputation: 15
http://www.openbsd.org/faq/pf/
 
Old 09-28-2004, 01:48 AM   #3
jeempc
Member
 
Registered: Mar 2003
Location: Ann Arbor, MI
Distribution: Slackware 10.1
Posts: 119

Original Poster
Rep: Reputation: 15
Thanks for the link but what I was looking for is some simple examples not a manual on how to do everything. I already looked there and couldn't figure it out. That is why I posted here.
I would have to believe that someone is doing the same thing that I want to do and can provide their experience.
 
Old 09-28-2004, 09:02 AM   #4
sandboy6184
Member
 
Registered: Apr 2004
Posts: 40

Rep: Reputation: 15
Quote:
Originally posted by jeempc
Thanks for the link but what I was looking for is some simple examples...
http://www.openbsd.org/faq/pf/example1.html
 
Old 09-28-2004, 09:18 AM   #5
jeempc
Member
 
Registered: Mar 2003
Location: Ann Arbor, MI
Distribution: Slackware 10.1
Posts: 119

Original Poster
Rep: Reputation: 15
Thanks for all your knowledge. As I said I already looked there smart alec.
jeempc
 
Old 09-28-2004, 10:29 AM   #6
Marble
Member
 
Registered: Feb 2003
Distribution: FreeBSD 5.2
Posts: 113

Rep: Reputation: 15
Maybe explain what you want to do with the firewall. I am not quite sure what you mean by "simple"?
 
Old 09-28-2004, 11:48 AM   #7
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
jeempc, that second link has a very small example showed completely at the bottom of the page, with each part of it explained above. If that is not simple enough for you, then you must say exactly what you're looking for and why the example above is not what you want. It really is extremely simple.
 
Old 09-28-2004, 11:50 AM   #8
jeempc
Member
 
Registered: Mar 2003
Location: Ann Arbor, MI
Distribution: Slackware 10.1
Posts: 119

Original Poster
Rep: Reputation: 15
Protect one machine and only allow ssh and http.
Sorry about being so vague. I am used to Linux where there are many canned scripts for a basic setup.
Jeempc
 
Old 09-28-2004, 01:13 PM   #9
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
Well, that's a major difference between BSD and Linux. In the BSD OSs, the documentation is extremely good and they provide good examples in the man pages and on-line documentation, so it's easy to understand and you can write your own (with the bonus of you knowing why it works the way it does).

For the most part, Linux distributions have rather poor documentation, but a lot of people post their config files for other people to blindly download and use. The end result is that many Linux users don't end up knowing why their services work the way they do, and in particular don't understand how their firewall works. That's bad!

For something as important as security, you should understand how everything works so you know what to change and what effect it will have if you do change something. You should attempt to learn how packet filtering works in the BSD operating systems rather than just ask for someone to give you rules. I could give you a config file that would work, but you would have to trust me that I didn't purposely leave a vulnerability that I could exploit later, and if you ever wanted to change anything with it more than likely you would ask me instead of changing it yourself.

I suggest that you take the time to read the Home or Small Office example that was pointed out to you above. The example shows 3 local machines, but it still applies to what you want. If you actually read the example, you would see that SSH connections are allowed from the outside to the firewall, and HTTP requests are redirected to COMP3 in the example. If you want SSH and HTTP to go to a machine behind the firewall, then change the SSH rule to look like the HTTP rule. If your SSH and HTTP servers are both on the same machine as the firewall, then change the HTTP rule to look like the SSH rule.

All the BSD packet filter languages (IPF, IPFW, PF) are written in "natural language", so there should be no problem at all comprehending them if you take the time to read the documentation.
 
Old 09-28-2004, 01:42 PM   #10
jeempc
Member
 
Registered: Mar 2003
Location: Ann Arbor, MI
Distribution: Slackware 10.1
Posts: 119

Original Poster
Rep: Reputation: 15
Thanks. I appreciate the concern for security. It is funny because I couldn't get anywhere on google except long explanations about packet filtering.
I will take the time to learn it the right way--I was going to anyways, I just wanted a framework to get started.
Thanks for explaining how the BSD community works.
It will save me from asking other questions that get the RTFM responses

Jeempc
 
Old 09-28-2004, 02:28 PM   #11
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
Read the FAQ that was linked all the way near the top of this thread, and also read the pf.conf man page [pf.conf(5)]. Those will explain what you need to know to setup a firewall with OpenBSD. pf.conf(5) shows all the possible options to use, so it gives you ideas of other rules you could setup. You should also read pfctl(8) (to see how to manipulate PF from the command line), pflogd(8) (for instructions on setting up logging), and ftp-proxy(8) (for an explanation of how PF handles FTP traffic).
 
Old 09-28-2004, 08:38 PM   #12
Stack
Member
 
Registered: Oct 2003
Distribution: FreeBSD
Posts: 325

Rep: Reputation: 30
As a side note you also have the choice to use pf under freebsd.
 
Old 09-29-2004, 01:03 AM   #13
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
Yes, but all the features of OpenBSD PF don't work on FreeBSD (yet) and it isn't as stable.
 
Old 09-29-2004, 10:33 AM   #14
sandboy6184
Member
 
Registered: Apr 2004
Posts: 40

Rep: Reputation: 15
Quote:
Originally posted by jeempc
As I said I already looked there smart alec.
jeempc
shutup and read the faq
 
Old 09-29-2004, 01:07 PM   #15
jeempc
Member
 
Registered: Mar 2003
Location: Ann Arbor, MI
Distribution: Slackware 10.1
Posts: 119

Original Poster
Rep: Reputation: 15
Be nice to everyone but me huh!
I am reading it.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Simple firewall and VPN question qennster Linux - Networking 4 05-08-2005 11:34 PM
simple NAT firewall mikz Linux - Security 6 02-01-2005 08:34 AM
simple firewall question tipaul Slackware 4 09-09-2004 04:11 PM
can't use simple firewall script (it worked before) tigerflag Linux - Security 2 06-23-2003 12:10 AM
simple firewall questions jamaso Linux - Security 5 08-28-2002 12:57 PM


All times are GMT -5. The time now is 03:35 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration