A note on ipfwadm spoof package protection

I was studying how to set up firewall rules for ipfwadm Linux command. In the process, I found some sample codes in filtering spoofed packets. However, I can't agree with the code.

Here is the code:

EXTERNNET="172.160.50.0/24"; # Subnetted external segment
ipfwadm -I -p accept
ipfwadm -I -a deny -V $IFINTERN -S $EXTERNNET -o

I thought about it and I think the code is in error. First of all, you can't defined an EXTERNNET. The EXTERNNET should be anything that is not your internal segment. But the ipfwadm syntax do not allow you to specify a negate or the supplement set. To over come this in this code setting, we should first allow the internal subnet:

ipfwadm -I -a accept -V $IFINTERN -S $INTERNNET -o

Then denied all others:

ipfwadm -I -a deny -V $IFINTERN -S $ANYWHERE -o

Of cause, depend on other rules, the deny statement may have to be moved toward the end so not to interfere with other rules.

man page for ipautofw - FREESCO

I was working on setting up a Linux firewall for my home next work. I found the FREESCO distribution and installed without a problem. Even though this is my 2nd Linux box, I never really spend enough time to learn the Linux.

This time, I begin by trying to figure out how the firewall is initialized. Since the FREESCO 042 is based on Linux 2.0, I run into the problem that some of the man page is hard to find. After an afternoon on the Google, I found the man page for both
ipautofw and ipportfw. Both of them are at Debian.Org web site.

The man page for ipautofw is by Bartosz Feński at:
http://lists.debian.org/debian-l10n-english/2003/10/msg00012.html

The man page for ipportfw can be download from Debian's early release.

If anyone can convert the man page to html, it will be great appreciated.

+++++++++++++ begin ipautofw ++++++++++++++++++++++
.TH "ipautofw" "1" "980511" "Bartosz Fenski " "Executable programs or shell commands"
.SH NAME
ipautofw \- utility to automatically add masquerade entries.
.SH SYNOPSIS

.nf
.B ipautofw [\fIcommand\fP] [\fIoptions\fP]
.fi
.SH DESCRIPTION

\fBipautofw\fP allows Linux masquerading available in 2.0 series kernels
to work with programs such as RealAudio which don't send out a packet
on all ports they wish to receive on.

This program is useless for 2.2 and 2.4 series kernels.

.SH OPTIONS

The following commands and options are supported.
.
.SS Valid commands:
.TP 15
.B -A
add new autoforward entry.
.TP
.B -D
delete an autoforward entry.
.TP
.B -F
flush the autoforward table.
.PD
.SS Valid options:
.TP 15
.B -r \fItype\fP \fIlow\fP \fIhigh\fP
forwarding on ports \fIlow\fP to \fIhigh\fP using protocol \fItype\fP
(tcp or udp).
.TP
.B -h \fIhost\fP
IP address of \fIhost\fP to receive forwarded packets.
.TP
.B -d \fItype\fP \fIlow\fP \fIhigh\fP
specifies a set of ports which will not use the default high range (60000+)
masquerade port area.
.TP
.B -p \fItype\fP \fIvisible\fP \fIhost\fP:\fIhidden\fP
set up port bouncing from visible host port to masqueraded host \fIhost\fP on
port \fIhidden\fP, protocol \fItype\fP (currently not supported).
.TP
.B -c \fItype\fP \fIport\fP
specifies a control port and protocol.
.TP
.B -u
do \fBnot\fP require that a host connect within 15 seconds of triggering the
control port.
.TP
.B -i
insecure mode; any host many connect after implied by not using the -c option
or implied by using the -h option once the control port has been triggered.
.TP
.B -v
verbose mode.
.SH AUTHORS
\fBipautofw\fP has been written by Richard Lynch.
This man page was written by Bartosz Fenski  for the
Debian GNU/Linux distribution (but it may be used by others).
+++++++++++++ end ipautofw ++++++++++++++++++