Forum Debian Users Gang

IPF="ipfw -q add"
ipfw -q -f flush

port1="1993"
port2="1994"

login_port="1992"
ssh_port="32122"

white_ip_ssh="xxx.xxx.xxx.xxx,yyy.yyy.yyy.yyy"
white_ip_sql="xxx.xxx.xxx.xxx,yyy.yyy.yyy.yyy"

inter="em0,lo0"

#loopback
$IPF 10 allow all from any to any via lo0
$IPF 20 deny all from any to 127.0.0.0/8
$IPF 30 deny all from 127.0.0.0/8 to any
$IPF 40 deny tcp from any to any frag

#nie wiem
$IPF 50 deny ip from any to any not antispoof in

#statefull
$IPF 60 check-state
$IPF 70 allow tcp from any to any established
$IPF 80 allow all from any to any out keep-state
$IPF 90 allow icmp from any to any icmptypes 0,3,8,11

#mysql, ssh
$IPF 100 allow tcp from $white_ip_sql to any 3306
$IPF 110 allow tcp from $white_ip_ssh to any $ssh_port

#login
$IPF 120 allow tcp from any to any $login_port in setup limit src-addr 5

#port1
$IPF 130 allow tcp from any to any $port1 in setup limit src-addr 10
$IPF 140 allow tcp from any to any $port1 out
#port2
$IPF 150 allow tcp from any to any $port2 in setup limit src-addr 10
$IPF 160 allow tcp from any to any $port2 out

#deny tcp flags
$IPF 250 deny tcp from any to any $port1 in tcpflags fin,rst,psh,urg recv $inter
$IPF 260 deny tcp from any to any $port2 in tcpflags fin,rst,psh,urg recv $inter

#log deny all
$IPF 310 deny log all from any to any