### Firewall Rule Registering Script (without UDP Dynamic Matching) ###########
#                                                                             #
#  This script source is to define your firewall rule with IPFW with UDP      #
#  dynamic matching. You can use the following variables to define.           #
#                                                                             #
#  $IPFW        : IPFW command path with options                              #
#  $oif         : interface name for the Internet                             #
#  $oip         : IP address for the Internet                                 #
#  $iif         : interface name for your inside network                      #
#  $inet        : network address of your inside network                      #
#  $imask       : subnet mask of your inside network                          #
#  $fif         : interface name for Flet's Square network                    #
#  $fip         : IP address for Flet's Square network (if available)         #
#  $fnet        : network address of Flet's Square network                    #
#  $fmask       : subnet mask of Flet's Square network                        #
#  $ntpsv_ip    : IP address of NTP server you use                            #
#  $flag_fixedip: IF a fixed IP address specified to $oip, this variable      #
#                 will be "YES". This is useful for deciding whether          #
#                 bootp(DHCP) port should be open or not.                     #
#                                                                             #
#  Example: $IPFW add 10 allow udp from $ntpsv_ip ntp to $oip ntp in via $oif #
#                                                                             #
###############################################################################



# =============================================================================
# 1000-9999
# Protection from the diverse invalid packets
# -----------------------------------------------------------------------------
#  1. Anit Land Attack
#  2. Anti IP Spoofing
#  3. Priventation from passing the packets contain private IP address
#     through the gateway ("the gateway" means myself.)
#
#  The rules for 2 usually inhere in the rules for 3.
#  - You probaly use the area assigned as a private IP address as your
#    internal network. If so, the rule also serve as anti IP spoofing.
#    e.g. Your internal network is 192.168.0.0/24. Then the following
#    last 2 rules ("deny ip from any to 192.168.0.0/16" and the opposite
#    direction) also serve as anti IP spoofing.
# =============================================================================
#
# ----- 1. Anit Land Attack -----
$FWCMD add 1000 deny log ip from $oip to $oip via $oif
#
# ----- 2. 3. Anit IP Spoofing and Private IP address droping -----
case $inet in
  10.*)
    skip_spoofing_filter="1"
    ;;
  172.1[6-9].*)
    skip_spoofing_filter="2"
    ;;
  172.2[0-57-9].*)
    skip_spoofing_filter="2"
    ;;
  172.26.*)
    skip_spoofing_filter="2"
    fip=""
    ;;
  172.3[01].*)
    skip_spoofing_filter="2"
    ;;
  192.168.*)
    skip_spoofing_filter="3"
    ;;
esac
$FWCMD add 2000 deny log ip from any to 127.0.0.0/8 via $oif
$FWCMD add      deny log ip from 127.0.0.0/8 to any via $oif
$FWCMD add 2200 deny log ip from any to 10.0.0.0/8 via $oif
[ "$skip_spoofing_filter" = "1" ] && \
$FWCMD add      skipto 2500 ip from $inet:$imask to any out via $oif
$FWCMD add      deny log ip from 10.0.0.0/8 to any via $oif
$FWCMD add 2500 deny log ip from any to 172.16.0.0/12 via $oif
[ "$skip_spoofing_filter" = "2" ] && \
$FWCMD add      skipto 2800 ip from $inet:$imask to any out via $oif
$FWCMD add      deny log ip from 172.16.0.0/12 to any via $oif
$FWCMD add 2800 deny log ip from any to 192.168.0.0/16 via $oif
[ "$skip_spoofing_filter" = "3" ] && \
$FWCMD add      skipto 3100 ip from $inet:$imask to any out via $oif
$FWCMD add      deny log ip from 192.168.0.0/16 to any via $oif


# =============================================================================
# 10000-19999
# Allow all packet in the network which the gateway have managed
# -----------------------------------------------------------------------------
#  1. Allow all the packets flow within the inside network
#  2. Allow all the packets flow within the loopback
# =============================================================================
#
# ----- 1. Allow the packets from/to inside network -----
$FWCMD add 10000 allow ip from $inet:$imask to $inet:$imask via $iif
#
# ----- 2. Allow loopback -----
$FWCMD add       allow ip from any to any via lo0


# =============================================================================
# 20000-29999
# NAPT
#  - As a necessity, the rules also allow the accesses which are
#    from the inside hosts to the gateway(=me), and the opposite direction.
# -----------------------------------------------------------------------------
#  1. for download path
#  2. for upload path
# =============================================================================
#
# ----- 1. for download path -----
$FWCMD add 20000 divert natd \
                 ip from not $inet:$imask to $oip in via $oif
$FWCMD add       allow       \
                 ip from not $inet:$imask to $inet:$imask in via $oif
$FWCMD add       allow       \
                 ip from not $inet:$imask to $inet:$imask out via $iif
#
# ----- 2. for upload path -----
$FWCMD add 21000 allow       \
                 ip from $inet:$imask to not $inet:$imask in via $iif
$FWCMD add       divert natd \
                 ip from $inet:$imask to not $inet:$imask out via $oif
$FWCMD add       allow       \
                 ip from $oip         to not $inet:$imask out via $oif


# =============================================================================
# 30000-39999
# Allow the packets from outside for benefiting services the gateway proffer
# -----------------------------------------------------------------------------
#  1. At 1st, it should be allowed all the TCP packets that the connection
#     has already established
#  2. Then it should be allowed each protocol packet indivisually.
#     - The gateway now proffers following services.
#       WWW, FTP, SSH, MTA, MUA(POP3)
#  3. At last, allow some kinds of ICMP packets
#     - The gateway allows following messages.
#         For ping(0:Echo Request, 8:Echo Reply),
#         For traceroute(3:Destination Unreachable)
#       However, Outgoing 8(Echo Reply) is already allowed in the NAPT rule
#       for upload path.
# =============================================================================
#
# ----- 1. Allow the TCP established packets -----
$FWCMD add 30000 allow \
                 tcp from $oip to not $inet:$imask out via $oif established
$FWCMD add       allow \
                 tcp from not $inet:$imask to $oip in via $oif established
#
# ----- 2. Allow the packets some kind of protocol the gateway proffer
# >>> WWW
#$FWCMD add 31000 allow tcp from not $inet:$imask to $oip http in via $oif setup
#
# >>> WWW(secure)
#$FWCMD add       allow tcp from not $inet:$imask to $oip https \
#                 in via $oif setup
#
# >>> FTP
#$FWCMD add       allow tcp from not $inet:$imask to $oip ftp in via $oif setup
# (Permit passive connection)
#$FWCMD add       allow tcp from not $inet:$imask to $oip 60000-60019 \
#                 in via $oif setup
#
# >>> SSH
#$FWCMD add       allow tcp from not $inet:$imask to $oip ssh in via $oif setup
#
# >>> MTA
#$FWCMD add       allow tcp from not $inet:$imask to $oip smtp in via $oif setup
#
# >>> MUA(POP3)
#$FWCMD add       allow tcp from not $inet:$imask to $oip pop3 in via $oif setup
#
# ----- 3. Allow the some kinds ICMP packets  -----
$FWCMD add 39000 allow icmp from not $inet:$imask to $oip in via $oif \
                 icmptypes 8
#$FWCMD add       allow icmp from $oip to not $inet:$imask out via $oif \
#                 icmptypes 0,3


# =============================================================================
# 40000-49999
# Let the gateway access any outside hosts
#  - The following kinds of packets should be allow.
#     (1) TCP
#         Setup request, Established
#     (2) UDP
#         All Outgoing, All Returing except Well-Known ports,
#         Response from NTP server if specified,
#         And response from DHCP server
#     (3) ICMP
#         Some kinds
#    However, some kinds of packets are already allowed in the foregong rules.
# =============================================================================
#
# ----- TCP ----
#$FWCMD add       allow tcp from any to any via $oif established
#$FWCMD add       allow tcp from $oip to not $inet:$imask out via $oif setup
# (Allow the FTP active mode connection for the gateway)
$FWCMD add 40000 allow tcp from not $inet:$imask to $oip ftp\\-data \
                 in via $oif setup
#
# ----- UDP ----
$FWCMD add       allow udp from not $inet:$imask to $oip 1024-65535 in via $oif
if [ -n $ntpsv_ip ]; then
  $FWCMD add       allow udp from $ntpsv_ip ntp to $oip ntp in via $oif
fi
if [ \( "$flag_fixedip" != "YES" \) -a \( "${oif%%[0-9]}" != "tun" \) ]; then
  $FWCMD add       allow \
                   udp from not $inet:$imask bootps to $oip bootpc in via $oif
fi
#$FWCMD add       allow udp from $oip to not $inet:$imask out via $oif
#
# ----- ICMP ----
$FWCMD add       allow icmp from not $inet:$imask to $oip in via $oif \
                 icmptypes 0,3,11
#$FWCMD add       allow icmp from $oip to not $inet:$imask out via $oif


# =============================================================================
# 60000-64999
# Allow access to any Flet's square hosts (if available)
#  - This rule expects that PPP's NAPT implementation (ppp -nat) will do NAPT.
# -----------------------------------------------------------------------------
#  1-3. Protection from the diverse invalid packets
#  4-5. Allow some kinds of packets from the inside network or the gateway
#  - The following kinds of packets should be allow.
#     (1) TCP
#         Setup request, Established
#     (2) UDP
#         All Outgoing and Returning(when outgoing)
#     (3) ICMP
#         Some kinds
# =============================================================================
#
if [ -n "$fip" ]; then
# ----- 1. Anit Land Attack -----
$FWCMD add 60000 deny log ip from $fip to $fip via $fif
#
# ----- 2. 3. Anit IP Spoofing and Private IP address droping -----
$FWCMD add 61000 deny log ip from any to 127.0.0.0/8 via $fif
$FWCMD add       deny log ip from 127.0.0.0/8 to any via $fif
[ "$skip_spoofing_filter" = "1" ] && \
$FWCMD add 61200 skipto 61400 ip from any to $inet:$imask in via $fif
$FWCMD add 61300 deny log ip from any to 10.0.0.0/8 via $fif
[ "$skip_spoofing_filter" = "1" ] && \
$FWCMD add 61400 skipto 61600 ip from $inet:$imask to any out via $fif
$FWCMD add 61500 deny log ip from 10.0.0.0/8 to any via $fif
$FWCMD add 61600 skipto 61900 ip from any to $fnet:$fmask via $fif
[ "$skip_spoofing_filter" = "2" ] && \
$FWCMD add       skipto 61900 ip from any to $inet:$imask in via $fif
$FWCMD add       deny log ip from any to 172.16.0.0/12 via $fif
$FWCMD add 61900 skipto 62200 ip from $fnet:$fmask to any via $fif
[ "$skip_spoofing_filter" = "2" ] && \
$FWCMD add       skipto 62200 ip from $inet:$imask to any out via $fif
$FWCMD add       deny log ip from 172.16.0.0/12 to any via $fif
[ "$skip_spoofing_filter" = "3" ] && \
$FWCMD add 62200 skipto 62400 ip from any to $inet:$imask in via $fif
$FWCMD add 62300 deny log ip from any to 192.168.0.0/16 via $fif
[ "$skip_spoofing_filter" = "3" ] && \
$FWCMD add 62400 skipto 62600 ip from $inet:$imask to any out via $fif
$FWCMD add 62500 deny log ip from 192.168.0.0/16 to any via $fif
#
# ----- 4. Allow access from the inside network toany Flet's square hosts -----
# ----- TCP ----
$FWCMD add 62300 allow tcp from $inet:$imask to $fnet:$fmask \
                 out via $fif established
$FWCMD add       allow tcp from $fnet:$fmask to $inet:$imask \
                 in via $fif established
$FWCMD add       allow tcp from $inet:$imask to $fnet:$fmask out via $fif setup
# (Allow the FTP active mode connection for the gateway)
$FWCMD add       allow tcp from $fnet:$fmask to $inet:$imask ftp\\-data \
                 in via $fif setup
# ----- UDP ----
$FWCMD add       allow udp from $fnet:$fmask to $inet:$imask 1024-65535 \
                 in via $fif
$FWCMD add       allow udp from $inet:$imask to $fnet:$fmask out via $fif
# ----- ICMP ----
$FWCMD add       allow icmp from $fnet:$fmask to $inet:$imask in via $fif \
                 icmptypes 0,3,11
$FWCMD add       allow icmp from $inet:$imask to $fnet:$fmask out via $fif \
                 icmptypes 8
#
# ----- 5. Let the gateway access any Flet's square hosts -----
# ----- TCP ----
$FWCMD add       allow tcp from $fip to $fnet:$fmask out via $fif established
$FWCMD add       allow tcp from $fnet:$fmask to $fip in via $fif established
$FWCMD add       allow tcp from $fip to $fnet:$fmask out via $fif setup
# (Allow the FTP active mode connection for the gateway)
$FWCMD add       allow tcp from $fnet:$fmask to $fip ftp\\-data \
                 in via $fif setup
# ----- UDP ----
$FWCMD add       allow udp from $fnet:$fmask to $fip 1024-65535 in via $fif
$FWCMD add       allow udp from $fip to $fnet:$fmask out via $fif
# ----- ICMP ----
$FWCMD add       allow icmp from $fnet:$fmask to $fip in via $fif \
                 icmptypes 0,3,11
$FWCMD add       allow icmp from $fip to $fnet:$fmask out via $fif \
                 icmptypes 8
fi


# =============================================================================
# 65534
# Drop and Log the packets that have not corresponded the above any rules
# =============================================================================
#
$FWCMD add 65534 deny log logamount 5000 ip from any to any
