Detections
Analytics

3.4.1.1 Ensure ipfw is enabled and configured

Information

The ipfw interface provides a new in-kernel packet classification framework that is based on a network-specific Virtual Machine (VM) and an ipfw userspace command line tool.

The ipfw interface reuses the existing dummynet subsystems such as the existing hook infrastructure, the connection tracking system, NAT, userspace queuing and logging subsystem.

The ipfw is a subsystem of the FreeBSD kernel that can protect against threats originating from within a corporate network to include malicious mobile code and poorly configured software on a host.

Solution

Run the following command to install and enable ipfw . The firewall profile workstation comes with sane and secure configurations for a single host.

# sysrc firewall_enable="YES"
# sysrc firewall_type="workstation"
# firewall_myservices+="22/tcp"
# firewall_allowservices="any"

This configuration will allow incoming connections on tcp port 22 or ssh from any IPv4 or IPv6 addresses.

If this is the first time configuration, and the system is on a remote location, it is best to reboot the system to load the kernel modules properly:

# reboot

Or in case new rules are added run the following commands to restart the ipfw service:

# service ipfw restart

For an example if we want to allow incoming traffic for tcp port 443 or https run the following commands:

# firewall_myservices+="443/tcp"
firewall_myservices: 22/tcp -> 22/tcp 443/tcp
# service ipfw restart
Flushed all rules.
00100 allow ip from any to any via lo0
00200 deny ip from any to 127.0.0.0/8
00300 deny ip from 127.0.0.0/8 to any
00400 deny ip from any to ::1
00500 deny ip from ::1 to any
00600 allow ipv6-icmp from :: to ff02::/16
00700 allow ipv6-icmp from fe80::/10 to fe80::/10
00800 allow ipv6-icmp from fe80::/10 to ff02::/16
00900 allow ipv6-icmp from any to any icmp6types 1
01000 allow ipv6-icmp from any to any icmp6types 2,135,136
00000 check-state :default
01200 allow tcp from me to any established
00000 allow tcp from me to any setup keep-state :default
00000 allow udp from me to any keep-state :default
00000 allow icmp from me to any keep-state :default
00000 allow ipv6-icmp from me to any keep-state :default
01700 allow udp from 0.0.0.0 68 to 255.255.255.255 67 out
01800 allow udp from any 67 to me 68 in
01900 allow udp from any 67 to 255.255.255.255 68 in
02000 allow udp from fe80::/10 to me 546 in
02100 allow icmp from any to any icmptypes 8
02200 allow ipv6-icmp from any to any icmp6types 128,129
02300 allow icmp from any to any icmptypes 3,4,11
02400 allow ipv6-icmp from any to any icmp6types 3
02600 allow tcp from any to me 22
02700 allow tcp from any to me 443
65000 count ip from any to any
65100 deny { tcp or udp } from any to any 135-139,445 in
65200 deny { tcp or udp } from any to any 1026,1027 in
65300 deny { tcp or udp } from any to any 1433,1434 in
65400 deny ip from any to 255.255.255.255
65500 deny ip from any to 224.0.0.0/24 in
65500 deny udp from any to any 520 in
65500 deny tcp from any 80,443 to any 1024-65535 in
65500 deny ip from any to any
Firewall rules loaded.

Impact:

Changing firewall settings while connected over the network can result in being locked out of the system.

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4

Plugin: Unix

Control ID: 9ec7803773d3b3f535b68ce7e5e68224875bc33ab5abc49123e71b1d72e4fa91