Configuring IPFW firewalls on OS X Server 10.3

The gui server admin tool provided with the server version of OS X is quite good and will meet most users' needs. These notes cover some basic issues I've run across trying to use it.

The Apple way

If you're trying to do anything advanced, you definitely want to read the files in the /etc/ipfilter subdir. The basic way server deals with the firewall settings is to store them in a plist. Then when the server starts, it takes those data and used them to build the ipfw.conf.apple in /etc/ipfilter. It then applies that file to ipfw. Finally, it applies the rules in the ipfw.conf file to ipfw. So if you want to do anything complicated that you can't get working in the GUI, you can add those rules to the ipfw.conf file.

If you use the ipfw.conf file, tho, my suggestion is to use the the gui tool as little as possible. Rule order in ipfw is very important, and you can't really control that if you mix rules from both sources. So you're better off just building the whole firewall in the ipfw.conf file manually.

I did it myyyyyyy way....

The admin tool for OS X server is nice, but the firewalls it generates are a bit simple. They are fine for basic services, but since they don't track state, it's harder to get things like afs and kerberos working through them. Ipfw supports state tracking, but I haven't been able how to activate it through the admin tool.

Another approach is to use a script, just like you would with the client version, to build your own custom firewall. There's a gotcha with this, tho, in that if you run a script as described in the OS X client ipfw doc, you'll find that the script won't work if the firewall is turned off in the server admin tool--it seems that what happens is that when the admin tool has the firewall off, ipfw doesn't run at all.

What I'm currently doing (and it seems to work ok for me, but mileage varies) is setting up the server admin tool to run a minimal firewall with just the ssh and server admin tools enabled, and then also running a script that flushes all of the ipfw rules and builds the firewall the way I'd like. That way, I don't have to worry about any rule ordering problems encountered by concactenating multiple rules files, and if my script fails for whatever reason, the server is still locked down and open just enough that I can connect remotely to fix it.

For this to work, you need to make sure your script starts by flushing all of the firewall rules (which is a good idea anyway, so you can run the script as often as you like while you're testing things out). The command for this is ipfw flush, see firewall_2 for an example of it in use. Also, you'll need to make sure that the firewall script you provide runs after the server has set up it's firewall. Fortunately, that's easy. All you need to do is make a slight modification in the StartupParameters.plist file in the startupitems folder for your firewall script, so that the script waits until the server manager daemon has started, thusly:

{
Description = "firewall";
Provides = ("Firewall");
Requires = ("Network", "Server Manager Daemon");
OrderPreference = "None";
Messages =
   {
   start = "Starting NAT/firewall";
   stop = "Stopping NAT/firewall";
   };
}
The Server Manager Daemon is what starts the firewall up, so what happens is that the Server starts with the minimal firewall settings as set in the admin app, and then this your script runs overwriting all of the previous settings.