3

I'm trying to create my own firewall script inside of FreeBSD and I'm running in a bit problems, I was wondering if someone done something smilier and could show me an example?

su-3.2# grep ^firewall /etc/rc.conf 
firewall_enable="YES"       # Set to YES to enable firewall functionality
firewall_type="/etc/ipfw.rules"
firewall_quiet="YES"        # Set to YES to suppress rule display
firewall_logging="YES"      # Set to YES to enable events logging
firewall_logdeny="YES"      # Set to YES to log default denied incoming
su-3.2# cat /etc/ipfw.rules 
${fwcmd} add 65000 pass all from any to any
su-3.2# /etc/rc.d/ipfw restart
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_enable is set to YES.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_enable is set to YES.
/etc/rc.d/ipfw: DEBUG: run_rc_command: doit: ipfw_stop 
net.inet.ip.fw.enable: 1 -> 0
/etc/rc.d/natd: DEBUG: checkyesno: natd_enable is set to NO.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_enable is set to YES.
/etc/rc.d/ipfw: DEBUG: run_rc_command: start_precmd: ipfw_prestart 
/etc/rc.d/ipfw: DEBUG: checkyesno: dummynet_enable is set to NO.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_nat_enable is set to NO.
/etc/rc.d/ipfw: DEBUG: load_kld: ipfw kernel module already loaded.
/etc/rc.d/ipfw: DEBUG: run_rc_command: doit: ipfw_start 
/etc/rc.d/natd: DEBUG: checkyesno: natd_enable is set to NO.
Line 1: bad command `${fwcmd}'
Firewall rules loaded.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_logging is set to YES.
Firewall logging enabled.
net.inet.ip.fw.enable: 0Read from remote host XXXXX.XXX: Connection reset by peer
Connection to XXXXX.XXX closed.
mbp:~ alexus$ 
  • Do you have an actual question? – Cian Sep 30 '09 at 22:58
  • If this is a new setup you may want to look at pf instead of ipfw. – chris Nov 15 '09 at 9:34
2

Lose the ${fwcmd}. Your file is being provided to ipfw as an argument.

ipfw [-cfnNqS] [-p preproc [preproc-flags]] pathname

To ease configuration, rules can be put into a file which is processed using ipfw as shown in the last synopsis line. An absolute pathname must be used. The file will be read line by line and applied as arguments to the ipfw utility.

Try running ipfw /etc/ipfw.rules

  • do I need something like add 65000 pass all from any to any at the end of file to make it similar to "open" ? or is it going add it on it's own? – alexus Oct 1 '09 at 5:12
  • It will not add anything, and at the end the default rule will be (usually it is deny; check sysctl net.inet.ip.fw.default_to_accept). – Gleb Oct 1 '09 at 5:20
2

Tip: You should enter rules to IPFW from a rc.d script (ex: /usr/local/etc/rc.d/ipfw.sh), don't use /etc/ipfw.rules , thats not flexible at all

0

basically, do what gleb said.

if you want to specify a script in rc.conf, you should rename your file, and use something like: firewall_script="/etc/ipfw.conf"

see /etc/defaults/rc.conf for more info.

also, ${fwcmd} needs to be defined; usually it's something like:

fwcmd="/sbin/ipfw"

see here for more info: http://www.freebsd.org/doc/en/books/handbook/firewalls-ipfw.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.