I have a 4.9 router that I decided I want to have a meaningful firewall with, so I have modified a copy of rc.firewall and would like someone to point out if I am doing something monumentally stupid.
I want to allow all from within my network, but only let in a few from the internet: DNS Email/imap-ssl(pop3-ssl in future) Ssh WWW And whatever natd redirects I have (remote desktop mainly). I definitely want to protect mysqld and only allow it from localhost or inside network. Here is what I have come up with so far (kernel built with default to deny): setup_loopback # set these to your network and netmask and ip net="192.168.1.0" mask="255.255.255.0" ip="192.168.1.1" # Allow any traffic to or from my own net. ${fwcmd} add pass all from ${ip} to ${net}:${mask} ${fwcmd} add pass all from ${net}:${mask} to ${ip} # Allow all out the world ${fwcmd} add pass all from ${ip} to any keep-state # Allow DNS queries out or in the world ${fwcmd} add pass all from any to any 53 keep-state # Allow email out or in the world ${fwcmd} add pass all from any to any 25 keep-state # Allow imap-ssl out or in the world ${fwcmd} add pass all from any to any 993 keep-state # Allow ssh out or in the world ${fwcmd} add pass all from any to any 22 keep-state # Allow www out or in the world ${fwcmd} add pass all from any to any 80 keep-state # Allow MSTSC in the world ${fwcmd} add pass all from any to any 5001 keep-state Any glaring mistakes on my part? TIA -Derrick _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"