3

I'm trying to create my own firewall script inside of FreeBSD and I'm running in a bit problems, I was wondering if someone done something smilier and could show me an example?

su-3.2# grep ^firewall /etc/rc.conf 
firewall_enable="YES"       # Set to YES to enable firewall functionality
firewall_type="/etc/ipfw.rules"
firewall_quiet="YES"        # Set to YES to suppress rule display
firewall_logging="YES"      # Set to YES to enable events logging
firewall_logdeny="YES"      # Set to YES to log default denied incoming
su-3.2# cat /etc/ipfw.rules 
${fwcmd} add 65000 pass all from any to any
su-3.2# /etc/rc.d/ipfw restart
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_enable is set to YES.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_enable is set to YES.
/etc/rc.d/ipfw: DEBUG: run_rc_command: doit: ipfw_stop 
net.inet.ip.fw.enable: 1 -> 0
/etc/rc.d/natd: DEBUG: checkyesno: natd_enable is set to NO.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_enable is set to YES.
/etc/rc.d/ipfw: DEBUG: run_rc_command: start_precmd: ipfw_prestart 
/etc/rc.d/ipfw: DEBUG: checkyesno: dummynet_enable is set to NO.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_nat_enable is set to NO.
/etc/rc.d/ipfw: DEBUG: load_kld: ipfw kernel module already loaded.
/etc/rc.d/ipfw: DEBUG: run_rc_command: doit: ipfw_start 
/etc/rc.d/natd: DEBUG: checkyesno: natd_enable is set to NO.
Line 1: bad command `${fwcmd}'
Firewall rules loaded.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_logging is set to YES.
Firewall logging enabled.
net.inet.ip.fw.enable: 0Read from remote host XXXXX.XXX: Connection reset by peer
Connection to XXXXX.XXX closed.
mbp:~ alexus$
Improve this question
2
  • Do you have an actual question?
    – Cian
    Sep 30, 2009 at 22:58
  • If this is a new setup you may want to look at pf instead of ipfw.
    – chris
    Nov 15, 2009 at 9:34

3 Answers 3

Reset to default
2

Lose the ${fwcmd}. Your file is being provided to ipfw as an argument.

ipfw [-cfnNqS] [-p preproc [preproc-flags]] pathname

To ease configuration, rules can be put into a file which is processed using ipfw as shown in the last synopsis line. An absolute pathname must be used. The file will be read line by line and applied as arguments to the ipfw utility.

Try running ipfw /etc/ipfw.rules

Improve this answer
2
  • do I need something like add 65000 pass all from any to any at the end of file to make it similar to "open" ? or is it going add it on it's own?
    – alexus
    Oct 1, 2009 at 5:12
  • It will not add anything, and at the end the default rule will be (usually it is deny; check sysctl net.inet.ip.fw.default_to_accept).
    – Gleb
    Oct 1, 2009 at 5:20
2

Tip: You should enter rules to IPFW from a rc.d script (ex: /usr/local/etc/rc.d/ipfw.sh), don't use /etc/ipfw.rules , thats not flexible at all

Improve this answer
0

basically, do what gleb said.

if you want to specify a script in rc.conf, you should rename your file, and use something like: firewall_script="/etc/ipfw.conf"

see /etc/defaults/rc.conf for more info.

also, ${fwcmd} needs to be defined; usually it's something like:

fwcmd="/sbin/ipfw"

see here for more info: http://www.freebsd.org/doc/en/books/handbook/firewalls-ipfw.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .