Skip to content

ipfw: Add option for firewall_type to be a directory #1828

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+111 −1
Open

ipfw: Add option for firewall_type to be a directory #1828

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5d8c0ea
ipfw: Add option for firewall_type to be a directory
thegushi Aug 28, 2025
46e2432
man: Document ipfw directory changes
thegushi Sep 11, 2025
44c6649
Apply suggestions from code review
thegushi Sep 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion libexec/rc/rc.firewall
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -547,7 +547,16 @@ case ${firewall_type} in
;;
*)
if [ -r "${firewall_type}" ]; then
${fwcmd} ${firewall_flags} ${firewall_type}
if [ -f "${firewall_type}" ]; then
${fwcmd} ${firewall_flags} ${firewall_type}
else
if [ -d "${firewall_type}" ]; then
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to update share/man/man5/rc.conf.5 to note that firewall_type can be a directory.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That I can do -- this change came out of the way we had modded this file to meet our needs, and obviously, we didn't tweak the docs for our own use. Coming shortly.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done (modulo some fighting with github)

for fwfile in `rcorder $firewall_type/*`
do
ipfw -q $fwfile;
done
fi
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The indentation looks wonky here, or is that just github rendering it incorrectly somehow?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I may have messed it up. The style in this file is odd -- things are indented with hard-tabs inside a function (but only sometimes?), but two-spaces inside a for loop? I had used a tab inside the for

Here's a screenshot in Nano with whitespace display turned on. (Also look at the function above this one)

image

But go look at the original file, it's just as weird and other than the "for" loop it's all hard tabs. This file is very inconsistent.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For context, here's the original file. Also tabs inside an if-block.

image

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I think this is fine then.

fi
fi
;;
esac
13 changes: 13 additions & 0 deletions share/examples/ipfw.d/final
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#
# PROVIDE: final
# REQUIRE: setup services outbound routing
#

#
add allow tcp from me to any out setup // default outbound

# silently ignore local multicast
add deny ip from any to 224.0.0.0/4 // drop multicast

# drop and log everything else
add reset log ip from any to any
11 changes: 11 additions & 0 deletions share/examples/ipfw.d/ntp_client
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# REQUIRE: outbound
# PROVIDE: ntp_client ntp_servers
# BEFORE: final

table ntp_servers create

# Uncomment and your NTP servers (if they are on known ips in your network) to the following table:

# table ntp_servers add x.x.x.x

add allow ip from me to table(ntp_servers) 123 keep-state // NTP outbound
6 changes: 6 additions & 0 deletions share/examples/ipfw.d/outbound
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
#
# REQUIRE: services
# PROVIDE: outbound
# BEFORE: final
#
# meta class - adds no rules
6 changes: 6 additions & 0 deletions share/examples/ipfw.d/routing
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
#
# REQUIRE: setup
# PROVIDE: routing
# BEFORE: services
#
# meta class - adds no rules
5 changes: 5 additions & 0 deletions share/examples/ipfw.d/services
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# REQUIRE: setup routing
# PROVIDE: services
# BEFORE: outbound
#
# meta class - adds no rules
47 changes: 47 additions & 0 deletions share/examples/ipfw.d/setup
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
#
# PROVIDE: setup blocked bogons
# BEFORE: services routing outbound final
#

# remove all existing tables
table all destroy
table blocked create

# standard (non-service specific) tables
table bogons create
table bogons add 0.0.0.0/8
table bogons add 10.0.0.0/8
table bogons add 172.12.0.0/12
table bogons add 192.168.0.0/16
table bogons add 169.254.0.0/16
table bogons add 240.0.0.0/4

# permit existing TCP sessions
add allow tcp from any to any established

# permit internal loopback traffic
add allow ip from any to any via lo0
add allow ip from any to any via lo1

# deny directed loopback traffic
add deny ip from any to 127.0.0.0/8 in
add deny ip from any to ::/64 in

# deny unexpected sources
add deny ip from table(bogons) to me in // unexpected sources

# deny explicitly disabled (non-persistent) sources
add deny ip from table(blocked) to me in // emergency (non-persistent) blocklist

# allow bsd-standard-port traceroutes
add allow udp from me to any 33434-33600 // traceroute in
add allow udp from any to me 33434-33600 // traceroute out
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer:

add unreach port udp from any to me dst-port 33434-33626

traceroute expects the host to return a destination port unreachable (ICMP type 3, code 3), by default starting on port $2^{15} + 666 = 33434$ and up to net.inet.ip.ttl (64 by default) hops, each with 3 probes by default ($33434 + 64 \times 3 = 33626$).


# moderately permissive ICMPv4
add allow icmp from any to any icmptypes 0,3,8,11,13,14 // safe ICMPv4

# link-local ICMPv6 (RS, RA, NS, NA) - per FreeBSD standard rules
add allow ipv6-icmp from :: to fe80::/10 // ICMPv6 DAD
add allow ipv6-icmp from fe80::/10 to fe80::/10 // ICMPv6 NDP
add allow ipv6-icmp from fe80::/10 to ff02::/16 // ICMPv6 NDP
add allow ipv6-icmp from any to any icmp6types 1,2,3,128,129,135,136 // safe ICMPv6
7 changes: 7 additions & 0 deletions share/examples/ipfw.d/ssh_service
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# REQUIRE: services
# PROVIDE: ssh_service ssh_clients
# BEFORE: outbound

table ssh_clients create

add allow tcp from table(ssh_clients) to me 22 in setup // inbound SSH
Loading