Complex ruleset questions

This is a discussion on Complex ruleset questions within the IPFilter forums, part of the System Security and Security Related category; Due to some network topology changes, I'm re-working a previously simple ruleset. The box is moving from a ...


Go Back   Usenet Forums > System Security and Security Related > IPFilter

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 06-27-2003
Damian Gerow
 
Posts: n/a
Default Complex ruleset questions

Due to some network topology changes, I'm re-working a previously simple
ruleset. The box is moving from a default-accept policy to a default-deny
policy, which is the big hurdle. Because of this, I'm breaking the whole
ruleset down into groups based on interface and direction -- so one
interface has two groups, inbound and outbound.

However, this particular machine has two 'Net connections, using BGP to
failover from one to the other. There is a /29 and a /30 routed to the box
(aliased to specific interfaces, and PAT'ed into the DMZ/LAN). Since the
majority of the rules for inbound traffic on the two external interfaces
will be the same, is there a simple way for me to combine these groups?

i.e.:

block in log on rl0 from any to any head 10
pass in quick proto tcp on rl0 from any to 192.168.1.1 port = 80 flags S keep state keep frags group 10
pass in quick proto tcp on rl0 from any to 192.168.1.2 port = 80 flags S keep state keep frags group 10
pass in quick proto tcp on rl0 from any to 192.168.1.2 port = 443 flags S keep state keep frags group 10
pass in quick proto tcp on rl0 from any to 192.168.1.2 port = 4333 flags S keep state keep frags group 10
<and others>

block in log on rl1 from any to any head 20
pass in quick proto tcp on rl1 from any to 192.168.1.1 port = 80 flags S keep state keep frags group 20
pass in quick proto tcp on rl1 from any to 192.168.1.2 port = 80 flags S keep state keep frags group 20
pass in quick proto tcp on rl1 from any to 192.168.1.2 port = 443 flags S keep state keep frags group 20
pass in quick proto tcp on rl1 from any to 192.168.1.2 port = 4333 flags S keep state keep frags group 20
<and others>

Was the first way I was doing it. I'm currently breaking it down to:

block in log on rl0 from any to any head 10
block in log on rl0 from any to 192.168.1.1 group 10 head 100
block in log on rl0 from any to 192.168.1.2 group 10 head 101
<and others>

block in log on rl1 from any to any head 20
block in log on rl1 from any to 192.168.1.1 group 20 head 100
block in log on rl1 from any to 192.168.1.2 group 20 head 101
<and others>

pass in quick proto tcp from any to 192.168.1.1 port = 80 flags S keep state keep frags group 100
pass in quick proto tcp from any to 192.168.1.2 port = 80 flags S keep state keep frags group 101
pass in quick proto tcp from any to 192.168.1.2 port = 443 flags S keep state keep frags group 101
pass in quick proto tcp from any to 192.168.1.2 port = 4333 flags S keep state keep frags group 101

Is there a way to specify, say:

block in log on {rl0,rl1} from any to any head 20
<service-specific forwards here>

Or is there anything else that anyone can think of? Or any reason why I
shouldn't do what I'm doing above?
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT +1. The time now is 08:25 AM.


Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0