laptop firewall rules

[Parv]

in message <7bbc4caf0510302012t7a0794cakc77353bd66c2d98a at mail.gmail.com>,
wrote Vitaly Cherny thusly...
>
> On 10/31/05, andy at neu.net <andy at neu.net> wrote:
> > Does anyone have a good example of a firewall ruleset for a wireless
> > interface in a laptop, or a pointer to documentation?  I want to use
> > IPFilter on 6.0 rc1.  I want to let all connections out and keep state,
> > but block all incoming from the outside.
> 
> To do this with ipfilter rather than ipfw, try these rules for your
> wireless interface (ath0 here):
> 
> pass out on ath0 proto tcp from any to any keep state
> pass out on ath0 proto udp from any to any port = domain keep state
> pass out on ath0 proto icmp from any to any keep state
> block out on ath0 all

Since ipf will use the last matched rule, will above not block all
outside access (unless you forgot to specify the "quick")?  See the
"FILTER RULES" section in ipf(5).

Above should be something like (substitute "<external-interface>" w/
actual one) ...

  pass in  quick on lo0  head 10
  pass out quick on lo0  head 15

  block in  on <external-interface> all
  block out on <external-interface> all
  pass out quick on <external-interface> proto tcp/udp from any to any keep state
  pass out quick on <external-interface> proto icmp from any to any keep state


... which can|should be further augmented; see ipf(5), ipftest(1),
and the ipfilter website.


  - Parv

--