Author: julian
Date: Mon Jun 22 04:25:41 2015
New Revision: 284691
URL: https://svnweb.freebsd.org/changeset/base/284691
Log:
remove 16 rules and replace by 2 by using a table
I've been doing this ever since there were tables
coudl make more efficient by using "in recv" and "out xmit" instead of via
but I'll leave that.
MFC after: 1 week
Modified:
head/etc/rc.firewall
Modified: head/etc/rc.firewall
==============================================================================
--- head/etc/rc.firewall Mon Jun 22 00:54:47 2015 (r284690)
+++ head/etc/rc.firewall Mon Jun 22 04:25:41 2015 (r284691)
@@ -266,6 +266,7 @@ case ${firewall_type} in
# firewall_simple_oif_ipv6: Outside IPv6 network interface.
# firewall_simple_onet_ipv6: Outside IPv6 network prefix.
############
+ BAD_ADDR_TBL=13
# set these to your outside interface network
oif="$firewall_simple_oif"
@@ -290,19 +291,23 @@ case ${firewall_type} in
fi
fi
+ # define stuff we should never send out or receive in
# Stop RFC1918 nets on the outside interface
- ${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
- ${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
- ${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
+ ${fwcmd} table ${BAD_ADDR_TBL} flush
+ ${fwcmd} table ${BAD_ADDR_TBL} add 10.0.0.0/8
+ ${fwcmd} table ${BAD_ADDR_TBL} add 172.16.0.0/12
+ ${fwcmd} table ${BAD_ADDR_TBL} add 192.168.0.0/16
# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
- ${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
- ${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
- ${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
- ${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
- ${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
+ ${fwcmd} table ${BAD_ADDR_TBL} add 0.0.0.0/8
+ ${fwcmd} table ${BAD_ADDR_TBL} add 169.254.0.0/16
+ ${fwcmd} table ${BAD_ADDR_TBL} add 192.0.2.0/24
+ ${fwcmd} table ${BAD_ADDR_TBL} add 224.0.0.0/4
+ ${fwcmd} table ${BAD_ADDR_TBL} add 240.0.0.0/4
+
+ ${fwcmd} add deny all from any to "table($BAD_ADDR_TBL)" via ${oif}
# Network Address Translation. This rule is placed here deliberately
# so that it does not interfere with the surrounding address-checking
@@ -319,20 +324,7 @@ case ${firewall_type} in
;;
esac
- # Stop RFC1918 nets on the outside interface
- ${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
- ${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
- ${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}
-
- # Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
- # DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
- # on the outside interface
- ${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
- ${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
- ${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
- ${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
- ${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}
-
+ ${fwcmd} add deny all from "table($BAD_ADDR_TBL)" to any via ${oif}
if [ -n "$inet6" ]; then
# Stop unique local unicast address on the outside interface
${fwcmd} add deny all from fc00::/7 to any via ${oif6}
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
