## SafeFire Links

### v1.3a

# Packet Filter Guide and Reference

## Contents

1. Introduction
2. General concepts
3. Packet filter configuration
4. Rule description syntax
5. Sample rules

## Introduction

This document describes Packet Filter (PF) feature of SafeFire Links.

Following explanation assumes some knowledge of the basic principles of TCP/IP networking, i.e. what is an IP address, what is an IP protocol (service) and what is a TCP/UDP port number. Also, general understanding what is an IP packet and what is a packet header is required.

Return to Contents

## General Concepts

The packet filter is one of the main facilities for protection of an internal network from illegal access.

The main idea of the packet filter is quite simple. Each packet, which is going through PF has some specific information located in a packet header. PF compares this information with so called 'rules' contained in special database. Each rule contains set of matching parameters and declares an action (permit or deny). When an exact match is found the declared action is performed.

Set of matching parameters can include:

- Source address and source mask
- Destination address and destination mask
- Protocol type : IP, TCP, UDP, ICMP. IP means ALL packets.
- Direction (incoming, outgoing or both)
- Port number (only TCP and UDP packets)
- Special options for TCP packets

Return to Contents

## Configuration

SafeFire Links package contains several sample configurations. Different configurations may use up to three packet filters. Each filter is configured independently through appropriate section in configuration file.

- pre-NAT filter is placed before NAT engine and therefore it is able to filter out packets even before they will reach NAT engine. Unfortunately this filter can't separate packets by addresses in internal (protected) net because NAT engine makes it look like all the packets coming from one address.
  Configuration section for this filter is called [natfilter].

- Main Filter is placed behind NAT engine and it may process packets completely including internal addresses.
  Configuration section for this filter is called [filter].

- DoD (Dial-on-Demand) Filter is placed between DoD interface and other parts of SafeFire Links and its primary goal is to tune conditions of triggering DoD. Configuration section for this filter is called [dodfilter].

Each section consists of the following variables:

- enable

  This variable enables PF. By default PF is OFF. To enable it, set value of this variable to either 'on', '1' or 'true'.

  Because by default packet filter rejects all packets this is necessary to allow packets for particular service go through PF to/from protected net, two rules should be defined. One rule should cover outgoing packets with source in internal net while other should cover incoming packets with destination in the internal net. As an alternative bidirectional rules can be used.

  For example, following two rules will allow a connection to external SMTP servers (an internal net is assumed 192.168.xx.xx in this sample):

      allow tcp from 192.168.0.0:255.255.0.0 to any smtp out
      allow tcp from any smtp to 192.168.0.0:255.255.0.0

  A bidirectional equivalent for two rules above is:

      allow tcp from 192.168.0.0:255.255.0.0 to any smtp bidi

  NOTE:

  > A port range for an internal net side is not specified, because an outgoing connection can have any port number and it is maintained by the OS/2 TCP/IP stack.

- rule

  Each rule has a number which is an identifier for add/remove operations. The order in which rules will be checked out also defined by this number. The rule with smaller number will be checked first. You can assign numbers manually or let a system assign numbers automatically.

  If you do not assign numbers manually, all rules will be added in order which they are defined in configuration file or otherwise added.

  Each occurrence of 'rule' variable in configuration file defines one rule as in example below:

      [filter]
      enable = on
      rule = allow ip from 10.0.2/24 to any out
      rule = allow ip from any to 10.0.2/24 in

Return to Contents

## Rule description syntax

Each rule has the following syntax:

    [<number>] action [log] protocol source destination [extra[,...]]

where

- [<number>]

  optional rule number

- action

  allow accept permit | - | allow a packet to go through the packet filter
  deny drop | - | drop packet
  reject | - | drop packet and send ICMP UNREACH to the sender
  count | - | count packet matching rule and go to the next rule
  pipe | - | passes packet to the given stream of the output streampack. For details refer to Firewall Plugin. Piping mode document

- [log]

  optional flag that tells packet filter to print some information about matching packet to the SYSLOG facility.

- protocol

  ip, all | - | rule is for all types of protocols
  tcp | - | rule is for TCP packets only
  udp | - | rule is for UDP packets only
  icmp | - | rule is for ICMP packets only

- source information about origin of the packet
  destination information about destination of the packet

  source and destination clauses use similar syntax:

      keyword [not] addrdef portdef

  - keyword

    from | for the source clause
    to | for the destination clause

  - [not]

    reverses meaning of source mask, i.e. rule will be applied if packet has origin NOT falling to address/mask specified in this rule

  - addrdef

    defines address or range of addresses of the packet

    addrdef has the following syntax:

        {any|ip[{/bits|:mask}]}

    where

    any | - | packet can have any origin
    ip/bits ip:mask | - | these are two forms of description of source IP address and mask. Instead of IP address keyword MYIP can be used. This address will be automatically set to IP address assigned during PPP connection setup procedure
    ip | - | is IP address written in usual dot delimited form
    bits | - | specifies number of high bits in address which will be used for comparison
    mask | - | specifies a mask with which should be done logical AND operation before comparison

  - portdef

    defines a port or a set of ports which will be used for comparison

    portdef has the following syntax:

        [{port|port-port},[port],...]

    where

    port[,port] port-port | - | these are two forms of the specifying a source or destination port of a packet. First form can be used to specify up to 10 separate ports. Second form specifies inclusive range of ports.
    port | - | can be either a port number or a service name as described in the SERVICES file from the directory pointed by a ETC environment variable.

- extra

  extra is any combination of following:

  fragment | - | if this flag is specified then rule will be applied only to fragments of the packets NOTE: may not be used with ports, tcpflags or icmptypes (see below)
  in | - | match only incoming packets
  out | - | match only outgoing packets
  bidi | - | match both incoming and outgoing packets but swap from/to addresses and ports in rule before comparison of outgoing packet
  established | - | match packets belongs to established TCP connection
  setup | - | match packets belongs to TCP packets used as connection setup stage
  tcpflags [!]{syn|fin|rst|ack|psh|urg},... | - | matching TCP packet should have specified bits set (reset if '!' is present) NOTE: valid only in a TCP rule
  icmptypes (ICMP type decimal value),... | - | matching ICMP packet should have one of the specified types NOTE: valid only in an ICMP rule

Return to Contents

## Samples

Some sample rules are provided below. Note that there are no complete set of rules applicable for any configuration but these rules can be used as a starting point. Note that enable variable for appropriate filter should be set to on or yes. Special note for novices: as usual to encourage documentation study some samples intentionaly contain errors so beware and trust doc not samples.

- DoD filter
  This set of rules will fire up connection only on DNS lookup request or HTTP request effectively cutting off other activity. Additional rules can be added in similar way.

      [dodfilter]
      rule=allow udp from any to any 53 out
      rule=allow tcp from any to any 80 out

- "Stealth" computer
  This set of rules can be used on computer with NO active servers running. Note that in many cases it is needed to allow connections on 113 (IDENTD) port even in such an installations. Sample uses pre-NAT filter and intended for full (three filters) configuration.

      [natfilter]

      enable=yes

      ;allow traffic to outside
      rule=allow ip from any to any out

      ;allow packets to high port numbers used by client side connections
      rule=allow tcp from any to any 16000-65535 in
      rule=allow udp from any to any 16000-65535 in

      ;optionally allow IDENTD to work (uncomment rule)
      ;rule=allow tcp from any to any 113 bidi

      ;rest of traffic is not allowed by default if filter is enabled

- Sample bidirectional rules
  These rules shows use of BIDI rules (rather than pair of IN and OUT rules).

  Rules below allows users from outside world to connect HTTP server:

      rule=allow tcp from any to myip 80 in
      rule=allow tcp from myip 80 to any out

  It can be replaced with one equivalent BIDI rule:

      rule=allow tcp from any to myip 80 bidi

- Simple traffic accounting Rules below allows to do simple accounting of internal clients. Note allow rule at the end of set: it enables all traffic and assumes that protection from outside world is done in pre-NAT filter.

      [filter]
      enable=yes

      ;count incoming HTTP traffic for 1-st client
      rule=count all from any to 192.168.1.1 in

      ;count incoming HTTP traffic for 2-nd client
      rule=count tcp from any 80 to 192.168.1.2 in

      ;allow traffic to go through filter
      rule=65000 allow all from any to any

Return to documentation index | SafeFire Links (C) Link Guard Solutions 1999, 2000