This document describes Packet Filter (PF) feature of SafeFire Links.
Following explanation assumes some knowledge of the basic principles of TCP/IP networking, i.e. what is an IP address, what is an IP protocol (service) and what is a TCP/UDP port number. Also, general understanding what is an IP packet and what is a packet header is required.
The packet filter is one of the main facilities for protection of an internal network from illegal access.
The main idea of the packet filter is quite simple. Each packet, which is going through PF has some specific information located in a packet header. PF compares this information with so called 'rules' contained in special database. Each rule contains set of matching parameters and declares an action (permit or deny). When an exact match is found the declared action is performed.
Set of matching parameters can include:
SafeFire Links package contains several sample configurations. Different configurations may use up to three packet filters. Each filter is configured independently through appropriate section in configuration file.
Each section consists of the following variables:
This variable enables PF. By default PF is OFF. To enable it, set value of this variable to either 'on', '1' or 'true'.
Because by default packet filter rejects all packets this is necessary to allow packets for particular service go through PF to/from protected net, two rules should be defined. One rule should cover outgoing packets with source in internal net while other should cover incoming packets with destination in the internal net. As an alternative bidirectional rules can be used.
For example, following two rules will allow a connection to external SMTP servers (an internal net is assumed 192.168.xx.xx in this sample):
allow tcp from 192.168.0.0:255.255.0.0 to any smtp out allow tcp from any smtp to 192.168.0.0:255.255.0.0A bidirectional equivalent for two rules above is:
allow tcp from 192.168.0.0:255.255.0.0 to any smtp bidi
NOTE:
A port range for an internal net side is not specified, because an outgoing connection can have any port number and it is maintained by the OS/2 TCP/IP stack.
Each rule has a number which is an identifier for add/remove operations. The order in which rules will be checked out also defined by this number. The rule with smaller number will be checked first. You can assign numbers manually or let a system assign numbers automatically.
If you do not assign numbers manually, all rules will be added in order which they are defined in configuration file or otherwise added.
Each occurrence of 'rule' variable in configuration file defines one rule as in example below:
[filter] enable = on rule = allow ip from 10.0.2/24 to any out rule = allow ip from any to 10.0.2/24 in
Each rule has the following syntax:
[<number>] action [log] protocol source destination [extra[,...]]
where
optional rule number
allow accept permit | - | allow a packet to go through the packet filter |
deny drop | - | drop packet |
reject | - | drop packet and send ICMP UNREACH to the sender |
count | - | count packet matching rule and go to the next rule |
pipe | - | passes packet to the given stream of the output streampack. For details refer to Firewall Plugin. Piping mode document |
optional flag that tells packet filter to print some information about matching packet to the SYSLOG facility.
ip, all | - | rule is for all types of protocols |
tcp | - | rule is for TCP packets only |
udp | - | rule is for UDP packets only |
icmp | - | rule is for ICMP packets only |
source and destination clauses use similar syntax:
keyword [not] addrdef portdef
from | for the source clause |
to | for the destination clause |
reverses meaning of source mask, i.e. rule will be applied if packet has origin NOT falling to address/mask specified in this rule
defines address or range of addresses of the packet
addrdef has the following syntax:
{any|ip[{/bits|:mask}]}
where
any | - | packet can have any origin |
ip/bits ip:mask | - | these are two forms of description of source IP address and mask. Instead of IP address keyword MYIP can be used. This address will be automatically set to IP address assigned during PPP connection setup procedure |
ip | - | is IP address written in usual dot delimited form |
bits | - | specifies number of high bits in address which will be used for comparison |
mask | - | specifies a mask with which should be done logical AND operation before comparison |
defines a port or a set of ports which will be used for comparison
portdef has the following syntax:
[{port|port-port},[port],...]
where
port[,port] port-port | - |
these are two forms of the specifying a source or destination
port of a packet. First form can be used to specify up to 10 separate ports. Second form specifies inclusive range of ports. |
port | - | can be either a port number or a service name as described in the SERVICES file from the directory pointed by a ETC environment variable. |
extra is any combination of following:
fragment | - | if this flag is specified then rule will be
applied only to fragments of the packets NOTE: may not be used with ports, tcpflags or icmptypes (see below) |
in | - | match only incoming packets |
out | - | match only outgoing packets |
bidi | - | match both incoming and outgoing packets but swap from/to addresses and ports in rule before comparison of outgoing packet |
established | - | match packets belongs to established TCP connection |
setup | - | match packets belongs to TCP packets used as connection setup stage |
tcpflags [!]{syn|fin|rst|ack|psh|urg},... | - | matching TCP packet should have specified bits set (reset if '!' is present) NOTE: valid only in a TCP rule |
icmptypes (ICMP type decimal value),... | - | matching ICMP packet should have one of the specified types NOTE: valid only in an ICMP rule |
Some sample rules are provided below. Note that there are no complete set of rules applicable for any configuration but these rules can be used as a starting point. Note that enable variable for appropriate filter should be set to on or yes. Special note for novices: as usual to encourage documentation study some samples intentionaly contain errors so beware and trust doc not samples.
[dodfilter] rule=allow udp from any to any 53 out rule=allow tcp from any to any 80 out
[natfilter] enable=yes ;allow traffic to outside rule=allow ip from any to any out ;allow packets to high port numbers used by client side connections rule=allow tcp from any to any 16000-65535 in rule=allow udp from any to any 16000-65535 in ;optionally allow IDENTD to work (uncomment rule) ;rule=allow tcp from any to any 113 bidi ;rest of traffic is not allowed by default if filter is enabled
Rules below allows users from outside world to connect HTTP server:
rule=allow tcp from any to myip 80 in rule=allow tcp from myip 80 to any outIt can be replaced with one equivalent BIDI rule:
rule=allow tcp from any to myip 80 bidi
[filter] enable=yes ;count incoming HTTP traffic for 1-st client rule=count all from any to 192.168.1.1 in ;count incoming HTTP traffic for 2-nd client rule=count tcp from any 80 to 192.168.1.2 in ;allow traffic to go through filter rule=65000 allow all from any to any
Return to documentation index | SafeFire Links (C) Link Guard Solutions 1999, 2000 |