LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Other *NIX Forums > *BSD
User Name
Password
*BSD This forum is for the discussion of all BSD variants.
FreeBSD, OpenBSD, NetBSD, etc.

Notices


Reply
  Search this Thread
Old 02-28-2021, 12:20 AM   #1
rng
Senior Member
 
Registered: Aug 2011
Posts: 1,117

Rep: Reputation: 43
Simple firewall needed for FreeBSD


I recently installed FreeBSD and it is working very well. I am using it on a desktop with XFCE4.

I want to install a firewall which should permit only web browsing with Firefox etc (and downloading from web). I know about iptables from my Linux experience but apparently that is not used in FreeBSD.

How can I setup a simple firewall which permits only web browsing and downloading from web? Thanks for your help.
 
Old 02-28-2021, 12:48 AM   #2
Turbocapitalist
LQ Guru
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 5,611
Blog Entries: 3

Rep: Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859Reputation: 2859
Hello again.

I would recommend looking into PF.

Peter N M Hansteen has written an excellent, thorough book on it and had numberous recorded presentations. His book, The Book Of PF, 3rd ed., from No Starch Press, can be ordered quickly from online shops and some of the presentations are about in slide form. The FreeBSD handbook is also a place to look for information about PF. +1 FreeBSD has a great handbook, -1 it needs a handbook to set up.

I haven't followed the details with FreeBSD, but I think there still is some divergance between the upstream PF at OpenBSD and the one still in FreeBSD. Either way, it is far easier to learn than iptables.
 
Old 02-28-2021, 07:49 AM   #3
Emerson
LQ Sage
 
Registered: Nov 2004
Location: Saint Amant, Acadiana
Distribution: Gentoo ~arch
Posts: 7,231

Rep: Reputation: Disabled
I had a FreeBSD box exposed directly to the internet and once I forgot to turn the firewall on. It was running over 7 months like this, until I noticed its CPU usage was unexpectedly high. All open ports were under heavy attack, who knows for how long. But no harm was done. This is what I love about FreeBSD, it is strong security-wise. People who have Windows shaped their mindset do not understand this.
 
Old 02-28-2021, 11:26 AM   #4
hitest
Guru
 
Registered: Mar 2004
Location: Prince Rupert, B.C., Canada
Distribution: Slackware, OpenBSD, Debian
Posts: 6,672

Rep: Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920
As previously mentioned I would recommend PF. That's what I use on OpenBSD.
 
Old 02-28-2021, 12:03 PM   #5
Emerson
LQ Sage
 
Registered: Nov 2004
Location: Saint Amant, Acadiana
Distribution: Gentoo ~arch
Posts: 7,231

Rep: Reputation: Disabled
For completeness have a look at IPFW, too. Its use cannot be simpler, just set it to "closed" in rc.conf and then allow your web browsing with added rule.
 
Old 03-01-2021, 05:57 AM   #6
rng
Senior Member
 
Registered: Aug 2011
Posts: 1,117

Original Poster
Rep: Reputation: 43
Quote:
Originally Posted by Emerson View Post
For completeness have a look at IPFW, too. Its use cannot be simpler, just set it to "closed" in rc.conf and then allow your web browsing with added rule.
Some example code will be really appreciated (IPFW or PF).
 
Old 03-01-2021, 07:00 AM   #7
Emerson
LQ Sage
 
Registered: Nov 2004
Location: Saint Amant, Acadiana
Distribution: Gentoo ~arch
Posts: 7,231

Rep: Reputation: Disabled
I run a mail server, sometimes I want to receive outside mail, but most time I keep my port closed with following - re0 is my WAN interface:
Code:
ipfw -q add 00705 deny tcp from any to any dst-port 25 in via re0
 
Old 03-01-2021, 08:50 AM   #8
rng
Senior Member
 
Registered: Aug 2011
Posts: 1,117

Original Poster
Rep: Reputation: 43
Quote:
Originally Posted by Emerson View Post
I run a mail server, sometimes I want to receive outside mail, but most time I keep my port closed with following - re0 is my WAN interface:
Code:
ipfw -q add 00705 deny tcp from any to any dst-port 25 in via re0
Will this allow web browsing and nothing else?
 
Old 03-01-2021, 09:10 AM   #9
Emerson
LQ Sage
 
Registered: Nov 2004
Location: Saint Amant, Acadiana
Distribution: Gentoo ~arch
Posts: 7,231

Rep: Reputation: Disabled
Quote:
Originally Posted by rng View Post
Will this allow web browsing and nothing else?
You must be kidding.
 
1 members found this post helpful.
Old 03-01-2021, 09:34 AM   #10
rng
Senior Member
 
Registered: Aug 2011
Posts: 1,117

Original Poster
Rep: Reputation: 43
Quote:
Originally Posted by Emerson View Post
You must be kidding.
That is what I want. I tried to clearly state that in my question above (top post).
 
Old 03-01-2021, 09:38 AM   #11
cynwulf
Senior Member
 
Registered: Apr 2005
Location: Walsall, UK
Posts: 2,631
Blog Entries: 7

Rep: Reputation: 2151Reputation: 2151Reputation: 2151Reputation: 2151Reputation: 2151Reputation: 2151Reputation: 2151Reputation: 2151Reputation: 2151Reputation: 2151Reputation: 2151
You will have to read the docs, man pages - there is no "copy and paste" solution. No one is going to sit down and write a firewall configuration for you.
 
1 members found this post helpful.
Old 03-01-2021, 09:56 AM   #12
hitest
Guru
 
Registered: Mar 2004
Location: Prince Rupert, B.C., Canada
Distribution: Slackware, OpenBSD, Debian
Posts: 6,672

Rep: Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920Reputation: 2920
Quote:
Originally Posted by rng View Post
Some example code will be really appreciated (IPFW or PF).
https://docs.freebsd.org/en_US.ISO88...ewalls-pf.html

edit /etc/pf.conf

Code:
block in all
pass out all keep state
 
Old 03-01-2021, 10:40 AM   #13
rng
Senior Member
 
Registered: Aug 2011
Posts: 1,117

Original Poster
Rep: Reputation: 43
Quote:
Originally Posted by hitest View Post
https://docs.freebsd.org/en_US.ISO88...ewalls-pf.html

edit /etc/pf.conf

Code:
block in all
pass out all keep state
Really simple code needed for PF !!
 
Old 03-16-2021, 02:52 AM   #14
Gad
Member
 
Registered: May 2013
Distribution: FreeBSD 12.2-RELEASE
Posts: 566

Rep: Reputation: 114Reputation: 114
Firewalling with OpenBSD's PF packet filter

http://home.nuug.no/~peter/pf/en/
 
Old 03-16-2021, 09:14 PM   #15
X-LFS-2010
Member
 
Registered: Apr 2016
Posts: 510

Rep: Reputation: 58
posts suggesting pfsense in the freeBSD.org forum are banned

just so you know
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Simple Slackware vs simple Arch vs simple Frugalware punchy71 Linux - Distributions 2 08-28-2012 02:30 PM
Centos Firewall...needed if already behind a firewall? JohnRock Linux - Networking 7 05-22-2009 02:49 PM
Simple Firewall Code Needed thegreatest Linux - Security 4 12-09-2005 02:00 AM
firewall..... make it simple needed slack66 Linux - Security 4 10-02-2003 03:24 AM
FreeBSD 4.6 vs. FreeBSD 4.7 mikeshn *BSD 1 11-02-2002 01:44 AM

LinuxQuestions.org > Forums > Other *NIX Forums > *BSD

All times are GMT -5. The time now is 01:26 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration