I'm a total noob to ipfw so my apologies in advance if my questions are basic, but I've not found any resources for it that help with the gap between using the GUI and knowing the commandline ipfw really well.
I'd like to block ips that are hitting my webserver repeatedly. The firewall is ipfw. I found this command:
ipfw add deny ip from the.ip.to.block to my.computer.ip.address
There are two things I'm unclear about:
I understand that the rule will be flushed on restart. What I would like to know is will running this command affect any existing rules that are running? I'm guessing not but I'd like to be sure.
Is there any software that interlinks with ipfw to add ip's for a short amount of time and then remove them? If not, I'll knock up a script for it, but is there a built-in way to add from several conf files? It would make it a lot easier to do if I could have one file with the stable rules and another that loads with the dynamic ones.
Any help is much appreciated, even RTFM's if you can give a link to a resource that helps me understand it a bit better.
My firewall scripts:
\#!/bin/sh /usr/bin/sudo /sbin/ipfw -q flush /usr/bin/sudo /sbin/ipfw -q delete set 31 /usr/bin/sudo /sbin/ipfw -q /usr/local/bin/Firewall/default.conf
#Check dynamic rules #anything that's already had the # green light can continue add 1000 check-state add 1050 allow tcp from any to any established add 1080 allow tcp from any to any out keep-state add 1090 allow udp from any to any out keep-state add 1095 allow icmp from any to any out #loopback add 1100 allow ip from 127.0.0.1/8 to 127.0.0.1/8 via lo0 add 1200 deny log ip from 127.0.0.1/8 to any in add 1300 deny log ip from any to 127.0.0.1/8 in #allow pings and traceroute # Ping out; accept ping answers. add 1400 allow icmp from any to any icmptypes 8 out add 1410 allow icmp from any to any icmptypes 0 in # Allow me to traceroute. add 1420 allow icmp from any to any icmptypes 11 in add 1500 allow tcp from any to any 11305 keep-state setup #http and https add 1600 allow tcp from any to any 80 keep-state setup # rules for reverse proxying add 1610 allow tcp from me to any 4567 keep-state setup add 1611 allow tcp from me to any 4568 keep-state setup add 1612 allow tcp from me to any 4569 keep-state setup add 1620 allow tcp from me to any 4577 keep-state setup add 1621 allow tcp from me to any 4578 keep-state setup add 1622 allow tcp from me to any 4579 keep-state setup add 1630 allow tcp from me to any 4560 keep-state setup add 1631 allow tcp from me to any 4561 keep-state setup add 1632 allow tcp from me to any 4562 keep-state setup add 1640 allow tcp from me to any 4570 keep-state setup add 1641 allow tcp from me to any 4571 keep-state setup add 1642 allow tcp from me to any 4572 keep-state setup add 1700 allow tcp from any to any 443 keep-state setup #Bonjour #add 2000 allow udp from any to any 5653 keep-state setup #Everything that isn't in a prior rule add 65533 reject log udp from any to any in add 65534 deny log ip from any to any in