0

I have two FreeBSD servers that are on 4.7. These are two older servers that were already configure and setup when I got here. Now that the original admins are gone, I've started looking a bit more at these servers and I've come to find there's no firewall installed! The services they run (like ssh and sendmail) are configured well enough within their own respective configurations to filter traffic how we want it. But the fact that I can do a port scan and a list of 20 open ports pops up is concerning.

So I prepped some firewall rules for ipfw and went to install them on the servers only to find that the servers know nothing of IPFW (the binary at /sbin/ipfw doesn't exist). Further, the command I'm used to using to load the kernel modules (kldload) doesn't exist either. I've looked through the ports and there is no port to install it. In the FreeBSD admin guide it said the IPFW was added in the 4.x releases.

Anyone know why I don't have it or how I can get it? Was PF the firewall program that existed before ipfw?

Improve this question
3
  • 1
    it's curious that you don't have kldload. may I ask you if you have modload? :) it's a 4.7 alright but maybe it's an openbsd :P
    – user237419
    Mar 28, 2011 at 17:04
  • Nope, no modload command either. Uname tells me it's FreeBSD 4.7-Release-p28
    – Safado
    Mar 28, 2011 at 17:53
  • worth asking. good luck! :)
    – user237419
    Mar 28, 2011 at 18:14

2 Answers 2

Reset to default
3

In order of preference:

My first suggestion would be to upgrade these machines to a supported version of FreeBSD.
4.x is pretty well ancient at this point, well beyond the end of support life, and you would do better replacing it than trying to keep it alive. You can also secure the new machines according to current best practices.
Note that there is no supported upgrade path from 4.x to anything recent that doesn't require a reinstall, so we're talking effectively a wholesale replacement of the machines/software.

My second suggestion if you absolutely can't upgrade these machines would be to disable the services you don't need and if you still feel the need to firewall them off to use a dedicated box sitting in front of them as the firewall.
This has the net effect of reducing the open ports, and freeing up RAM, all without having to rebuild your kernel/OS. Using a dedicated firewall box allows you to set up whatever firewall rules you want without the risk of meddling with the systems themselves (which I assume are stable & working).

My third suggestion, if you still have your heart set on messing with these machines directly, would be to get a copy of the 4.7 source tree (via cvsup), and rebuild world & kernel (configuring the latter with ipfw) -- this will get you patched up to the latest and greatest 4.7 available, and give you the ipfw binary and kernel components you need to set up a firewall.
This is a HUGE risk - in the process of touching these machines you may well cause a domino cascade of things breaking that you will then need to fix.

Improve this answer
2
  • Thanks for the great response. These servers are running services that are sun setting (hopefully sooner than later). So at this point reinstalling the entire OS would be a nightmare of a project. I think disabling unneeded services and relying on program specific measures of filtering access is the best option, then pray for a speedy decommission! Thanks for your suggestions.
    – Safado
    Mar 28, 2011 at 17:22
  • @Ryan definitely, especially if the servers are going away. When dealing with something this old "Replace and Document" (or Retire) is almost always preferable to trying to make changes to a working, if ancient, system :)
    – voretaq7
    Mar 28, 2011 at 17:54
0

If ipfw was compiled as a module, you should see it in /modules/ipfw.ko

if present, load it into the kernel as root with this : "kldload ipfw && ipfw add 32000 allow ip from any to any" extracted from "man ipfw".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .