aboutsummaryrefslogtreecommitdiff
path: root/etc/rc.firewall
Commit message (Collapse)AuthorAgeFilesLines
* DNS should not necessarily be named(8), tweak the comment a bit.Ruslan Ermilov2003-11-021-1/+1
| | | | Notes: svn path=/head/; revision=121881
* Add a header: #!/bin/sh.Tom Rhodes2003-02-061-0/+1
| | | | | | | PR: 44363 Notes: svn path=/head/; revision=110476
* Bring rc.firewall{,6} more in line with the word and spirit ofCrist J. Clark2002-02-211-7/+17
| | | | | | | | | | | | | | | | | | | rc.conf(5) and the files' inline documentation. - Add the "closed"-type, documented in both places, but which did not exist in the code. - When provided a ruleset, the system should not make any assumptions about the sites's policy and should add no rules of its own. - Make the "UNKNOWN" (documented in-line) actual work as advertised, load no rules. Prodded by: Igor M Podlesny <poige@morning.ru> MFC after: 1 week Notes: svn path=/head/; revision=91019
* Remove a stale entry related to passing ARP with bridging and ipfw.Luigi Rizzo2001-12-271-2/+0
| | | | | | | | | | | | This feature has been removed since 4.1 times and it is only a source of confusion. Same needs to be done on -stable. MFC after: 1 day Notes: svn path=/head/; revision=88523
* Sync the code that sucks in rc.conf and friends with what's inDima Dorfman2001-08-141-5/+7
| | | | | | | | | | | | | | | rc.firewall6. Specifically, don't do anything if [ -z ${source_rc_confs_defined} ]. Not doing this leads to a problem with dependencies: chkdepend will set, e.g., portmap_enable to YES if some service that needs portmap is enabled, but rc.network sources rc.firewall, which used to source defaults/rc.conf unconditionally, which would result in portmap_enable being set back to NO. PR: 29631 Submitted by: OGAWA Takaya <t-ogawa@triaez.kaisei.org> Notes: svn path=/head/; revision=81618
* style nitDavid E. O'Brien2001-03-061-1/+1
| | | | Notes: svn path=/head/; revision=73842
* Also deny 127.0.0.0/8 going out.David E. O'Brien2001-03-051-1/+2
| | | | | | | Submitted by: grimes Notes: svn path=/head/; revision=73785
* Fix references to Chapman & Zwicky and Cheswick & Bellowin.Dag-Erling Smørgrav2001-02-251-3/+5
| | | | | | | | PR: 24652 Submitted by: jjreynold@home.com Notes: svn path=/head/; revision=73023
* Fix some glaring insecurities in the prototype firewall configurations.Nick Sayer2001-02-201-8/+4
| | | | | | | | | | | pass udp from any 53 to ${oip} allows an attacker to access ANY local port by simply binding his local side to 53. The state keeping mechanism is the correct way to allow DNS replies to go back to their source. Notes: svn path=/head/; revision=72772
* Add copyright notices. Other systems have been barrowing our /etc filesDavid E. O'Brien2000-10-081-2/+29
| | | | | | | w/o giving any credit. Notes: svn path=/head/; revision=66830
* Only install `divert natd' rule for predefined firewall types,Ruslan Ermilov2000-08-301-3/+1
| | | | | | | | | | not when ${firewall_type} is set to a filename, as we know nothing about user's script specifics. Reported by: Bernhard Valenti <bernhard.valenti@gmx.net> Notes: svn path=/head/; revision=65257
* Make natd(8) "compatible" with firewall_type="simple".Ruslan Ermilov2000-08-041-17/+46
| | | | | | | PR: conf/13769, conf/20197 Notes: svn path=/head/; revision=64244
* Update rev 1.29 -- 'draft-manning-dsua' is now in its 3rd version.David E. O'Brien2000-07-301-1/+3
| | | | Notes: svn path=/head/; revision=64028
* Add an explicit rule number to natd so you do not end up with twoPaul Saab2000-05-081-1/+1
| | | | | | | | | rule 100's. Submitted by: Jan Koum <jkb@yahoo-inc.com> Notes: svn path=/head/; revision=60208
* Add to defaults/rc.conf a new function source_rc_confs which rcSheldon Hearn2000-04-271-0/+1
| | | | | | | | | | | | | | | | | | | | scripts may use to source safely overrides in ${rc_conf_files} files. This protects users who insist on the bad practice of copying /etc/defaults/rc.conf to /etc/rc.conf from a recursive loop that exhausts available file descriptors. Several people have expressed interest in breaking this function out into its own shell script. Anyone who wants to embark on such an undertaking would do well to study the attributed PR. PR: 17595 Reported by: adrian Submitted by: Doug Barton <Doug@gorean.org> Notes: svn path=/head/; revision=59674
* Back out the hook to execute the file ${firewall_type}. The intendedBrian S. Dean2000-04-271-3/+1
| | | | | | | | | | | | | purpose of the hook was to provide the ability for a shell program to instantiate the firewall rules instead of forcing them to be statically coded. This functionality was already present through the use of ${firewall_script}, and I see no need to keep the ${firewall_type} hook around. Reminded by: Dag-Erling Smorgrav <des@freebsd.org> Notes: svn path=/head/; revision=59669
* Allow the firewall rules to be established by a shell script insteadBrian S. Dean2000-04-161-1/+3
| | | | | | | | | | of forcing them to be an 'ipfw' rules file. This allows one to determine interface addresses dynamically, etc. The rule is if the file referenced by ${firewall_type} is executable, it is sourced, but if it is just readable, it is used as input to 'ipfw' like before. Notes: svn path=/head/; revision=59270
* Add a firewall_flags option that is used when ipfw processes a file. It allowsPaul Richards2000-02-061-1/+1
| | | | | | | | | | you to run a preprocessor, such as m4, so that you can use macros in your rules file. Approved by: jkh Notes: svn path=/head/; revision=57014
* Update this with the additional nets recomended by readingRodney W. Grimes2000-01-281-14/+26
| | | | | | | | | | | | | | draft-manning-dsua-01.txt. Stop using public addresses as samples and use the recommended 192.0.2.0/24 netblock that has specifically been set aside for documentation purposes. Reviewed by: readers of freebsd-security did not respond to a request for review Notes: svn path=/head/; revision=56736
* Minor whitespace fix.David E. O'Brien1999-12-041-2/+1
| | | | Notes: svn path=/head/; revision=54108
* Pass IP fragments with non-zero offset. The semantics of matchingRuslan Ermilov1999-11-041-0/+6
| | | | | | | | | IP fragments has been changed in src/sys/netinet/ip_fw.c,v 1.78. Reminded by: "Ronald F. Guilmette" <rfg@monkeys.com> Notes: svn path=/head/; revision=52873
* Add commented entry to the lo0 section inviting bridge users toNick Sayer1999-10-241-0/+2
| | | | | | | enable ARP on filtering bridges. Notes: svn path=/head/; revision=52449
* Allow for incoming DNS UDP queries.Ruslan Ermilov1999-10-201-0/+2
| | | | Notes: svn path=/head/; revision=52404
* Fix a typo in a comment.Mike Pritchard1999-09-301-1/+1
| | | | Notes: svn path=/head/; revision=51805
* Apply a consistent style to most of the etc scripts. Particularly, useSheldon Hearn1999-09-131-115/+138
| | | | | | | | | | | | case instead of test where appropriate, since case allows case is a sh builtin and (as a side-effect) allows case-insensitivity. Changes discussed on freebsd-hackers. Submitted by: Doug Barton <Doug@gorean.org> Notes: svn path=/head/; revision=51231
* $Id$ -> $FreeBSD$Peter Wemm1999-08-271-1/+1
| | | | Notes: svn path=/head/; revision=50472
* Style clean-up:Sheldon Hearn1999-08-251-39/+39
| | | | | | | | | | | | | | | | | | | * All variables are now embraced: ${foo} * All comparisons against some value now take the form: [ "${foo}" ? "value" ] where ? is a comparison operator * All empty string tests now take the form: [ -z "${foo}" ] * All non-empty string tests now take the form: [ -n "${foo}" ] Submitted by: jkh Notes: svn path=/head/; revision=50357
* Use /etc/defaults/rc.conf everywhere, falling back to /etc/rc.confJordan K. Hubbard1999-02-101-2/+5
| | | | | | | as necessary (for half-assed upgrades). Notes: svn path=/head/; revision=43849
* Strengthen the rules governing the 127.0.0.0/8 subnet. The previous rulesAlexander Langer1998-04-251-3/+3
| | | | | | | | | | | | | allowed external hosts to send packets to the 127.0.0.0/8 subnet on the firewall host. Renumber the lo0 rules to guarantee they appear first. PR: 6406 Submitted by: Archie Cobbs <archie@whistle.com> Notes: svn path=/head/; revision=35444
* Add natd support.Brian Somers1998-04-181-1/+10
| | | | | | | | PR: 6339 Submitted by: cdillon@wolves.k12.mo.us Notes: svn path=/head/; revision=35267
* Better RFC1918 network protectionPoul-Henning Kamp1998-04-151-1/+4
| | | | | | | | | PR: 6278 Reviewed by: phk Submitted by: Ruslan Ermilov <ru@ucb.crimea.ua> Notes: svn path=/head/; revision=35207
* get default firewall type from rc.confAdam David1998-02-101-1/+5
| | | | Notes: svn path=/head/; revision=33203
* MF22 - make firewall_type a little more robustDaniel O'Callaghan1997-10-211-9/+6
| | | | Notes: svn path=/head/; revision=30617
* Fix some problems in the rules file loading and need for modload detection.Daniel O'Callaghan1997-09-181-2/+2
| | | | | | | Found by: "James E. Housley" <housley@pr-comm.com> Notes: svn path=/head/; revision=29590
* Reviewed by: msmith, alexDaniel O'Callaghan1997-09-111-44/+60
| | | | | | | Cosmetic changes to the loading of firewall rules and lkm. Notes: svn path=/head/; revision=29300
* Add inetd_flags and way of passing ipfw a configuration fileJordan K. Hubbard1997-05-051-4/+9
| | | | | | | | | | | | (if firewall = "somefilename"). Fix typo fixes and URLs which were accidently nuked out of this file (submitted by: soil@quick.net via PR#3501). Submitted by: "Danny J. Zerkel" <dzerkel@phofarm.com> Notes: svn path=/head/; revision=25478
* Update the etc world from RELENG_2_2 which is now more up-to-dateJordan K. Hubbard1997-05-031-5/+3
| | | | | | | | | (gotta get myself -current again, this is a drag). Also-fixes-problems-noted-by: Wolfgang Helbig & Joerg Wunsch Notes: svn path=/head/; revision=25412
* Typo police.Alexander Langer1997-04-271-3/+5
| | | | | | | | Added links to O'Reilly & Associates and Addison-Wesley's web sites to accompany the book recommendations. Notes: svn path=/head/; revision=25203
* Bring in rc file changes from -current.Jordan K. Hubbard1997-04-271-7/+4
| | | | Notes: svn path=/head/; revision=25184
* Revert $FreeBSD$ to $Id$Peter Wemm1997-02-231-1/+1
| | | | Notes: svn path=/head/; revision=23037
* Make the long-awaited change from $Id$ to $FreeBSD$Jordan K. Hubbard1997-01-141-1/+1
| | | | | | | | | | | This will make a number of things easier in the future, as well as (finally!) avoiding the Id-smashing problem which has plagued developers for so long. Boy, I'm glad we're not using sup anymore. This update would have been insane otherwise. Notes: svn path=/head/; revision=21673
* don't ask for confirmationAdam David1996-09-051-2/+2
| | | | Notes: svn path=/head/; revision=18045
* space typo, the shell don't like name=<space>valueWolfram Schneider1996-08-191-2/+2
| | | | Notes: svn path=/head/; revision=17671
* Remove root dotfiles which did more harm than good.Jordan K. Hubbard1996-08-141-19/+31
| | | | Notes: svn path=/head/; revision=17594
* Flush out the rules before adding entries. This prevents duplicateAlexander Langer1996-06-221-1/+5
| | | | | | | | rules from appearing when switching back and forth from single to multi-user modes. Notes: svn path=/head/; revision=16578
* Add another good book to the required reading.Poul-Henning Kamp1996-04-121-3/+11
| | | | | | | | | | make a couple of rules more sensible. Reviewed by: phk Submitted by: jmb Notes: svn path=/head/; revision=15210
* Add skeleton firewall setup(s). Comments very welcome.Poul-Henning Kamp1996-04-031-0/+133
Notes: svn path=/head/; revision=15027
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-25 07:05:46 +0000