DOC 6501_Release V
ATS-6501 Users Guide
7
2.2.4 Firewall Settings
The system IP firewall has a default “allow all” policy. To enable the firewall, the customer
needs to create a firewall rules file on the product file system named
/mod/etc/firewall.rules
.
There are example firewall rules files on the product in the directory
/usr/tsc/site/firewall
.
Example rules files may be copied to the correct location and edited on the product using ‘vi’.
Once the rules file is setup, reboot the unit.
Note that misconfiguration of the firewall can lock out network access to the product. If that
occurs, the firewall may be disabled by using the USB command port adapter, and executing the
command
firewall --disable
. This removes the current firewall rules and resets it to immediately
allow all traffic exposing the device.
The firewall is the standard FreeBSD IPFW. Full documentation on the firewall configuration
may be found here:
http://www.freebsd.org/doc/en/books/handbook/firewalls-ipfw.html
The suggested hardened firewall rules are:
#!/bin/sh
cmd='/sbin/ipfw -q add'
/sbin/ipfw -q flush
#
# This example file demonstrates how to:
# . allow ssh (22) access from everywhere
# . allow ntp (123) access from everywhere
# . allow snmp (161) access from everywhere
#
#ensure the device can talk to itself.
$cmd pass all from any to any via lo0
#enable "stateful" firewall functionality
#this is required for TCP and UDP rules to associate
#a "state" (connection) with each rule
#
#without this, two-rules would need to be created
#for allowing access to each "port"
#for example:
# . pass tcp from somewhere to me dst-port 12345
# . pass tcp from me to somewhere src-port 12345
$cmd check-state
#allow the device to be a DHCP client
$cmd pass udp from me to any src-port 68 dst-port 67
$cmd pass udp from any to me src-port 67 dst-port 68
#allow the device to be a DNS client
$cmd pass udp from me to any dst-port 53 keep-state
# allow ICMP
$cmd pass icmp from any to any
#######################
#allow SSH from anywhere
$cmd pass tcp from any to me dst-port 22 keep-state