Simple firewall needed for FreeBSD

rng · 02-28-2021, 12:20 AM

I recently installed FreeBSD and it is working very well. I am using it on a desktop with XFCE4.

I want to install a firewall which should permit only web browsing with Firefox etc (and downloading from web). I know about iptables from my Linux experience but apparently that is not used in FreeBSD.

How can I setup a simple firewall which permits only web browsing and downloading from web? Thanks for your help.

Turbocapitalist · 02-28-2021, 12:48 AM

Hello again.

I would recommend looking into PF.

Peter N M Hansteen has written an excellent, thorough book on it and had numberous recorded presentations. His book, The Book Of PF, 3rd ed., from No Starch Press, can be ordered quickly from online shops and some of the presentations are about in slide form. The FreeBSD handbook is also a place to look for information about PF. +1 FreeBSD has a great handbook, -1 it needs a handbook to set up.

I haven't followed the details with FreeBSD, but I think there still is some divergance between the upstream PF at OpenBSD and the one still in FreeBSD. Either way, it is far easier to learn than iptables.

Emerson · 02-28-2021, 07:49 AM

I had a FreeBSD box exposed directly to the internet and once I forgot to turn the firewall on. It was running over 7 months like this, until I noticed its CPU usage was unexpectedly high. All open ports were under heavy attack, who knows for how long. But no harm was done. This is what I love about FreeBSD, it is strong security-wise. People who have Windows shaped their mindset do not understand this.

hitest · 02-28-2021, 11:26 AM

As previously mentioned I would recommend PF. That's what I use on OpenBSD.

Emerson · 02-28-2021, 12:03 PM

For completeness have a look at IPFW, too. Its use cannot be simpler, just set it to "closed" in rc.conf and then allow your web browsing with added rule.

rng · 03-01-2021, 05:57 AM

Quote:

Originally Posted by Emerson

For completeness have a look at IPFW, too. Its use cannot be simpler, just set it to "closed" in rc.conf and then allow your web browsing with added rule.

Some example code will be really appreciated (IPFW or PF).

Emerson · 03-01-2021, 07:00 AM

I run a mail server, sometimes I want to receive outside mail, but most time I keep my port closed with following - re0 is my WAN interface:

Code:

ipfw -q add 00705 deny tcp from any to any dst-port 25 in via re0

rng · 03-01-2021, 08:50 AM

Quote:

Originally Posted by Emerson

I run a mail server, sometimes I want to receive outside mail, but most time I keep my port closed with following - re0 is my WAN interface:

Code:

ipfw -q add 00705 deny tcp from any to any dst-port 25 in via re0

Will this allow web browsing and nothing else?

Emerson · 03-01-2021, 09:10 AM

Quote:

Originally Posted by rng

Will this allow web browsing and nothing else?

You must be kidding.

rng · 03-01-2021, 09:34 AM

Quote:

Originally Posted by Emerson

You must be kidding.

That is what I want. I tried to clearly state that in my question above (top post).

cynwulf · 03-01-2021, 09:38 AM

You will have to read the docs, man pages - there is no "copy and paste" solution. No one is going to sit down and write a firewall configuration for you.