0

I have prepared the following configuration:

# cat /etc/firewall.conf 
add 1000 count udp from any to me 10000
add 1001 count udp from any to me 10001
add 1002 count udp from any to me 10002
add 65000 allow ip from any to any

This is the output from ipfw:

# ipfw list
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
01000 count udp from any to me 10000
01001 count udp from any to me 10001
01002 count udp from any to me 10002
65000 allow ip from any to any
65535 deny ip from any to any

I have the following two questions:

  1. What would be the command to allow UDP traffic from IP 203.0.113.1 to UDP port range 20500-20750? Would the rule below be the right one?

    add 2000 allow udp from 203.0.113.1 to me 20500-20750

  2. With the above configuration, do I ensure that all traffic is allowed?

Improve this question
4
  • That rule looks fine, but will only control traffic in one direction.
    – Richard Smith
    Jun 5, 2020 at 12:19
  • But if I understood it correctly, with the rule 65000 I am effectively allowing all traffic (except that addressed to localhost 127.0.0.1), right?
    – M.E.
    Jun 5, 2020 at 12:53
  • That is correct.
    – Richard Smith
    Jun 5, 2020 at 12:56
  • Thanks that helps to understand how ipfw shall be configured..
    – M.E.
    Jun 5, 2020 at 17:38

1 Answer 1

Reset to default
1

add 2000 allow udp from 203.0.113.1 to me 20500-20750

Right, that will work.

With the above configuration, do I ensure that all traffic is allowed?

It depends on what you meant of "all traffic". Rule 65000 allow ip from any to any effectively allows all traffic, so except of rules 200-500, there is no sense to keep others in the same moment.
Without rule 65000, however, there is a lack of many critical rules: ssh access to server itself and, the most funny part, any outgoing traffic from the one.
So I'd recommend to read numerous manuals of firewall set up.
One more useful thing is to use ipfw logging in the rules end.
Check out a great FreeBSD handbook: https://www.freebsd.org/doc/handbook/firewalls-ipfw.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .