IPFW rules for FreeBSD?

[pipman]

Hey Guys,

My FreeBSD server got hacked and I would like to finally configure a IPFW firewall. I've got it install and enabled ok, but I just confused by the rules to configure the firewall.

Basically I was hoping that someone could send me some simple & easy to understand IPFW rules that will only enable the ports for WWW, DNS, SMTP, POP3, SSH2, and SNMPD. And have all the other ports denied.

Any help would be greatly appreciated.

Regards,

Dan

 

[pipman]

After looking at various examples. Here are the IPFW rules that I've come up with so far. Please let me know if there is anything wrong with these, like being in the wrong order, redundant rules or too insecure. Any help would be greatly appreciated.


#########################################################
# IPFW Firewall Commands
#########################################################

cmd="ipfw -q add"
ipfw -q -f flush


#########################################################
# Allow Loopback and Deny Loopback Spoofing
#########################################################

$cmd allow ip from any to any via lo0
$cmd deny ip from any to 127.0.0.0/8
$cmd deny ip from 127.0.0.0/8 to any
$cmd deny tcp from any to any frag


#########################################################
# Stateful Rules
#########################################################

$cmd check-state
$cmd allow tcp from any to any established
$cmd allow ip from any to any keep-state out
$cmd allow icmp from any to any


#########################################################
# Incoming/Outgoing Services
#########################################################

$cmd allow tcp from any to any 22 keep-state setup
$cmd allow tcp from any to any 25 keep-state setup
$cmd allow tcp from any to any 53 keep-state setup
$cmd allow udp from any to any 53 keep-state
$cmd allow tcp from any to any 80 keep-state setup
$cmd allow tcp from any to any 110 keep-state setup
$cmd allow udp from any to any 161 keep-state
$cmd allow udp from any to any 27015 keep-state


#########################################################
# Deny and Log
#########################################################

$cmd deny log ip from any to any