ipfwでファイアーウォールを設定

さくらのVPSで標準OSをインストールした場合は、コントロールパネルからファイアーウォールの設定が可能です。
カスタムOSの場合は利用できませんのでファイアーウォールを構築する場合はOS標準のファイアーウォール機能かサードパティ製のファイアーウォール機能かを選択することになります。ファイアーウォールを構築することはセキュリティを強化するための手段です。

ipfwでファイアーウォールを設定

ファイアーウォールの種類

FreeBSDでは次の3つのファイアーウォールが利用できます。

1. pf
2. ipfw
3. ipf(ipfilter)

fa-check-square-oポイントここでは、簡単にファイアーウォールを構成するためipfwにしました。
ipfwは、カーネルロード可能モジュールとして基本的なFreeBSDインストールに含まれています。
ipfwを有効にするためにカスタムカーネルは必要ありません。

ファイアーウォールの構成

/etc/rc.confを編集します。

fa-check-square-oポイントviエディタなどで編集するよりは、sysrcコマンドを使用するのがおススメです。

ファイアーウォールを有効化

FreeBSDが提供するデフォルトのファイアウォールタイプの1つを使用するには、タイプを指定する別の行を追加します。

root@ik1-438-51137:~ # sysrc firewall_enable=YES
firewall_enable: NO -> YES

OS起動時に自動的にファイアーウォール機能(ipfw)が起動します。
また、serviceコマンドが使用できるようになります。

ファイアーウォールのタイプの選択

firewall_typeで設定します。どのタイプにするかで読み込まれるルールセットが異なります。
指定可能な値は次の表の通りです。

タイプごとのデフォルトのルールセットを調査しました。

firewall_type=open

root@ik1-438-51137:/etc # sysrc firewall_type=open
firewall_type: workstation -> open
root@ik1-438-51137:/etc # service ipfw restart
Flushed all rules.
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
65000 allow ip from any to any
Firewall rules loaded.
Firewall logging enabled.
root@ik1-438-51137:/etc # ipfw list
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
65000 allow ip from any to any
65535 deny ip from any to any

firewall_type=client

root@ik1-438-51137:/etc # sysrc firewall_type=client
firewall_type: open -> client
root@ik1-438-51137:/etc # service ipfw restart
Flushed all rules.
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
01100 allow ip from 192.0.2.0/24 to 255.255.255.255
01200 allow ip from me to 192.0.2.0/24
01300 allow ip from 192.0.2.0/24 to me
01400 allow tcp from any to any established
01500 allow ip from any to any frag
01600 allow tcp from any to me 25 setup
01700 allow tcp from me to any setup
01800 deny tcp from any to any setup
00000 allow udp from me to any 53 keep-state :default
00000 allow udp from me to any 123 keep-state :default
Firewall rules loaded.
Firewall logging enabled.
root@ik1-438-51137:/etc # ipfw list
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
01100 allow ip from 192.0.2.0/24 to 255.255.255.255
01200 allow ip from me to 192.0.2.0/24
01300 allow ip from 192.0.2.0/24 to me
01400 allow tcp from any to any established
01500 allow ip from any to any frag offset
01600 allow tcp from any to me 25 setup
01700 allow tcp from me to any setup
01800 deny tcp from any to any setup
01900 allow udp from me to any 53 keep-state :default
02000 allow udp from me to any 123 keep-state :default
65535 deny ip from any to any

firewall_type=simple

root@ik1-438-51137:/etc # sysrc firewall_type=simple
firewall_type: client -> simple
root@ik1-438-51137:/etc # service ipfw restart
Flushed all rules.
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
01100 deny ip from 192.0.2.16/28 to any in via ed0
01200 deny ip from 192.0.2.0/28 to any in via ed1
ipfw: failed to flush table 13 info: No such process
ipfw: DEPRECATED: inserting data into non-existent table 13. (auto-created)
added: 10.0.0.0/8 0
added: 172.16.0.0/12 0
added: 192.168.0.0/16 0
added: 0.0.0.0/8 0
added: 169.254.0.0/16 0
added: 192.0.2.0/24 0
added: 224.0.0.0/4 0
added: 240.0.0.0/4 0
00000 deny ip from any to table(13) via ed0
00000 deny ip from table(13) to any via ed0
01500 allow tcp from any to any established
01600 allow ip from any to any frag
01700 allow tcp from any to me 25 setup
01800 allow tcp from any to me 53 setup
01900 allow udp from any to me 53
02000 allow udp from me 53 to any
02100 allow tcp from any to me 80 setup
02200 deny log ip4 from any to any in via ed0 setup proto tcp
02300 allow tcp from any to any setup
00000 allow udp from me to any 53 keep-state :default
00000 allow udp from me to any 123 keep-state :default
Firewall rules loaded.
Firewall logging enabled.
root@ik1-438-51137:/etc # ipfw list
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
01100 deny ip from 192.0.2.16/28 to any in via em0
01200 deny ip from 192.0.2.0/28 to any in via em1
01300 deny ip from any to table(13) via em0
01400 deny ip from table(13) to any via em0
01500 allow tcp from any to any established
01600 allow ip from any to any frag offset
01700 allow tcp from any to me 25 setup
01800 allow tcp from any to me 53 setup
01900 allow udp from any to me 53
02000 allow udp from me 53 to any
02100 allow tcp from any to me 80 setup
02200 deny log ip4 from any to any in via em0 setup proto tcp
02300 allow tcp from any to any setup
02400 allow udp from me to any 53 keep-state :default
02500 allow udp from me to any 123 keep-state :default
65535 deny ip from any to any

firewall_type=close
[aside type=”warning”]リモート接続ができなくなります[/aside]

root@ik1-438-51137:~ # sysrc firewall_type=close
firewall_type: simple -> close
root@ik1-438-51137:~ # service ipfw restart
Flushed all rules.
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
Firewall rules loaded.
Firewall logging enabled.
root@ik1-438-51137:~ # ipfw list
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
65535 deny ip from any to any

firewall_type=workstation

root@ik1-438-51137:/etc # sysrc firewall_type=workstation
firewall_type: close -> workstation
root@ik1-438-51137:/etc # service ipfw restart
Flushed all rules.
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
00000 check-state :default
01200 allow tcp from me to any established
00000 allow tcp from me to any setup keep-state :default
00000 allow udp from me to any keep-state :default
00000 allow icmp from me to any keep-state :default
00000 allow ipv6-icmp from me to any keep-state :default
01700 allow udp from 0.0.0.0 68 to 255.255.255.255 67 out
01800 allow udp from any 67 to me 68 in
01900 allow udp from any 67 to 255.255.255.255 68 in
02000 allow udp from fe80::/10 to me 546 in
02100 allow icmp from any to any icmptypes 8
02200 allow ipv6-icmp from any to any icmp6types 128,129
02300 allow icmp from any to any icmptypes 3,4,11
02400 allow ipv6-icmp from any to any icmp6types 3
65000 count ip from any to any
65100 deny { tcp or udp } from any to any 135-139,445 in
65200 deny { tcp or udp } from any to any 1026,1027 in
65300 deny { tcp or udp } from any to any 1433,1434 in
65400 deny ip from any to 255.255.255.255
65500 deny ip from any to 224.0.0.0/24 in
65500 deny udp from any to any 520 in
65500 deny tcp from any 80,443 to any 1024-65535 in
65500 deny log logamount 500 ip from any to any
Firewall rules loaded.
Firewall logging enabled.
root@ik1-438-51137:/etc # ipfw list
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
01100 check-state :default
01200 allow tcp from me to any established
01300 allow tcp from me to any setup keep-state :default
01400 allow udp from me to any keep-state :default
01500 allow icmp from me to any keep-state :default
01600 allow ipv6-icmp from me to any keep-state :default
01700 allow udp from 0.0.0.0 68 to 255.255.255.255 67 out
01800 allow udp from any 67 to me 68 in
01900 allow udp from any 67 to 255.255.255.255 68 in
02000 allow udp from fe80::/10 to me 546 in
02100 allow icmp from any to any icmptypes 8
02200 allow ipv6-icmp from any to any icmp6types 128,129
02300 allow icmp from any to any icmptypes 3,4,11
02400 allow ipv6-icmp from any to any icmp6types 3
65000 count ip from any to any
65100 deny { tcp or udp } from any to any 135-139,445 in
65200 deny { tcp or udp } from any to any 1026,1027 in
65300 deny { tcp or udp } from any to any 1433,1434 in
65400 deny ip from any to 255.255.255.255
65500 deny ip from any to 224.0.0.0/24 in
65500 deny udp from any to any 520 in
65500 deny tcp from any 80,443 to any 1024-65535 in
65500 deny ip from any to any
65535 deny ip from any to any

firewall_type=UNKNOWN
[aside type=”warning”]リモート接続ができなくなります[/aside]

root@ik1-438-51137:~ # sysrc firewall_type=UNKNOWN
firewall_type: workstation -> UNKNOWN
root@ik1-438-51137:~ # service ipfw restart
Flushed all rules.
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
Firewall rules loaded.
Firewall logging enabled.
root@ik1-438-51137:~ # ipfw list
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
65535 deny ip from any to any

firewall_type=/etc/ipfw.rules
[aside type=”warning”]リモート接続ができなくなる可能性があります[/aside]

FreeBSDのマニュアルにある/etc/ipfw.rulesを作ってみました。
pifには実際のサーバーのインターフェース名(ifconfigの結果)を入力します。

#!/bin/sh
# Flush out the list before we begin.
ipfw -q -f flush

# Set rules command prefix
cmd="ipfw -q add"
pif="vtnet0"     # interface name of NIC attached to Internet
# Change xl0 to LAN NIC interface name
$cmd 00005 allow all from any to any via xl0

# No restrictions on Loopback Interface
$cmd 00010 allow all from any to any via lo0

$cmd 00101 check-state

# Allow access to public DNS
# Replace x.x.x.x with the IP address of a public DNS server
# and repeat for each DNS server in /etc/resolv.conf
$cmd 00110 allow tcp from any to 133.242.0.3 53 out via $pif setup keep-state
$cmd 00111 allow udp from any to 133.242.0.3 53 out via $pif keep-state

# Allow access to ISP's DHCP server for cable/DSL configurations.
# Use the first rule and check log for IP address.
# Then, uncomment the second rule, input the IP address, and delete the first rule
#$cmd 00120 allow log udp from any to any 67 out via $pif keep-state
#$cmd 00120 allow udp from any to x.x.x.x 67 out via $pif keep-state

# Allow outbound HTTP and HTTPS connections
$cmd 00200 allow tcp from any to any 80 out via $pif setup keep-state
$cmd 00220 allow tcp from any to any 443 out via $pif setup keep-state

# Allow outbound email connections
$cmd 00230 allow tcp from any to any 25 out via $pif setup keep-state
$cmd 00231 allow tcp from any to any 110 out via $pif setup keep-state

# Allow outbound ping
$cmd 00250 allow icmp from any to any out via $pif keep-state

# Allow outbound NTP
$cmd 00260 allow udp from any to any 123 out via $pif keep-state

# Allow outbound SSH
$cmd 00280 allow tcp from any to any 22 out via $pif setup keep-state

# deny and log all other outbound connections
$cmd 00299 deny log all from any to any out via $pif

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 00300 deny all from 192.168.0.0/16 to any in via $pif     #RFC 1918 private IP
$cmd 00301 deny all from 172.16.0.0/12 to any in via $pif      #RFC 1918 private IP
$cmd 00302 deny all from 10.0.0.0/8 to any in via $pif         #RFC 1918 private IP
$cmd 00303 deny all from 127.0.0.0/8 to any in via $pif        #loopback
$cmd 00304 deny all from 0.0.0.0/8 to any in via $pif          #loopback
$cmd 00305 deny all from 169.254.0.0/16 to any in via $pif     #DHCP auto-config
$cmd 00306 deny all from 192.0.2.0/24 to any in via $pif       #reserved for docs
$cmd 00307 deny all from 204.152.64.0/23 to any in via $pif    #Sun cluster interconnect
$cmd 00308 deny all from 224.0.0.0/3 to any in via $pif        #Class D & E multicast

# Deny public pings
$cmd 00310 deny icmp from any to any in via $pif

# Deny ident
$cmd 00315 deny tcp from any to any 113 in via $pif

# Deny all Netbios services.
$cmd 00320 deny tcp from any to any 137 in via $pif
$cmd 00321 deny tcp from any to any 138 in via $pif
$cmd 00322 deny tcp from any to any 139 in via $pif
$cmd 00323 deny tcp from any to any 81 in via $pif

# Deny fragments
$cmd 00330 deny all from any to any frag in via $pif

# Deny ACK packets that did not match the dynamic rule table
$cmd 00332 deny tcp from any to any established in via $pif

# Allow traffic from ISP's DHCP server.
# Replace x.x.x.x with the same IP address used in rule 00120.
#$cmd 00360 allow udp from any to x.x.x.x 67 in via $pif keep-state

# Allow HTTP and HTTPS connections to internal web server
$cmd 00400 allow tcp from any to me 80 in via $pif setup limit src-addr 2
$cmd 00400 allow tcp from any to me 443 in via $pif setup limit src-addr 2

# Allow inbound SSH connections
$cmd 00410 allow tcp from any to me 11022 in via $pif setup limit src-addr 2

# Reject and log all other incoming connections
$cmd 00499 deny log all from any to any in via $pif

# Everything else is denied and logged
$cmd 00999 deny log all from any to any

このルールファイルを指定します。

root@ik1-438-51137:~ # sysrc firewall_type=/etc/ipfw.rules
firewall_type: UNKNOWN -> /etc/ipfw.rules
root@ik1-316-18435:~ # service ipfw restart
Flushed all rules.
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
Line 3: bad command `ipfw'
Firewall rules loaded.

3行目でエラーになりそのあとのフィルターが追加されませんでした。
/etc/ipfw.rulesはスクリプトなのでそのまま実行してみます。
正常に実行できたようです。
※このスクリプトファイルはfirewall_typeに指定するとエラーになりますが、firewall_scriptに指定した場合は正常に動作します。

root@ik1-438-51137:~ # sh /etc/ipfw.rules
root@ik1-438-51137:~ # ipfw list
00005 allow ip from any to any via xl0
00010 allow ip from any to any via lo0
00101 check-state :default
00110 allow tcp from any to 133.242.0.3 53 out via vtnet0 setup keep-state :default
00111 allow udp from any to 133.242.0.3 53 out via vtnet0 keep-state :default
00200 allow tcp from any to any 80 out via vtnet0 setup keep-state :default
00220 allow tcp from any to any 443 out via vtnet0 setup keep-state :default
00230 allow tcp from any to any 25 out via vtnet0 setup keep-state :default
00231 allow tcp from any to any 110 out via vtnet0 setup keep-state :default
00250 allow icmp from any to any out via vtnet0 keep-state :default
00260 allow udp from any to any 123 out via vtnet0 keep-state :default
00280 allow tcp from any to any 22 out via vtnet0 setup keep-state :default
00299 deny log ip from any to any out via vtnet0
00300 deny ip from 192.168.0.0/16 to any in via vtnet0
00301 deny ip from 172.16.0.0/12 to any in via vtnet0
00302 deny ip from 10.0.0.0/8 to any in via vtnet0
00303 deny ip from 127.0.0.0/8 to any in via vtnet0
00304 deny ip from 0.0.0.0/8 to any in via vtnet0
00305 deny ip from 169.254.0.0/16 to any in via vtnet0
00306 deny ip from 192.0.2.0/24 to any in via vtnet0
00307 deny ip from 204.152.64.0/23 to any in via vtnet0
00308 deny ip from 224.0.0.0/3 to any in via vtnet0
00310 deny icmp from any to any in via vtnet0
00315 deny tcp from any to any 113 in via vtnet0
00320 deny tcp from any to any 137 in via vtnet0
00321 deny tcp from any to any 138 in via vtnet0
00322 deny tcp from any to any 139 in via vtnet0
00323 deny tcp from any to any 81 in via vtnet0
00330 deny ip from any to any frag offset in via vtnet0
00332 deny tcp from any to any established in via vtnet0
00400 allow tcp from any to me 80 in via vtnet0 setup limit src-addr 2 :default
00410 allow tcp from any to me 11022 in via vtnet0 setup limit src-addr 2 :default
00499 deny log ip from any to any in via vtnet0
00999 deny log ip from any to any
65535 deny ip from any to any

root@ik1-438-51137:~ # kenv -u net.inet.ip.fw.default_to_accept=1
net.inet.ip.fw.default_to_accept="1"

root@ik1-438-51137:~ # sysrc firewall_enable=YES
firewall_enable: NO -> YES

root@ik1-438-51137:~ # sysrc firewall_type=close
firewall_type: UNKNOWN -> close
root@ik1-438-51137:~ # service ipfw start
Flushed all rules.
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
Firewall rules loaded.

root@ik1-438-51137:~ # ipfw list
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
65535 allow ip from any to any

今回は、firewall_type=workstationにしました。

root@ik1-438-51137:~ # sysrc firewall_type=workstation
firewall_type: UNKNOWN -> workstation

ファイアーウォールスクリプトを指定(firewall_script)

firewall_scriptでカスタムスクリプトを指定します。
firewall_script=/etc/ipfw.rules

未定義の場合、デフォルトは/etc/rc.firewallを使用します。
firewall_typeがclientやsimpleの時は、rc.firewallの編集が必要です。
今回は/etc/rc.firewallを使うよう未定義(/etc/rc.confから削除)にしました。

サービスへの接続の許可

fa-check-square-oポイント/etc/rc.firewallスクリプトを使用している場合に有効です。

サービスポートまたはサービス名の許可(firewall_myservices)

サーバーとして稼働しているサービスのポート番号またはサービス名を設定します。
複数設定する場合は半角スペースで区切ります。
使用できるサービス名は/etc/servicesに登録されているサービス名です。
ここに記載したサービスのポート番号およびサービス名への接続が許可されます。
ただし、許可されるのはTCPのみです。
UDPを許可する場合は別途/etc/rc.firewallの編集が必要です。

次の例では、sshカスタムポート番号(11022)、http(80)とhttps(443)を許可しています。

root@ik1-438-51137:~ # sysrc firewall_myservices="11022 http https"
firewall_myservices:  -> 11022 http https

クライアントの許可(firewall_allowservices)

許可されたサービスへ接続できるクライアントの許可を設定します。
anyはすべてのクライアントがサービスに接続できることを意味しています。(from anyの部分）
any以外にはIPv4/IPv6のアドレスまたは範囲を指定します。

root@ik1-438-51137:~ # sysrc firewall_allowservices=any
firewall_allowservices:  -> any

firewall_myservicesとfirewall_allowservicesにより以下のルールが追加されます。

02500 allow tcp from any to me 11022
02600 allow tcp from any to me 80
02700 allow tcp from any to me 443

メッセージログの採取

firewall_logging=YESによりロギングを有効にしてもこれだけではipfwはログを記録しません。
ルールセット内のどのルールのログを記録したいかを決めてそのルールにlogキーワードを追加することでそのルールのログを記録します。
ようするにログに記録したいルールにlogオプションを記述して使用します。
一般的には、ルールセットの最後にすべてのアクセスに一致する拒否ルールを作成し、その拒否ルールをログに記録するように設定します。
こうすることでどのルールにも一致しないアクセスが判明します。
そのアクセスをコントロールするルールを追加することを検討します。

firewall_logdeny=YESにすることで拒否時に/var/log/securityにログメッセージを出力します。

IPFIREWALL_VERBOSE_LIMIT

このカーネルオプションは、特定のルールのパケットマッチングに関して、syslogdに送信される連続メッセージの数を制限します。
特定のルールに関する5つの連続したメッセージがsyslogdに記録され、残りの同一の連続したメッセージがカウントされ、last message repeated 45 timesのようにsyslogdに投稿されます。

root@ik1-438-51137:~ # cat /etc/syscont.conf
net.inet.ip.fw.verbose_limit=5

ファイアーウォールに関連するカーネルオプション

options    IPFIREWALL			# enables IPFW
options    IPFIREWALL_VERBOSE		# enables logging for rules with log keyword to syslogd(8)
options    IPFIREWALL_VERBOSE_LIMIT=5	# limits number of logged packets per-entry
options    IPFIREWALL_DEFAULT_TO_ACCEPT # sets default policy to pass what is not explicitly denied
options    IPFIREWALL_NAT		# enables basic in-kernel NAT support
options    LIBALIAS			# enables full in-kernel NAT support
options    IPFIREWALL_NAT64		# enables in-kernel NAT64 support
options    IPFIREWALL_NPTV6		# enables in-kernel IPv6 NPT support
options    IPFIREWALL_PMOD		# enables protocols modification module support
options    IPDIVERT			# enables NAT through natd(8)

さくらのVPSの場合

さくらのVPSだけかもしれませんが、ルーターのパケットが流れているようです。
このパケットが大量に流れているため、拒否してログに記録するとすぐにログメッセージを記録しなくなります。

HSRPのhelloパケット 224.0.0.2 　1985/UDP
HSRPのその他パケット、2029/UDP

ipfw: 65500 Deny UDP [fe80::c6f7:d5ff:fe62:797f]:2029 [ff02::66]:2029 in via vtnet0
ipfw: 999 Deny UDP 153.126.190.3:1985 224.0.0.102:1985 in via vtnet0

/etc/rc.firewallの3000番に許可ルールを追加しました。

${fwcmd} add 3000 allow udp from any to any 2029

その他の設定

以下のコマンドを実行すれば、/etc/rc.configのデフォルト設定を含め一覧が表示されます。

root@ik1-438-51137:~ # sysrc -A | grep firewall
firewall_allowservices:
firewall_client_net: 192.0.2.0/24
firewall_coscripts:
firewall_enable: YES
firewall_flags:
firewall_logdeny: NO
firewall_logging: NO
firewall_logif: NO
firewall_myservices:
firewall_nat64_enable: NO
firewall_nat_enable: NO
firewall_nat_flags:
firewall_nat_interface:
firewall_nologports: 135-139,445 1026,1027 1433,1434
firewall_nptv6_enable: NO
firewall_pmod_enable: NO
firewall_quiet: NO
firewall_script: /etc/ipfw.rules
firewall_simple_iif: em1
firewall_simple_inet: 192.0.2.16/28
firewall_simple_oif: em0
firewall_simple_onet: 192.0.2.0/28
firewall_trusted:
firewall_type: open

よく使うipfwコマンド

ipfw list

ipfw show

ipfw zero 番号

ipfw resetlog

/etc/rc.conf

firewall_enable="YES"
firewall_type="workstation"
firewall_myservices="11022 http https "
firewall_allowservices="any"
firewall_logdeny="YES"

ipfwの起動と再起動と停止

service ipfw start/restart/stop

パケットキャプチャーと解析

アクセスのあるパケットすべてを把握してそれぞれ許可拒否をコントールするにはまず、パケットのキャプチャーが必要です。
そしてそのキャプチャーしたパケットからルールセットを作りこむための解析作業です。

パケットキャプチャーにはtcpdumpが有名です。
このtcpdumpが出力したファイルを入力して解析に使用できるwiresharkがあります。
解析をするwiresharkはWindowsでも動作します。