Neo-Vortex wrote: >>- When I run "/sbin/ipfw -q -f flush" in the rules script all connection >>get reset (and I am thrown out of the box). > > > Yep, standard functionality, easy fix though: > > -- Start file /root/bin/fws -- > #!/bin/sh > fw > /root/fws-out 2>&1 & > -- End File -- > > -- Start file /root/bin/fw -- > #!/bin/sh > > ipfw="ipfw" > > > # Flush Old Rules > $ipfw -f flush > > # Tempoary rules to stop connections being killed when reloading rules > $ipfw add 1 allow tcp from any to any established > $ipfw add 2 allow udp from any to any > > <snip> - your rules go here (dont use rule 1 or 2 though) > > # Clean up tempoary rules used to stop connections being killed > $ipfw delete 1 > $ipfw delete 2 > -- End File -- > > I use that all the time, mabe 1 out of 100 times it will kill a ssh > session (only one that has irssi open cause of the time updating it kills > it, i have it set to update every second though, so normally it'd be like > 1 out of 500 or so) and even if it does, it still finishes loading the > ruleset anyway so you can just ssh straight back in > > If you havn't guessed, you run /root/bin/fws - you can change it to > whatever you want of course, also, the output is redirected to > /root/fws-out - if you dont redirect it, it'll kill your ssh session - > although it won't stop it loading the other rules
Thanks :) My changed rule file looks like this: ----start file ipfw.rules----------- #!/bin/sh /sbin/ipfw -q -f flush cmd="/sbin/ipfw add " # build rule prefix ks="keep-state" # just too lazy to key this each time /sbin/ipfw add 1 allow tcp from any to any established ##################################### $cmd 00500 check-state $cmd 00502 deny all from any to any frag #$cmd 00501 deny tcp from any to any established $cmd 00602 allow tcp from 20x.xx.xx.xx/32 to any 22 in via ed0 $ks $cmd 00603 allow tcp from 20x.xx.xx.xx/32 to any 22 in via ed0 $ks $cmd 00604 allow all from 20x.xx.xx.xx/32 to any out via ed0 $ks $cmd 00609 allow tcp from 22x.xx.0.0/16 to any 22 in via ed0 $ks $cmd 00610 allow icmp from 22x.xx.0.0/16 to any in via ed0 $ks $cmd 00611 allow tcp from 220.xx.0.0/16 to any 22 in via ed0 $ks $cmd 00612 allow icmp from 220.xx.0.0/16 to any in via ed0 $ks $cmd 02500 divert 8000 log tcp from any to any 80 $cmd 02501 allow tcp from any to any 80 in via ed0 $ks ##################################### /sbin/ipfw delete 1 ----end file ipfw.rules----------- Even if I run this script as it is (without running from within another script and redirecting), I don't get disconnected. Thanks again, - Siddhartha _______________________________________________ freebsd-security@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[EMAIL PROTECTED]"
