IPfilter

This is how to setup ipfilter in Solaris 10

1. Create configuration files in /etc/ipf and enable ipfilter service

# vi /etc/ipf/ippool.conf
table role=ipf type=tree number=10 { 0.0.0.0/8; 10.0.0.0/8; 127.0.0.0/8; 169.254.0.0/16; 172.16.0.0/12; 192.0.2.0/24; 192.168.0.0/16; 204.152.64.0/23; 224.0.0.0/3; };

# vi /etc/ipf/ipf.conf

#### set intercept_loopback false;
#set intercept_loopback true;

#### Let's define our interfaces, pools, networks and even hosts
#### see /etc/ipf/ippool.conf for the definition of $ext_pool and $forbidden_net
int1_if = "bge0";
int2_if = "bge1";
ext_if = "bge2";

int1_net = "1.2.3.0/25";
int2_net = "2.3.4.0/27";
ext_net = "4.5.6.0/27";

host1 = "1.2.3.1/32";
host2 = "2.3.4.2/32";
host3 = "4.5.6.3/32";

forbidden_net = "pool/10";

# This is the default rules - block everything
## Let's group in and out traffic in separate groups:
#### "in" - group 1, "out" - group 2
block in quick all head 1
block out quick all head 2

## Let's further divide firewall processing using groups:

#### GROUP 1 (in)
block in quick log first on $int1_if all head 10 group 1
block in quick log first on $int2_if all head 15 group 1
block in quick log first on $ext_if all head 20 group 1

#### GROUP 2 (out)
block out quick log first on $int1_if all head 30 group 2
block out quick log first on $int2_if all head 35 group 2
block out quick log first on $ext_if all head 40 group 2

## GROUP 10 (in on $int1_if)
#### Anti-spoofing
block in quick log first on $int1_if from $ext_net to any group 10
block in quick log first on $int1_if from $int2_net to any group 10

#### Minimum restrictions for internal interface
pass in quick log first proto tcp/udp from $int1_net to any keep state keep frags group 10
pass in quick log first proto icmp from $int1_net to any keep state keep frags group 10

## GROUP 15 (in on $hiteco_if)
#### Anti-spoofing
block in quick log first on $int2_if from $ext_net to any group 15
block in quick log first on $int2_if from $int1_net to any group 15

#### Minimum restrictions for internal interface
pass in quick log first proto tcp/udp from $int2_net to any keep state keep frags group 15
pass in quick log first proto icmp from $int2_net to any keep state keep frags group 15

## GROUP 20 (in on $ext_if)
#### Anti-spoofing
block in quick log first from $int_pool to any group 20
block in quick log first from $forbidden_net to any group 20

#### Allow icmp packets in for the machine but not the clients for now
pass in quick log first proto icmp from any to $ext_ip keep state keep frags group 20
#pass in quick log first proto icmp from any to $int_pool keep state keep frags group 20

#### SSH access
pass in quick log first proto tcp from $x_net to $int_pool port = 22 flags S keep state keep frags group 20

#### HTTP/HTTPS access
pass in quick log first proto tcp from any to $web_server port = 80 flags S keep state keep frags group 20
pass in quick log first proto tcp from any to $web_server port = 443 flags S keep state keep frags group 20

#### Mail Access
pass in quick log first proto tcp from any to $mail_pool port = 25 flags S keep state keep frags group 20
pass in quick log first proto tcp from any to $smb port = 110 flags S keep state keep frags group 20
pass in quick log first proto tcp from any to $smb port = 143 flags S keep state keep frags group 20
pass in quick log first proto tcp from any to $mail_pool port = 993 flags S keep state keep frags group 20
pass in quick log first proto tcp from any to $mail_pool port = 995 flags S keep state keep frags group 20

#### DNS Access
pass in quick log first proto udp from any to $smb port = 53 keep state keep frags group 20
pass in quick log first proto tcp from $dns_peers to $smb port = 53 flags S keep state keep frags group 20


## GROUP 30 (out on $int1_if)
#### Minimum restrictions for internal interface
pass out quick log first proto tcp/udp from any to $int1_net keep state keep frags group 30
pass out quick log first proto icmp from any to $int1_net keep state keep frags group 30

## GROUP 35 (out on $int2_if)
#### Minimum restrictions for internal interface
pass out quick log first proto tcp/udp from any to $int2_net keep state keep frags group 35
pass out quick log first proto icmp from any to $int2_net keep state keep frags group 35

## GROUP 40 (out on $ext_if)

#### Let clients behind the firewall send out to the Internet and keep state
pass out quick log first proto tcp from $int_pool to any flags S keep state keep frags group 40
pass out quick log first proto udp from $int_pool to any port = 123 keep state keep frags group 40

pass out quick log first proto icmp from $int_pool to any keep state keep frags group 40

#### Let this machine to send out packets as well
pass out quick log first proto tcp from $ext_ip to any flags S keep state keep frags group 40
pass out quick log first proto udp from $ext_ip to any port = 123 keep state keep frags group 40
pass out quick log first proto icmp from $ext_ip to any keep state keep frags group 40


# vi /etc/ipf/ipnat.conf
#### Let's define our interfaces
int_if = "bge0";
ext_if = "bge2";

#### Address MAP section

map $ext_if 10.1.1.6/32 -> 4.5.6.2/32
map $ext_if 10.1.1.17/32 -> 4.5.6.3/32
map $ext_if 10.1.1.22/32 -> 4.5.6.4/32

#### nat rules first match
map $ext_if 10.1.1.0/24 -> 4.5.6.1/32

#### Ports Redirection Section

rdr $ext_if 4.5.6.2/32 port 22 -> 10.1.1.6 port 22 tcp
rdr $ext_if 4.5.6.2/32 port 80 -> 10.1.1.16 port 80 tcp
rdr $ext_if 4.5.6.3/32 port 443 -> 10.1.1.17 port 443 tcp
rdr $ext_if 4.5.6.4/32 port 8980 -> 10.1.1.22 port 8980 tcp

# vi /lib/svc/method/ipfilter

load_ipf() {

# Increase the state table size fr_statesize to 100003 from 5737
# (must be prime number) and fr_statemax from 4013 to 70000
# (should be 0.7 * fr_statesize)
        ipf -T fr_statemax=70000
        ipf -D -T fr_statesize=100003 -E

# routeadm -e ipv4-forwarding -u
# svcadm enable ipfilter

# ipf -T fr_statemax=70000
# ipf -D -T fr_statesize=100003 -E

# ippool -l /etc/ipf/ippool.conf
# ipf -n -f /etc/ipf/ipf.conf
# ipf -Fa -f /etc/ipf/ipf.conf

# vi /etc/syslog.conf
local0.info                     /var/log/ipmon.log

# vi /etc/logadm/conf
/var/log/ipmon.log -C 30 -a 'kill -HUP `cat /var/run/syslog.pid`' -p 1d -s 1b -z 0