ipf: difference between any and all

xpucto · 02-02-2006, 11:41 AM

Hi!
I´m trying to define my ipf.conf. But I don´t see the difference between any and all.
For example, what does mean:

Code:

pass in quick proto tcp from ANY to any port = 22 keep state

and what does mean

Code:

pass in quick proto tcp from ALL to any port = 22 keep state

Well, I know that ALL means "all source IP address", but what is ANY then?

Thanks.

jlliagre · 02-02-2006, 02:30 PM

The correct syntax is "from any to any".
"all" is a synonym of the whole.

"from all" is a mistake.

xpucto · 02-03-2006, 03:17 AM

Thanks for your reply. I'll use ANY then... sounds abit less scaring than all!
I do not understand why they talk about the "ALL" keyword in the Sun docu though:
http://docs.sun.com/app/docs/doc/816...aoq0245?a=view

from/to/all/any

Matches any or all of the following: the source IP address, the destination IP address, and the port number. The all keyword is used to accept packets from all sources and to all destinations
Is there a mistake here or didn't I understand something correctly?

xpucto · 02-03-2006, 05:06 AM

Another question: is the "keep state" expression the equivalent to the "--state ESTABLISHED,RELATED" in linux?

If I write

Code:

pass in quick proto tcp from any to any port = 22 keep state

will I be abble to work with ssh AND scp?

Thanks

jlliagre · 02-03-2006, 07:07 AM

Quote:

Originally Posted by xpucto

Thanks for your reply. I'll use ANY then... sounds abit less scaring than all!
I do not understand why they talk about the "ALL" keyword in the Sun docu though:
http://docs.sun.com/app/docs/doc/816...aoq0245?a=view

from/to/all/any

Matches any or all of the following: the source IP address, the destination IP address, and the port number. The all keyword is used to accept packets from all sources and to all destinations
Is there a mistake here or didn't I understand something correctly?

Better to look at the manual page which is clear (man -s 4 ipf):

The all keyword is essentially a synonym for "from any to any" with no other match parameters.

jlliagre · 02-03-2006, 07:11 AM

Quote:

Originally Posted by xpucto

Another question: is the "keep state" expression the equivalent to the "--state ESTABLISHED,RELATED" in linux?

If I write

Code:

pass in quick proto tcp from any to any port = 22 keep state

will I be abble to work with ssh AND scp?

Thanks

I think so, but nothing is better than experimentation.

xpucto · 02-14-2006, 10:50 AM

I wrote

Quote:

pass in quick on bge0 proto tcp from any to any port = http flags S keep state group 100

pass in quick on bge0 proto tcp from any to any port = https flags S keep state group 100

in ipf.conf and doing

Quote:

ipf -Fa -f /etc/ipf/ipf.conf

I got the error message that http and https are unknown! Do I have to define them in some other file?
I took those lines from a tutorial but I aktually do not understand why it wasn't written:

Quote:

pass in quick on bge0 proto tcp from any to any port = 80 flags S keep state group 100

Is "port = 80" the equivalent of "port = http"?

jlliagre · 02-14-2006, 01:50 PM

Quote:

Originally Posted by xpucto

I got the error message that http and https are unknown!

True

Quote:

Do I have to define them in some other file?

Yes, the standard Unix file to define tcp and udp service names is /etc/services.
By default, http is not there, at least under Solaris.

Quote:

Is "port = 80" the equivalent of "port = http"?

Yes, after you declare what http means.

xpucto · 02-15-2006, 03:29 AM

Quote:

Originally Posted by jlliagre

Yes, the standard Unix file to define tcp and udp service names is /etc/services.
By default, http is not there, at least under Solaris.

Why is /etc/services (/etc/inet/services) in read-only modus actually?
It seems strange to me especially when such protocolls like http and htpps aren't listen in it.
Should I put it back into read-only modus?

xpucto · 02-15-2006, 03:54 AM

I corrected my ipf.conf this way:

Quote:

# block short packets which are packets fragmented too short to be real.
block in log quick all with short

# block and log inbound and outbound by default, group by destination
block in log on bge0 from any to any head 100
block out log on bge0 from any to any head 200

# web rules that get hit most often
pass in quick on bge0 proto tcp from any to any port = 80 flags S keep state group 100
pass in quick on bge0 proto tcp from any to any port = 443 flags S keep state group 100

# inbound traffic - ssh, auth
pass in quick on bge0 proto tcp from any to any port = 22 flags S keep state group 100
pass in log quick on bge0 proto tcp from any to any port = 113 flags S keep state group 100
pass in log quick on bge0 proto tcp from any port = 113 to any flags S keep state group 100

# outbound traffic - DNS, auth, NTP, ssh, WWW, smtp
pass out quick on bge0 proto tcp/udp from any to any port = domain flags S keep state group 200
pass in quick on bge0 proto udp from any port = domain to any group 100
pass out quick on bge0 proto tcp from any to any port = 113 flags S keep state group 200
pass out quick on bge0 proto tcp from any port = 113 to any flags S keep state group 200
pass out quick on bge0 proto udp from any to any port = ntp group 200
pass in quick on bge0 proto udp from any port = ntp to any port = ntp group 100
pass out quick on bge0 proto tcp from any to any port = ssh flags S keep state group 200
pass out quick on bge0 proto tcp from any to any port = 80 flags S keep state group 200
pass out quick on bge0 proto tcp from any to any port = 443 flags S keep state group 200
pass out quick on bge0 proto tcp from any to any port = smtp flags S keep state group 200

# pass icmp packets in and out
#pass in quick on bge0 proto icmp from any to any keep state group 100
#pass out quick on bge0 proto icmp from any to any keep state group 200

# block and ignore NETBIOS packets
block in quick on bge0 proto tcp from any to any port = 135 flags S keep state group 100
block in quick on bge0 proto tcp from any port = 137 to any flags S keep state group 100
block in quick on bge0 proto udp from any to any port = 137 group 100
block in quick on bge0 proto udp from any port = 137 to any group 100
block in quick on bge0 proto tcp from any port = 138 to any flags S keep state group 100
block in quick on bge0 proto udp from any port = 138 to any group 100
block in quick on bge0 proto tcp from any port = 139 to any flags S keep state group 100
block in quick on bge0 proto udp from any port = 139 to any group 100

This time I didn't get any error message, but then I can't connect through SSH anymore!
Why? Where is my mistake?

xpucto · 02-17-2006, 06:38 AM

Ok, I guess I should start a new thread because it's actually a new question.