#
# SAMPLE: RESTRICTIVE FILTER RULES
#
# THIS EXAMPLE IS WRITTEN FOR IP FILTER 3.3
#
# ppp0 - (external) PPP connection to ISP, address a.b.c.d/32
#
# ed0 - (internal) network interface, address w.x.y.z/32
#
# This file contains the basic rules needed to construct a firewall for the
# above situation.
#
#-------------------------------------------------------
# *Nasty* packets we don't want to allow near us at all!
# short packets which are packets fragmented too short to be real.
#-------------------------------------------------------
# Group setup.
# ============
# By default, block and log everything. This maybe too much logging
# (especially for ed0) and needs to be further refined.
#
#-------------------------------------------------------
# Localhost packets.
# ==================
# interface should *NOT* exist.
# And of course, make sure the loopback allows packets to traverse it.
#-------------------------------------------------------
# Invalid Internet packets.
# =========================
#
# Deny reserved addresses.
#
#
# Prevent IP spoofing.
#
#
#-------------------------------------------------------
# Allow outgoing DNS requests (no named on firewall)
#
#
# If we were running named on the firewall and all internal hosts talked to
# it, we'd use the following:
#
#pass in quick proto udp from any to w.x.y.z/32 port = 53 keep state group 202
#pass out quick on ppp0 proto udp from a.b.c.d/32 to any port = 53 keep state
#
# Allow outgoing FTP from any internal host to any external FTP server.
#
#
# Allow NTP from any internal host to any external NTP server.
#
#
# Allow outgoing connections: SSH, TELNET, WWW
#
#
#-------------------------------------------------------
#
# Allow incoming to the external firewall interface: mail, WWW, DNS
#
#-------------------------------------------------------
# Log these:
# ==========
# * return RST packets for invalid SYN packets to help the other end close
# * return ICMP error packets for invalid UDP packets