I am interested how to secure a management interface on a forwarding firewall box. What I am trying to prevent is a hacker getting access to the system from an untrusted interface, and being able to access the management interface from inside.

I know that one good solution would be to enable ipf and kernel security levels, but is it possible to disable forwarding between some interfaces by means of sysctl, and yet allow forwarding between others?


Thanks,



-igor

so, basically... you only want to allow incoming connections on <trusted_if> on port 22.. and disable incomming connections on <untrusted_if> on port 22?? This should be relatively easy...I lack the immediate time to develop the answer for you.. but I would recommend using PF over ipf... and the PF handbook from OpenBSD is EXCELLENT... You could also specify a single (or group) or trusted IP's to allow remote administration over port 22... while blocking anything that doesn't match that... as well, you could enable SSH to only allow private key connections.. meaning you need to keep your SSH key on a thumb drive/floppy/whatever...

*As a side note: I recently purchased the book 'Mastering FreeBSD and OpenBSD Security'. It is excellent thus far... A lot of the book is just going over good security practices and principals, and explaining why we do this or that. I highly recommend it!