keep-state and divert

[Victor Sudakov]

Michael Powell wrote:
> > 
> > I have read some recommendations on combining a stateful firewall with
> > divert, e.g.
> > http://www.derkeiler.com/Mailing-Lists/FreeBSD-Security/2003-06/0078.html
> > and http://nuclight.livejournal.com/124348.html (the latter is in
> > Russian).
> > 
> > Do I understand correctly that it is (mathematically?) impossible to
> > use the two together without also using "skipto"?

[dd]

> 
> I haven't used ipfw for a very long time, and haven't kept current with any 
> changes. Below is an example (using kernel pppd) that I used to use a long 
> time ago. For example purposes only, extract what you need for your specific 
> configuration needs.

I have looked at your ruleset. First you have:

[dd]
> $fwcmd add divert natd ip from any to me in via ppp0
> $fwcmd add divert natd ip from 10.10.0.0/8 to any out via ppp0
> $fwcmd add check-state
> 

[dd]

and only later you have your keep-state rules:

> 
> $fwcmd add allow udp from any to any via ppp0 keep-state
> $fwcmd add allow log icmp from any to any icmptypes 3,4
> 
> $fwcmd add allow tcp from any to me 80 via ppp0 keep-state
> 
> $fwcmd add deny log tcp from any to any in recv ppp0 setup
> $fwcmd add allow tcp from any to any out xmit ppp0 setup keep-state
> $fwcmd add allow tcp from any to any via ppp0 established keep-state

This means your dynamic rules will contain an already NAT-ted address,
which is useless.

With my example ruleset below, where would you put the keep-state
option?


00100 divert 8668 ip from any to table(1) out via rl0
00200 deny log logamount 100 ip from 10.0.0.0/8 to any out via rl0
00300 deny log logamount 100 ip from 172.16.0.0/12 to any out via rl0
00400 deny log logamount 100 ip from 192.168.0.0/16 to any out via rl0

00500 divert 8668 ip from table(1) to any in via rl0
00600 check-state
00700 deny log logamount 100 ip from any to 10.0.0.0/8 in via rl0
00800 deny log logamount 100 ip from any to 172.16.0.0/12 in via rl0
00900 deny log logamount 100 ip from any to 192.168.0.0/16 in via rl0

65535 allow ip from any to any


-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
sip:sudakov at sibptus.tomsk.ru