#!/bin/sh
## Boot Script for firewall
#
# thanks and acknowledgements for examples and explanations to 
# barijaona 
# (see http://homepage.mac.com/barijaona/macintosh/osxpb4.html)
# daniel co^te'
# (http://www3.sympatico.ca/dccote/firewall.html)
# Dru Lavigne
# (http://www.onlamp.com/pub/a/bsd/2001/04/25/FreeBSD_Basics.html)
# and brian hill 
# (see http://personalpages.tds.net/~brian_hill/brickhouse.html), 
# I recommend brian's brickhouse for purchase if you're going to 
# do a lot of firewall configuration, it's a great product
# 
# Also see 
# http://www.macdevcenter.com/pub/a/mac/2002/12/27/macosx_firewall.html
# for additional information
#
# Finally, ipfw uses the /subnet mask denotation for declaring network ranges
# For example, 152.2.0.0/16 is the same as 152.2.0.0 with a 255.255.0.0, the 
# /16 means that 16 bits of the 32 possible bits are masked.
# Basically, the smaller the /index, the larger the range of addresses encompassed
# This system is somewhat confusing to some folks, but there's a good online 
# subnet calculator you can use to figure out what ranges are covered 
# http://ccna.exampointers.com/subnet.htm

########
# Enable Logging
########
#
# Logged entries go into /var/log/system.log
# But there's no point in logging unless you're going to check the 
# entries. In this script, all deny are tagged with a log 

if [ `/usr/sbin/sysctl -n net.inet.ip.fw.verbose` == 0 ] ; then
        /usr/sbin/sysctl -w net.inet.ip.fw.verbose=1
fi

## To disable logging, comment out the above lines and uncomment the following:
# /usr/sbin/sysctl -w net.inet.ip.fw.verbose=0

# Purge existing rules, this blanks any existing rules
/sbin/ipfw -f flush

#Some standard services are listed, you can uncomment these
#to enable the service, or use them as examples to tailor your 
#machine's settings

########
# Localhost Settings
########

# Allow everything on the localhost (127.0.0.1)
# This way the machine can connect to itself via the localhost interface
# This also sets the start of the rule sequence

/sbin/ipfw -f add 00100 allow ip from any to any via lo0

# Now check for spoofing attacks via localhost, and deny them
# Also log the denial
/sbin/ipfw -f add 00110 deny log ip from 127.0.0.0/8 to any in
/sbin/ipfw -f add 00120 deny log ip from any to 127.0.0.0/8 in
/sbin/ipfw -f add 00130 deny log ip from 224.0.0.0/3 to any in
/sbin/ipfw -f add 00140 deny log tcp from any to 224.0.0.0/3 in

########
# Minimal Requirements
########
# First, tell ipfw to track states
# Also, I'm inserting a rule number here, since what I've set the rules
# for basic networking, and now I'm opening services.
# So by setting a new rule number here, I can create a block in the center
# where I can dynamically insert rules as needed to block bad guys
# with a blocker script such as TimeLox, see:
# http://wwwx.cs.unc.edu/~hays/dev/timelox_and_TheHand/
#
#
/sbin/ipfw -f add 25000 check-state

# Allow established connections
# This rule matches tcp packets that have the ack or rst bits set
# It shouldn't be needed for a stateful firewall, but 
# in practice with 10.3 I've found connections to be flaky
# if you don't use this, seems like the connection tracker
# times out too soon.
/sbin/ipfw -f add allow tcp from any to any established

# Allow all outbound, and tell ipfw to track state of outbound connections
/sbin/ipfw -f add allow tcp from any to any out setup keep-state

# Allow outbound icmp and udp
/sbin/ipfw -f add allow udp from any to any out keep-state
/sbin/ipfw -f add allow icmp from any to any out 

# DHCP Settings
# Shouldn't be needed since we're checking state, but left in the file in
# case anyone has problems. If you boot, and can't get an IP number, 
# try uncommenting this.
#
# Allow DHCP from any server
#/sbin/ipfw -f add allow udp from any 67 to any 68 in
# If you know what server you use for DHCP, you can refine this a bit,
# which reduces the chance of getting the wrong number. It also reduces 
# the chance of getting any number, especially if you are mobile.
# 1021 and 1022 are set up for computer science affiliates registered with our
# DHCP server.  
#/sbin/ipfw -f add allow udp from 152.2.131.228 67 to any 68 in
#/sbin/ipfw -f add allow udp from 152.2.131.227 67 to any 68 in
# If the above doesn't work, you might need to uncomment these
#/sbin/ipfw -f add allow udp from any 68 to 255.255.255.255 67 out 
#/sbin/ipfw -f add allow udp from any 67 to 255.255.255.255 68 in 

# DNS Settings
# Shouldn't be needed since we're checking state, but left in the file in
# case anyone has problems. If you boot, and can't get host or nslookup to 
# resolve names, try uncommenting this.
# This rule opens the firewall to any DNS server, so if you have a laptop that
# moves from network to network, this may be the best rule to use.
#/sbin/ipfw -f add allow udp from any 53 to any in
# These rules allow DNS only from known servers. The first two lines are the dns servers for CS.
# Users outside of CS should use the main unc servers, 152.2.21.1 and 152.2.253.100
#/sbin/ipfw -f add allow udp from 152.2.131.228 53 to any in 
#/sbin/ipfw -f add allow udp from 152.2.131.227 53 to any in
#/sbin/ipfw -f add allow udp from 152.2.21.1 53 to any in
#/sbin/ipfw -f add allow udp from 152.2.253.100 53 to any in

# NTP (Network Time)
# Again, this shouldn't be needed since we're tracking state, but 
# if you can't get a time server to work, uncomment this.
# This rule allows this machine to use any NTP server
# /sbin/ipfw -f add allow udp from any to any 123 in
# Or if you what the time server is, you can restrict it.
#/sbin/ipfw -f add allow udp from 152.2.21.1 to any 53 in

########
# ICMP
########

# If you want to allow anyone to ping you, or run a tracroute to you
# uncomment this
#/sbin/ipfw -f add allow icmp from any to any in

# ICMP settings, this rules allow ICMP from any of the main unc network ranges.
# Allow ICMP (ping and traceroute) from main unc hosts
# For unc folks this is a good way to limit it.
/sbin/ipfw -f add allow icmp from 152.2.0.0/16 to any in
/sbin/ipfw -f add allow icmp from 152.23.0.0/16 to any in 
/sbin/ipfw -f add allow icmp from 152.19.0.0/16 to any in

# Allow iperf from cs machines
# Most users won't run iperf, but this is here as an example. 
# Iperf is used to generate lots of network traffic to test throughput on 
# network connections. Use iperf with caution, it's a Denial of Service Attack
# just waiting to happen!
#/sbin/ipfw -f add allow tcp from 152.2.128.0/20 to any 5001

########
# Standard Services
########

# Don't open these unless you want to run the service.
# Also consider who would need access, for example, it's very unlikely 
# you'll need to allow ssh from the entire internet. But most
# folks want the web server wide open

# Allow ftp
# (BUT you shouldn't need to do this--if you enable remote login 
# in the preferences, you're turning on sftp as well as ssh, and 
# sftp is much more secure than ftp!)
#/sbin/ipfw -f add 3010 allow tcp from any to any 20-21 setup
# Allow active ftp clients to work. If the ftp server can't call back
# in, you can get an ftp connection.  
#/sbin/ipfw -f 3011 add allow tcp from any 20-21 to any 49152-65535 in via en0

# SSH
# Allow ssh from unc.edu hosts
/sbin/ipfw -f add allow tcp from 152.2.0.0/16 to any 22 keep-state setup
/sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 22 keep-state setup
/sbin/ipfw -f add allow tcp from 152.23.0.0/16 to any 22 keep-state setup

# HTTP and HTTPS
# Allow web service from anywhere, and track the state of the connection
#/sbin/ipfw -f add allow tcp from any to any 80 keep-state setup
#/sbin/ipfw -f add allow tcp from any to any 443 keep-state setup

# AFP
# Allow AppleShare File Sharing from UNC hosts
/sbin/ipfw -f add allow tcp from 152.2.0.0/16 to any 548 keep-state setup
/sbin/ipfw -f add allow tcp from 152.2.0.0/16 to any 427 keep-state setup
/sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 548 keep-state setup
/sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 427 keep-state setup
/sbin/ipfw -f add allow tcp from 152.23.0.0/16 to any 548 keep-state setup
/sbin/ipfw -f add allow tcp from 152.23.0.0/16 to any 427 keep-state setup

# Or, restrict to just CS
#/sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 548 keep-state setup
#/sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 427 keep-state setup

# Allow SMB/CIFS (windows networking) from unc hosts
/sbin/ipfw -f add allow tcp from 152.2.0.0/16 to any 139 keep-state setup
/sbin/ipfw -f add allow tcp from 152.19.0.0/16 to any 139 keep-state setup
/sbin/ipfw -f add allow tcp from 152.23.0.0/16 to any 139 keep-state setup
#Or just from cs.unc.edu hosts
#/sbin/ipfw -f add allow tcp from 152.2.128.0/20 to any 139 keep-state setup

# LDAP (in case you run an ldap server)
#/sbin/ipfw -f add  allow tcp from 152.2.128.0/20 to any 389 setup
#/sbin/ipfw -f add  allow udp from 152.2.128.0/20 to any 389 keep-state

# Retrospect Backups
# This example allows the cs backup server to back up this machine.
/sbin/ipfw -f add allow udp from 152.2.131.176 to any 497  
/sbin/ipfw -f add allow tcp from 152.2.131.176 to any 497 keep-state setup

# Quicktime Streaming Service 
# Allow QTSS from anywhere
#/sbin/ipfw -f add allow tcp from any to any 545 keep-state setup
# Allow RTSP from anywhere (part of QTSS)
#/sbin/ipfw -f add allow tcp from any to any 554 keep-state setup
# Allow UDP RTSP data
#/sbin/ipfw -f add allow udp from any to any keep-state 6970-6999

# Allow SWAT from cs.unc.edu
# SWAT is the samba configuration tool, if you don't know what that means, 
# you don't need to enable this.
#/sbin/ipfw -f add allow tcp from 152.2.128.0/20 to any 901 setup

# iTunes 
# Allow iTunes sharing from unc.edu addresses
#/sbin/ipfw -f add 4400 allow udp from 152.2.0.0/16 to any 3689 keep-state 
#/sbin/ipfw -f add 4410 allow udp from 152.19.0.0/16 to any 3689 keep-state 
#/sbin/ipfw -f add 4420 allow udp from 152.23.0.0/16 to any 3689 keep-state
#/sbin/ipfw -f add  allow tcp from 152.2.0.0/16 to any 3689 setup 
#/sbin/ipfw -f add  allow tcp from 152.19.0.0/16 to any 3689 setup 
#/sbin/ipfw -f add  allow tcp from 152.23.0.0/16 to any 3689 setup

# Allow Rendevous 
/sbin/ipfw -f add allow udp from any to any keep-state 5353

#######
# Closing up
#######
#
/sbin/ipfw -f add 65533 reject log udp from any to any in
#
# This should block all ip packets not matched by a prior rule. Anything 
# caught here gets logged.
/sbin/ipfw -f add 65534 deny log ip from any to any in

