#!/bin/sh
## Boot Script for firewall
#
# thanks and acknowledgements for examples and explanations to 
# barijaona 
# (see http://homepage.mac.com/barijaona/macintosh/osxpb4.html)
# daniel co^te'
# (http://www3.sympatico.ca/dccote/firewall.html)
# and brian hill 
# (see http://personalpages.tds.net/~brian_hill/brickhouse.html), 
# I recommend brian's brickhouse for purchase if you're going to 
# do a lot of firewall configuration, it's a great product
# 
# Also see http://www.macdevcenter.com/pub/a/mac/2002/12/27/macosx_firewall.html
# for additional information
#
# Finally, ipfw uses the /subnet mask denotation for declaring network ranges
# For example, 152.2.0.0/16 is the same as 152.2.0.0 with a 255.255.0.0, the 
# /16 means that 16 bits of the 32 possible bits are masked.
# Basically, the smaller the /index, the larger the range of addresses encompassed
# This system is somewhat confusing to some folks, but there's a good online 
# subnet calculator you can use to figure out what ranges are covered 
# http://ccna.exampointers.com/subnet.htm

########
# Enable Logging
########
#
# Logged entries go into /var/log/system.log
# But there's no point in logging unless you're going to check the 
# entries. In this script, all deny are tagged with a log 

#if [ `/usr/sbin/sysctl -n net.inet.ip.fw.verbose` == 0 ] ; then
#        /usr/sbin/sysctl -w net.inet.ip.fw.verbose=1
#fi

## To disable logging, use
# /usr/sbin/sysctl -w net.inet.ip.fw.verbose=0

# Purge existing rules
/sbin/ipfw -f flush

#Start with the default rules from Apple's configuration

#Some standard services are listed, you can uncomment these
#to enable the service, or use them as examples to tailor your 
#machine's settings


########
# Localhost Settings
########


# Allow everything on the localhost (127.0.0.1)
# This way the machine can connect to itself via the ethernet interface

/sbin/ipfw -f add 2000 allow ip from any to any via lo0

# Now check for spoofing attacks via localhost, and deny them
/sbin/ipfw -f add 02010 deny log ip from 127.0.0.0/8 to any in
/sbin/ipfw -f add 02020 deny log ip from any to 127.0.0.0/8 in
/sbin/ipfw -f add 02030 deny log ip from 224.0.0.0/3 to any in
/sbin/ipfw -f add 02040 deny log tcp from any to 224.0.0.0/3 in


########
# Meat and Potatos
########

# Allow all outbound.
# This means your machine can try to
# connect to any other machine out there
/sbin/ipfw -f add 02050 allow tcp from any to any out

# Allow all established connections
# Any connections already in progress can be continued. 
# (so you don't have to open all dynamic ports)
/sbin/ipfw -f add 02060 allow tcp from any to any established

########
# Network Related Rules to enable troubleshooting
########

# Allow ICMP (ping and traceroute)
/sbin/ipfw -f add 3000 allow icmp from any to any

########
# Standard Services
########

# Don't open these unless you want to run the service.
# Also consider who would need access, for example, it's very unlikely 
# you'll need to allow ssh from the entire internet. 

# Allow web service from anywhere
#/sbin/ipfw -f add 4000 allow tcp from any to any 80 setup

# Allow ftp
# (BUT you shouldn't need to do this--if you enable remote login 
# in the preferences, you're turning on sftp as well as ssh, and 
# sftp is much more secure than ftp!)
# /sbin/ipfw -f add 4010 allow tcp from any to any 20-21 setup

# Allow ssh from unc.edu hosts
/sbin/ipfw -f add 4020 allow tcp from 152.2.0.0/16 to any 22 setup
/sbin/ipfw -f add 4020 allow tcp from 152.19.0.0/16 to any 22 setup


# Allow AppleShare File Sharing from unc hosts
/sbin/ipfw -f add 4150 allow tcp from 152.2.0.0/16 to any 548 setup
/sbin/ipfw -f add 4150 allow tcp from 152.2.0.0/16 to any 427 setup
/sbin/ipfw -f add 4150 allow tcp from 152.19.0.0/16 to any 548 setup
/sbin/ipfw -f add 4150 allow tcp from 152.19.0.0/16 to any 427 setup

# Allow SMB/CIFS (windows networking) from unc hosts
/sbin/ipfw -f add 4100 allow tcp from 152.2.0.0/16 to any 139 setup
/sbin/ipfw -f add 4100 allow tcp from 152.19.0.0/16 to any 139 setup
#Or just from cs.unc.edu hosts
#/sbin/ipfw -f add 4100 allow tcp from 152.2.128.0/20 to any 139 setup

#######
# Closing up
#######

/sbin/ipfw -f add 60000 deny log tcp from any to any
/sbin/ipfw -f add 60010 allow ip from any to any