diff options
| author | dm <dm@cvs.openbsd.org> | 1996-01-09 09:29:53 +0000 |
|---|---|---|
| committer | dm <dm@cvs.openbsd.org> | 1996-01-09 09:29:53 +0000 |
| commit | 580705fd00c4c825c1b4c8f99a3b5e13b1ca7334 (patch) | |
| tree | a57a5d4077ccee71d613431cdc380a9bc86ff960 /share/ipf/example.13 | |
| parent | 62bcfe4fb97a3c16cd569d6957f3cd6e9b73e8a1 (diff) | |
added IP filter to netstat/rc and put examples in /usr/share/ipf
Diffstat (limited to 'share/ipf/example.13')
| -rw-r--r-- | share/ipf/example.13 | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/share/ipf/example.13 b/share/ipf/example.13 new file mode 100644 index 00000000000..c4c1994030b --- /dev/null +++ b/share/ipf/example.13 @@ -0,0 +1,61 @@ +# +# log all inbound packet on le0 which has IP options present +# +log in on le0 from any to any with ipopts +# +# block any inbound packets on le0 which are fragmented and "too short" to +# do any meaningful comparison on. This actually only applies to TCP +# packets which can be missing the flags/ports (depending on which part +# of the fragment you see). +# +block in log quick on le0 from any to any with short frag +# +# log all inbound TCP packets with the SYN flag (only) set +# (NOTE: if it were an inbound TCP packet with the SYN flag set and it +# had IP options present, this rule and the above would cause it +# to be logged twice). +# +log in on le0 proto tcp from any to any flags S/SA +# +# block and log any inbound ICMP unreachables +# +block in log on le0 proto icmp from any to any icmp-type unreach +# +# block and log any inbound UDP packets on le0 which are going to port 2049 +# (the NFS port). +# +block in log on le0 proto udp from any to any port = 2049 +# +# quickly allow any packets to/from a particular pair of hosts +# +pass in quick from any to 10.1.3.2/32 +pass in quick from any to 10.1.0.13/32 +pass in quick from 10.1.3.2/32 to any +pass in quick from 10.1.0.13/32 to any +# +# block (and stop matching) any packet with IP options present. +# +block in quick on le0 from any to any with ipopts +# +# allow any packet through +# +pass in from any to any +# +# block any inbound UDP packets destined for these subnets. +# +block in on le0 proto udp from any to 10.1.3.0/24 +block in on le0 proto udp from any to 10.1.1.0/24 +block in on le0 proto udp from any to 10.1.2.0/24 +# +# block any inbound TCP packets with only the SYN flag set that are +# destined for these subnets. +# +block in on le0 proto tcp from any to 10.1.3.0/24 flags S/SA +block in on le0 proto tcp from any to 10.1.2.0/24 flags S/SA +block in on le0 proto tcp from any to 10.1.1.0/24 flags S/SA +# +# block any inbound ICMP packets destined for these subnets. +# +block in on le0 proto icmp from any to 10.1.3.0/24 +block in on le0 proto icmp from any to 10.1.1.0/24 +block in on le0 proto icmp from any to 10.1.2.0/24 |