Board index Solaris

ipfilter why does moving a rule break it?

ipfilter why does moving a rule break it?

Post by Pierre Girar » Sat, 18 Mar 2006 00:20:29



Hello,
     we wrote a simple rules file to allow only ssh in and we had
problem to make it work.  We finally realized that reordering some lines
  make it works but in our opinion it shouldn't make any difference.

Can anyone explain why this configuration works:

block in all
pass out on bge0 from any to any flags S keep state

pass in  on lo0 all
pass out on lo0 all

pass in on bge0 proto tcp from any to any port = 22 keep state

and this one doesn't:

block in all

pass in  on lo0 all
pass out on lo0 all

pass in on bge0 proto tcp from any to any port = 22 keep state

pass out on bge0 from any to any flags S keep state

We only moved the pass out rule from top to bottom and there aren't any
other out rules on the interface so according to the documentation it
shouldn't matter since it should be the only rule that matches and if it
matches in one case it should match in the other.

This is on solaris 10ga on x86 with the installed ipfilter.

ipf: IP Filter: v4.0.2 (592)
Kernel: IP Filter: v4.0.2
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 1

online         10:40:53 svc:/network/pfil:default
online         10:40:56 svc:/network/ipfilter:default

Thanks for your help.

 
 
 
Top

ipfilter why does moving a rule break it?

Post by Robert Lawhea » Sat, 18 Mar 2006 03:33:12



> Hello,
>     we wrote a simple rules file to allow only ssh in and we had problem
> to make it work.  We finally realized that reordering some lines  make
> it works but in our opinion it shouldn't make any difference.

> Can anyone explain why this configuration works:

> block in all
> pass out on bge0 from any to any flags S keep state

> pass in  on lo0 all
> pass out on lo0 all

> pass in on bge0 proto tcp from any to any port = 22 keep state

> and this one doesn't:

> block in all

> pass in  on lo0 all
> pass out on lo0 all

> pass in on bge0 proto tcp from any to any port = 22 keep state

> pass out on bge0 from any to any flags S keep state

> We only moved the pass out rule from top to bottom and there aren't any
> other out rules on the interface so according to the documentation it
> shouldn't matter since it should be the only rule that matches and if it
> matches in one case it should match in the other.

> This is on solaris 10ga on x86 with the installed ipfilter.

> ipf: IP Filter: v4.0.2 (592)
> Kernel: IP Filter: v4.0.2
> Running: yes
> Log Flags: 0 = none set
> Default: pass all, Logging: available
> Active list: 1

> online         10:40:53 svc:/network/pfil:default
> online         10:40:56 svc:/network/ipfilter:default

> Thanks for your help.

It might help if you refined your description of the problem
(including any relevant log entries), as well as the rules in
force when the failure occurs.  You can see the active rules
using the ipfstat -i and ipfstat -o commands.

 
 
 
Top

ipfilter why does moving a rule break it?

Post by Pierre Girar » Sat, 18 Mar 2006 05:30:50



> It might help if you refined your description of the problem
> (including any relevant log entries), as well as the rules in
> force when the failure occurs.  You can see the active rules
> using the ipfstat -i and ipfstat -o commands.

Actually the ipf command was* (and that caused ssh not to work).
  It seems we forgot to change the nsswitch.conf file to check files
before nis and the system was* on nis requests.
 
 
 
Top

1. ipfilter rule set..?

Hello:

I am a newbie to ipfilter and want to use it to control access to
my machine in office (SunBlade running Solaris-8).

I have written the following ruleset for ipfilter (incoming traffic
only) and I want unrestricted traffic from my machine to world. I
need help with this as outgoing traffic is being blocked
(telnet/ftp/smtp etc.)? Any pointers?

-ishwar
--------
#       IPfilter rules for Solaris-8 7/31/01
#  Allow ftp/telnet from mysubnet to host BUT unrestricted
#  access from host to outside world..
#
#  MYIPADR -- hostipaddress
#  MYSUBNET -- subnetipaddress
# local -- lo0
pass in quick on lo0 all

# address spoofing
block in quick on eri0 from 127.0.0.0/8 to any
block in quick on eri0 from MYIPADR to any

# ftp(20/21), ssh(22), telnet(23), smtp(25), http(80)
pass in quick on eri0 proto tcp from MYSUBNET to any port = 20
pass in quick on eri0 proto tcp from MYSUBNET to any port = 21
pass in quick on eri0 proto tcp from any to any port = 22
pass in quick on eri0 proto tcp from MYSUBNET to any port = 23
pass in quick on eri0 proto tcp from any to any port = 25
pass in quick on eri0 proto tcp from any to any port = 80

# dns??
pass in quick on eri0 proto udp from NAMSVR port = 53 to any

# others???
pass in quick on eri0 proto tcp from any to any port = 111
pass in quick on eri0 proto tcp from MYSUBNET port > 1023 to any
pass in quick on eri0 proto udp from MYSUBNET port > 1023 to any

# icmp
pass in quick on eri0 proto icmp from any to any

# deny the rest
block in log quick on eri0 all
---------

2. which distribution to use??

3. ipfilter rule set

4. How to keep up with OS5 patches and such

5. Converting ipchains rules to ipfilter, please!

6. RSH problem solaris 2.5

7. ipfiltering rules problem

8. Userland PPP and Windowmaker

9. ipfilter rule

10. IPFILTER NAT Rules

11. How to set FTP rule in IPFilter firewall on Solaris 8(x86)??

12. easy one...IPFilter rule to allow email through

13. ipfilter problem - "pass in" rules not active after boot


All times are UTC
Board index