This is a discussion on Complex ruleset questions within the IPFilter forums, part of the System Security and Security Related category; Due to some network topology changes, I'm re-working a previously simple ruleset. The box is moving from a ...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
Due to some network topology changes, I'm re-working a previously simple
ruleset. The box is moving from a default-accept policy to a default-deny policy, which is the big hurdle. Because of this, I'm breaking the whole ruleset down into groups based on interface and direction -- so one interface has two groups, inbound and outbound. However, this particular machine has two 'Net connections, using BGP to failover from one to the other. There is a /29 and a /30 routed to the box (aliased to specific interfaces, and PAT'ed into the DMZ/LAN). Since the majority of the rules for inbound traffic on the two external interfaces will be the same, is there a simple way for me to combine these groups? i.e.: block in log on rl0 from any to any head 10 pass in quick proto tcp on rl0 from any to 192.168.1.1 port = 80 flags S keep state keep frags group 10 pass in quick proto tcp on rl0 from any to 192.168.1.2 port = 80 flags S keep state keep frags group 10 pass in quick proto tcp on rl0 from any to 192.168.1.2 port = 443 flags S keep state keep frags group 10 pass in quick proto tcp on rl0 from any to 192.168.1.2 port = 4333 flags S keep state keep frags group 10 <and others> block in log on rl1 from any to any head 20 pass in quick proto tcp on rl1 from any to 192.168.1.1 port = 80 flags S keep state keep frags group 20 pass in quick proto tcp on rl1 from any to 192.168.1.2 port = 80 flags S keep state keep frags group 20 pass in quick proto tcp on rl1 from any to 192.168.1.2 port = 443 flags S keep state keep frags group 20 pass in quick proto tcp on rl1 from any to 192.168.1.2 port = 4333 flags S keep state keep frags group 20 <and others> Was the first way I was doing it. I'm currently breaking it down to: block in log on rl0 from any to any head 10 block in log on rl0 from any to 192.168.1.1 group 10 head 100 block in log on rl0 from any to 192.168.1.2 group 10 head 101 <and others> block in log on rl1 from any to any head 20 block in log on rl1 from any to 192.168.1.1 group 20 head 100 block in log on rl1 from any to 192.168.1.2 group 20 head 101 <and others> pass in quick proto tcp from any to 192.168.1.1 port = 80 flags S keep state keep frags group 100 pass in quick proto tcp from any to 192.168.1.2 port = 80 flags S keep state keep frags group 101 pass in quick proto tcp from any to 192.168.1.2 port = 443 flags S keep state keep frags group 101 pass in quick proto tcp from any to 192.168.1.2 port = 4333 flags S keep state keep frags group 101 Is there a way to specify, say: block in log on {rl0,rl1} from any to any head 20 <service-specific forwards here> Or is there anything else that anyone can think of? Or any reason why I shouldn't do what I'm doing above? |
![]() |
| Thread Tools | |
| Display Modes | |
|
|