I finished the filter (thanks to your tip) and it appears
to work well.
The following filter allows access only for:
1. Our web server (port 80)
2. Our ftp server (port 21, 20, gt1023)
3. Our POP3 server (port 110)
It is not thoroughly tested (only by me over the weekend).
This filter system is composed of a .in and .out filter that
is applied to the user level.
I have not tested it at a port level or the ether0 level.
If anyone finds a redundancy or possible error, please contact me
so I can correct it.
In this example, the server addresses are as follows:
192.0.21.25....... mail server
192.0.21.20....... ftp server * and* the web server
Most of the syntax was copied from Livingston's web page on filtering.
Unknown relationships:
a. This filter allows contact with our mail, web, and ftp servers,
but there is no restriction of the client's ip address. ( 0.0.0.0/0 )
This might be changed to specify a specific client address.
b. Applicability as an ether0 or serial port filter.
== .in filter ====
## DNS allow--allows DNS from anywhere
set filter f2.in 1 permit 0.0.0.0/0 0.0.0.0/0 udp dst eq 53
set filter f2.in 2 permit 0.0.0.0/0 0.0.0.0/0 udp src eq 53
## ftp allow from our server only (includes web browsers--PASV)
## This will permit browsers to use ftp as well as 'real' ftp clients.
set filter f2.in 3 permit 0.0.0.0/0 192.0.21.20/32 tcp dst eq 21
set filter f2.in 4 permit 0.0.0.0/0 192.0.21.20/32 tcp dst eq 20 estab
set filter f2.in 5 permit 0.0.0.0/0 192.0.21.20/32 tcp dst gt 1023
set filter f2.in 6 permit 0.0.0.0/0 192.0.21.20/32 tcp src gt 1023 estab
# allow POP3 from our mail server
set filter f2.in 7 permit 0.0.0.0/0 192.0.21.25/32 tcp dst eq 110
set filter f2.in 8 permit 0.0.0.0/0 192.0.21.25/32 tcp src eq 110 estab
set filter f2.in 9 permit 0.0.0.0/0 192.0.21.25/32 udp dst eq 110
set filter f2.in 10 permit 192.0.21.25/32 0.0.0.0/0 udp src eq 110 estab
# Allow http traffic from our web server
set filter f2.in 11 permit 0.0.0.0/0 192.0.21.20/32 tcp dst eq 80
set filter f2.in 12 permit 0.0.0.0/0 192.0.21.20/32 tcp src eq 80 estab
set filter f2.in 13 permit 0.0.0.0/0 192.0.21.20/32 udp dst eq 80
set filter f2.in 14 permit 192.0.21.20/32 0.0.0.0/0 udp src eq 80 estab
==out filter
## DNS allow--allow DNS to anywhere
set filter f2.out 1 permit 0.0.0.0/0 0.0.0.0/0 udp dst eq 53
set filter f2.out 2 permit 0.0.0.0/0 0.0.0.0/0 udp src eq 53
## ftp allow to our server only (includes web browsers--PASV)
set filter f2.out 3 permit 192.0.21.20/32 0.0.0.0/0 tcp src eq 21 estab
set filter f2.out 4 permit 192.0.21.20/32 0.0.0.0/0 tcp src eq 20
# This allows for PASV mode with high port numbers
set filter f2.out 5 permit 192.0.21.20/32 0.0.0.0/0 tcp src gt 1023 estab
set filter f2.out 6 permit 192.0.21.20/32 0.0.0.0/0 tcp dst gt 1023
# Opens a connection with a pop3 server (sending)
set filter f2.out 7 permit 192.0.21.25/32 0.0.0.0/0 tcp src eq 110 estab
set filter f2.out 8 permit 192.0.21.25/32 0.0.0.0/0 tcp dst eq 110
set filter f2.out 9 permit 0.0.0.0/0 192.0.21.25/32 udp src eq 110 estab
set filter f2.out 10 permit 192.0.21.25/32 0.0.0.0/0 udp dst eq 110
# Opens an http connection with web server (Sending)
set filter f2.out 11 permit 192.0.21.20/32 0.0.0.0/0 tcp src eq 80 estab
set filter f2.out 12 permit 192.0.21.20/32 0.0.0.0/0 tcp dst eq 80
set filter f2.out 13 permit 0.0.0.0/0 192.0.21.20/32 udp src eq 80 estab
set filter f2.out 14 permit 192.0.21.20/32 0.0.0.0/0 udp dst eq 80