src/etc/rc.firewall simple ${fw_pass} tcp from any to any established

[Giorgos Keramidas]

On 2006-11-11 17:08, "Julian H. Stacey" <jhs at flat.berklix.net> wrote:
> Hi security@ list,
> In my self written, large ipfw rule set, I had something that passed
> http to allow me to browse most but not all remote sites. For years
> I assumed the few sites I had difficulty with were cases pppoed MTU
> != 1500, from not having installed tcpmssd on my 4.*-RELEASE, but
> then running 6.1-RELEASE I realised that wasn't the problem.
>
> 	http://www.web.de		Still failed, &
> 	http://www.sueddeutsche.de	Was slow.
>
> I tried adding
>
> 	${fwcmd} add pass tcp from any to any established
>
> from src/etc/rc.firewall case - simple. Which solved it.
> But I was scared, not undertstand what the established bit did, &
> how easily an attacker might fake something, etc.
> I found adding these tighter rules instead worked for me
>
> 	${fwcmd} tcp from any http to me established in via tun0
> 	${fwcmd} tcp from me to any http established out via tun0
>
> Should I still be worrying about 	established ?

In general, I prefer stateful rulesets, which eliminate the need for
'established' rules.  This would be something like:

    ${fwcmd} check-state
    ${fwcmd} tcp from me to any http out via tun0 keep-state
    ${fwcmd} tcp from me to any ssh  out via tun0 keep-state
    [...]

This may create problems with connections whose entries time out before
something is received back from the other end, but IMHO this is much
better than the possibility of someone 'abusing' the 'established' check
to poke holes through the firewall ruleset.