#!/bin/sh
#### IPFW ruleset and initialization script
fwcmd="/sbin/ipfw add" # Firewall add command
ks="keep-state" # Bi-directional traffic between source and dest IPs
# DNS servers
edns=192.231.203.132 # Primary external DNS
edns1=192.231.203.3 # Secondary external DNS
# LAN variables (inside)
iif="bge0"
inet="10.0.0.0/24"
imask="255.255.255.0"
iip="10.0.0.1"
# WAN variables (outside)
oif="tun0"
oip="x.x.x.x"
onet="x.x.x.0"
omask="255.255.255.0"
# VPN variables (remote access to LAN)
vif="tun1"
vnet="10.0.9.0/24"
vmask="255.255.255.0"
vip="10.0.9.1"
# delete all rules
echo "Flushing all IPFW rules..."
ipfw -f flush
### Inclusive allow firewall rules
## Un-restricted interfaces/networks
$fwcmd allow all from any to any via $iif # Allow all packets for inside interface
$fwcmd allow all from any to any via lo0 # Allow all packets for local loopback
$fwcmd allow all from any to any via $vif # Allow all packets for VPN interface
# check the packet against the dynamic rules table
$fwcmd check-state
### Outbound
# Allow out DNS lookup from Internode ISP
$fwcmd allow tcp from any to $edns 53 out via $oif setup $ks # Primary
$fwcmd allow udp from any to $edns 53 out via $oif $ks
$fwcmd allow tcp from any to $edns1 53 out via $oif setup $ks # Secondary
$fwcmd allow udp from any to $edns1 53 out via $oif $ks
# Allow out non-secure and secure HTTP
$fwcmd allow tcp from any to any 80,443 out via $oif setup $ks
# Allow out send & get email function
$fwcmd allow tcp from any to any 25 out via $oif setup $ks
$fwcmd allow tcp from any to any 110 out via $oif setup $ks
# Allow out FBSD (make install & CVSUP) functions
# Basically give user root "GOD" privileges.
$fwcmd allow tcp from me to any out via $oif setup $ks uid root
# Allow out ping
$fwcmd allow icmp from any to any out via $oif $ks
# Allow out Time
$fwcmd allow tcp from any to any 37 out via $oif setup $ks
# Allow out insecure IMAP
$fwcmd allow tcp from any to any 143 out via $oif setup $ks
# Allow out insecure POP3
$fwcmd allow tcp from any to any 110 out via $oif setup $ks
# Allow out nntp news (i.e. news groups)
$fwcmd allow tcp from any to any 119 out via $oif setup $ks
# Allow out secure FTP, Telnet, and SCP
# This function is using SSH (secure shell)
$fwcmd allow tcp from any to any 22 out via $oif setup $ks
# Allow out whois
$fwcmd allow tcp from any to any 43 out via $oif setup $ks
# Allow out traceroute
$fwcmd allow icmp from any to any icmptypes 11 out via $oif
# Allow out outgoing for RDP
$fwcmd allow tcp from any to any 3389 out via $oif setup $ks
$fwcmd allow udp from any to any 3389 out via $oif $ks
# Allow out standard IRC ports
$fwcmd allow tcp from any to any 6667-7000 out via $oif setup $ks
# Allow out MSN Messenger
$fwcmd allow tcp from any to any 1863 out via $oif setup $ks
$fwcmd allow udp from any to any 1863 out via $oif $ks
$fwcmd allow tcp from any to any 6891-6900 out via $oif setup $ks
$fwcmd allow udp from any to any 6891-6900 out via $oif $ks
# Allow out jabber
$fwcmd allow tcp from any to any 5222 out via $oif setup $ks
$fwcmd allow tcp from any to any 5223 out via $oif setup $ks
# Allow out ICQ
$fwcmd allow tcp from any to any 5190 out via $oif setup $ks
# Allow out insecure FTP
$fwcmd allow tcp from any to any 21 out via $oif setup $ks
$fwcmd allow tcp from any to any 20 out via $oif setup $ks
$fwcmd allow tcp from any to any 49152-65535 $ks out xmit $oif
# Allow all out (temporary)
$fwcmd allow tcp from $inet to any out via $oif setup $ks
$fwcmd allow udp from $inet to any out via $oif $ks
# Deny and log everything else that is attempting to get out
# This rule enforces the block all by default logic
$fwcmd deny log all from any to any out via $oif
### Inbound Services
## EXPLICIT DENIES
# Deny all inbound traffic from non-routable reserved address spaces
$fwcmd deny all from 192.168.0.0/16 to any in via $oif #RFC 1918 private IP
$fwcmd deny all from 172.16.0.0/12 to any in via $oif #RFC 1918 private IP
$fwcmd deny all from 10.0.0.0/8 to any in via $oif #RFC 1918 private IP
$fwcmd deny all from 127.0.0.0/8 to any in via $oif #loopback
$fwcmd deny all from 0.0.0.0/8 to any in via $oif #loopback
$fwcmd deny all from 169.254.0.0/16 to any in via $oif #DHCP auto-config
$fwcmd deny all from 192.0.2.0/24 to any in via $oif #reserved for docs
$fwcmd deny all from 204.152.64.0/23 to any in via $oif #Sun cluster interconnect
$fwcmd deny all from 224.0.0.0/3 to any in via $oif #Class D & E multicast
# Deny ident
$fwcmd deny tcp from any to any 113 in via $oif
# Deny public pings
# $fwcmd deny icmp from any to any in via $oif
# Deny all Netbios service. 137=name, 138=datagram, 139=session
# Netbios is MS/Windows sharing services.
# Block MS/Windows hosts2 name server requests 81
$fwcmd deny tcp from any to any 137 in via $oif
$fwcmd deny tcp from any to any 138 in via $oif
$fwcmd deny tcp from any to any 139 in via $oif
$fwcmd deny tcp from any to any 81 in via $oif
# Deny any late arriving packets
$fwcmd deny all from any to any frag in via $oif
# Deny ACK packets that did not match the dynamic rule table
$fwcmd deny tcp from any to any established in via $oif
## EXCPLICIT ALLOWS
# Allow in ping
$fwcmd allow icmp from any to any in via $oif $ks
# Allow in standard VPN port for OpenVPN
$fwcmd allow udp from any to me 1194 in via $oif $ks
# Allow in standard www function for Apache httpd
$fwcmd allow tcp from any to me 80 in via $oif setup limit src-addr 64
# Allow in secure FTP, Telnet, and SCP from public Internet
$fwcmd allow tcp from any to me 22 in via $oif setup limit src-addr 16
# Allow in RDP
$fwcmd allow tcp from any to any 3389 in via $oif setup $ks
$fwcmd allow udp from any to any 3389 in via $oif $ks
# Allow in standard SMTP ports
$fwcmd allow tcp from any to me 25 in via $oif setup limit src-addr 8
$fwcmd allow tcp from any to me 587 in via $oif setup limit src-addr 8
# Allow in secure IMAPS
$fwcmd allow tcp from any to me 993 in via $oif setup $ks
# Allow in insecure POP
$fwcmd allow tcp from any to me 110 in via $oif setup limit src-addr 4
# Allow in insecure IMAP
$fwcmd allow tcp from any to me 143 in via $oif setup limit src-addr 16
# Allow in jabber from public Internet
$fwcmd allow tcp from any to me 5222 in via $oif setup $ks
$fwcmd allow tcp from any to me 5223 in via $oif setup $ks
$fwcmd allow tcp from any to me 5269 in via $oif setup $ks
# Allow in NTP from public Internet
$fwcmd allow udp from any to any 123 in via $oif
# Allow in Bit Torrent
$fwcmd allow log tcp from any to $inet 44000-44100 in via $oif setup $ks
$fwcmd allow udp from any to $inet 44000-44100 in via $oif $ks
# Allow in VNC and divert to ionataeus
#$fwcmd fwd 192.168.0.99,5900 tcp from any to any dst-port 5900
# --
### Everything else is denied by default
# Reject & Log all incoming connections from the outside that have no rule-match
$fwcmd deny log all from any to any in via $oif
# deny and log all packets that fell through to see what they are
$fwcmd deny log all from any to any