---

Hej!

Jeg har sammensat en lille router/firewall som kører FreeBSD. Den skal
bruges i forbindelse med et LAN på 60-70 mennesker. Den skal begrænse
mulighederne på Internettet så folk ikke kan bruge p2p og lign. Jeg vil
gerne høre om I evt. kan give mig forslag til ændringer på det
firewall-script jeg har lavet:

### Variables: ###
# Let's start with defining som variables:

# Internal NIC:
INT_NIC="xl0"
INT_NIC2="rl0"

# External NIC:
EXT_NIC="fxp0"

# Link to ipfw-binary:
FWBIN="/sbin/ipfw"

### The script: ###

# Flush all rules:
$FWBIN -f flush


$FWBIN add divert natd all from any to any via $EXT_NIC


# Let's allow everything trough localhost and the admin NIC.
$FWBIN add allow ip from any to any via lo0
$FWBIN add allow ip from any to any via $INT_NIC2
$FWBIN add allow tcp from me to any out via $EXT_NIC
$FWBIN add allow tcp from any to any established
$FWBIN add allow tcp from any to any out via $INT_NIC

$FWBIN add allow tcp from any to any 22 in via $INT_NIC
$FWBIN add allow tcp from any to any 25 in via $INT_NIC
$FWBIN add allow tcp from any to any 53 in via $INT_NIC
$FWBIN add allow tcp from any to any 80 in via $INT_NIC
$FWBIN add allow tcp from any to any 110 in via $INT_NIC
$FWBIN add allow tcp from any to any 113 in via $INT_NIC
$FWBIN add allow tcp from any to any 1243 in via $INT_NIC
$FWBIN add allow tcp from any to any 5999 in via $INT_NIC
$FWBIN add allow tcp from any to any 6667-6669 in via $INT_NIC

# Ports that users have asked to be opened
$FWBIN add allow tcp from any to any 8000 in via $INT_NIC


# Open everything for a specific user
$FWBIN add allow tcp from 192.168.0.0/24{12} to any in via $INT_NIC

# Let's allow all ICMP-thingies:
$FWBIN add allow icmp from any to any

# Allow all udp-packages:
$FWBIN add allow udp from any to any

# Ports which should be allowed through the $EXT_NIC to the server:
# $FWBIN add allow tcp from any to me 20 in via $EXT_NIC setup
# $FWBIN add allow tcp from any to me 21 in via $EXT_NIC setup
$FWBIN add allow tcp from any to me 22 in via $EXT_NIC setup
$FWBIN add allow tcp from any to me 113 in via $EXT_NIC setup
# $FWBIN add allow tcp from any to me 49100-65535 in via $EXT_NIC


# Deny the rest:
$FWBIN add 65000 deny log ip from any to any




Mvh. Ulrik Sølgaard-Nielsen

PS: Maskinen er en 300Mhz PII med 256MB ram. Folk kommer primært til at
bruge lokalnetværket, og jeg regner derfor ikke med at maskinen ikke kan
håndtere det.