The FreeBSD Diary
Providing practical examples since 1998If you buy from Amazon USA, please support us by using this link.
IP Filter - second time around 4 November 1998
This article is now outdated. For FreeBSD 3.* and ipf 3.3.3, see Installing IP Filter 3.3.3
This diary note describes how I installed IP Filter for the second time. I strongly suggest you follow the instructions within INST.FreeBSD-2.2 in conjunction with my detailed steps from my original IP Filter installation.
This is the second time I've tried IP Filter. I had trouble getting traceroute. I've been using the latest beta of IP Filter and doing some testing with the help of the author. Darren has fixed the trace problem I initially encountered. The utility I was using to do a trace used short packets which were being removed by the block in log quick all with short rule. This fix will be available with IP Filter 3.2.10.
|You should follow the instructions found within INST.FreeBSD-2.2.
This time, I followed the same instructions I used in the original install. Although I did not create a new kernel as that step had been performed during the original install. In short, I did the following.
NOTE: in step 5, substitute your kernel name for <kernel_name>. See the original install for details.
The following command shows the name of your present kernel:
su-2.02# uname -a FreeBSD freebsd.dvl-software.co.nz 2.2.7-RELEASE FreeBSD 2.2.7-RELEASE #0: Wed Nov 4 23:49:25 NZDT 1998 firstname.lastname@example.org:/usr/src/sys/compile/IPFILTER3 i386
In the above example, the kernel name is IPFILTER3.
|If you were already running IP Filter, here is what you do to reload it.
su-2.02# modstat Type Id Off Loadaddr Size Info Rev Module Name DEV <id> 79 f3c86000 0031 f3c90248 1 IP Filter v3.2.9 su-2.02# modunload -i <id> su-2.02# modload /lkm/if_ipl.o Module loaded as ID 1
You will also have to restart your NAT rules and reload your filtering rules. Here's what I did:
ipnat -f /etc/ipnat.conf ipf -f /etc/ipfilter_rules
I have also supplied my NAT rules for those that may need an example.
As for your firewall rules, I suggest you start with the contents of the Rules directory and use either BASIC_1.FW or BASIC_1.FW as the basis for your rule set. Also note that BNF contains the rule syntax.
|I've decided to do some logging of my traffic. Everything is running fine, but I
want to know what packets are being blocked and why. From the IP Filter mailing list archive, I've found
the following steps to enable logging.
But nothing appears in /var/log/firewall.log. Instead, the messages are going to /var/log/messages.
/etc/syslog.conf, it prefers tabs, not spaces. Details available here.
Please note that syslog.conf prefers tabs over spaces. If you use spaces, you'll get a message during reboot which is similar to the following:
unknown priority name "info /var/log/firewall.log"
Here is what I put in my /etc/syslog.conf to get ipmon messages into the correct file (note that the first line has been split into two lines so it fits on the page):
*.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none /var/log/messages local0.info;local0.debug /var/log/firewall.log local0.err /var/log/firewall.err
You will notice that I added a local0.none to the first line. This stopped the messages from appearing the the messages log. The next two lines direct the information to the appropriate files.
Eventually, I'll add something to rotate these logs so they don't get too big. But that's another topic for a later date.