Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 482
  • Last Modified:

firewall_enable="NO" and yet it starts off with all ports other than 25 and 22 firewalled

I've just got through my first ever 4.9 FreeBSD installation and have happily got apache13 and apache13_modssl up and running using ports (with some kind encouragement from EE). I'm at the point that I should let network traffic into the box on ports 80 and 443. As indicated in the start-up, only ports 25 and 22 are let in with the "moderate" firewall you get when you don't install a firewall.

Where is the firewalling for these two ports set up for the "moderate" firewall? I notice that /etc/defaults/rc.conf has firewall_enable="NO" and there is no override in /etc/rc.conf. Is there another mechanism for setting up firewalls that I ought to beware of?
3 Solutions
Mmmm.. normaly there is no firewall install in the basic installation.
You can look around in the /usr/local/etc if there is some '3party' firewall installed the config in normaly in this dir. In the /usr/local/etc/rc.d are the programs located that start in the start-up.
Wen apache is running and your go to http://<apache-servername> you should get the man-pages form Apache.

Check if Apache is running:
look for USERNAME www and COMMAND httpd
rstaveleyAuthor Commented:
I can run lynx http ://localhost and lynx https ://localhost on the server and connect to Apache just fine. I cannot do the same from any other PC on the LAN and yet I can connect to it by telneting into port 25 the SMTP port and I can also ssh into it (port 22).

In the initial kernel build there is an option to set up a security profile or to opt for "moderate" security...
Do you want to select a default security profile for this host (select No for "moderate" security)? ... No

There was a subsequent message saying that the SMTP and SSH ports would be the only ones accessible with moderate sucurity in place, so it is behaving as advertised. I was just wondering where the "moderate" firewall is set up which is blocking all other ports. I was wondering also if I need to build a kernel with a firewall to make those ports accessible, because the PC is protected by an external firewall anyhow and there is no reason for me to have FreeBSD block any of its ports.
IPFW is set up by /etc/rc.firewall
/etc/rc.conf just contains some pointers for that script, namely:

Single comment form /etc/rc.firewall
# Define the firewall type in /etc/rc.conf.  Valid values are:
#   open     - will allow anyone in
#   client   - will try to protect just this machine
#   simple   - will try to protect a whole network
#   closed   - totally disables IP services except via lo0 interface
#   UNKNOWN  - disables the loading of firewall rules.
#   filename - will load the rules in the given filename (full path required)
# For ``client'' and ``simple'' the entries below should be customized
# appropriately.

A fragment from /etc/defaults/rc.conf (settings you have to override )
firewall_enable="NO"            # Set to YES to enable firewall functionality
firewall_script="/etc/rc.firewall" # Which script to run to set up the firewall
firewall_type="UNKNOWN"         # Firewall type (see /etc/rc.firewall)
firewall_quiet="NO"             # Set to YES to suppress rule display
firewall_logging="NO"           # Set to YES to enable events logging
firewall_flags=""               # Flags passed to ipfw when type is a file

There is another firewall in base system - IPFilter, just like one in NetBSD, read "man 5 ipf", maybe you will like the this ruleset syntax a bit more
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

rstaveleyAuthor Commented:
I subsequently set up the firewall easily enough per the instructions at http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls.html, but I'm still curious to know where the "moderate" firewalling came from while ipfw support wasn't linked into the kernel.  

> There is another firewall in base system - IPFilter, just like one in NetBSD

Do you reckon it could have been using IPFilter before "proper" firewall support was linked into the kernel?
please post kldstat, to make sore no unnecessary modules are loaded.
but allowed localhost seems more like ipfw defaults
rstaveleyAuthor Commented:
Like I said the firewall is OK now. I was curious about the setup prior to enabling the firewall.

Here's the kldstat with firewalling implemented:
Id Refs Address    Size     Name
 1    3 0xc0100000 4445f0   kernel
 2    1 0xc0d92000 4000     logo_saver.ko
 3    1 0xc0d98000 15000    linux.ko

I am up and running OK, but I'll keep the question open for a little while in case anyone knows anything about the apparent firewall setup, when there is no firewalling support specified - i.e. where the configuration is set up when you specify "moderate" security in FreeBSD 4.9-RELEASE:

> Do you want to select a default security profile for this host (select No for "moderate" security)? ... No
You can use sysctl for some security options/settings.

Do a sysctl -a >> sysctl.settings and look through to see what the level of security is at, and any other possible settings.  You could also look into the /usr/src/sysctl.conf file to see if anything is placed there that could give you problems.

Fot the networking portion look through the "net." settings, such as seeing what "net.inet.ip.fw.enable" is set to; just be carefull about making any modifications to the sysctl settings without knowing what you are getting yourself into!

from /etc/rc.firewall
# $FreeBSD: src/etc/rc.firewall,v 1.47 2003/11/02 07:31:44 ru Exp $

        # Allow setup of incoming email
        ${fwcmd} add pass tcp from any to ${oip} 25 setup

        # Allow access to our DNS
        ${fwcmd} add pass tcp from any to ${oip} 53 setup
        ${fwcmd} add pass udp from any to ${oip} 53
        ${fwcmd} add pass udp from ${oip} 53 to any

        # Allow access to our WWW
        ${fwcmd} add pass tcp from any to ${oip} 80 setup
look for firewall_type in /etc/rc.conf and
... just add here more ports and it will start to work.
rstaveleyAuthor Commented:
I'll close the question now. This has been a bit inconclusive, because I haven't got to the bottom of where the moderate security settings come from and how it sets up the firewall in the absence of ipfw, which reports a socket error when you don't have firewall support linked into the kernel.

It may be the case that the information reported by kmckinstry's suggestion might shed some light, but I guess I don't really need to know. I am up and running with firewall support inked into the kernel and using the open firewall.

Many thanks for the contributions. I'll B grade this, so that it doesn't show up in the PAQ database as something which has a definitive answer, but I hope this doesn't come across as unappreciative.

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now