InfoMagic Internet Tools 1993 July/Internet Tools.iso/RockRidge/security/ipacl/example.cfg

Text File | 1993-01-12 | 5.1 KB | 215 lines

#
# Configuration file example for ipacl
# ------------------------------------
#
# Let's assume the following scenario:
#
# - We have a local area network with a couple of hosts.
# - We want to connect to the internet.
# - Only one of our hosts shall have internet access, we call this
#   host piggy.edu. All other hosts in our local network
#   do *not* have direct internet access. We use IPACL to
#   make some access restrictions for piggy.edu.
# - The rest of our local network shall be protected
#   from the internet.
# - For security reasons we only want to allow connections
#   outgoing from piggy.edu into the internet and disallow
#   incoming connections (except for smtp, nntp and name server
#   connections, which are necessary to receive mails and news feed).
# - We also disallow telnet/ftp/... connections from piggy.edu
#   into our local net (except smtp), but any host in our local
#   net can telnet/ftp/mail/... to piggy.edu.
# - Piggy.edu has 2 network interfaces, one connectiong
#   to the internet, the other one connectiong to the local net.
#   Piggy.edu does *not* route packetes between our local net
#   and the internet (IPFORWARDING in the kernel is set to off).
#
# The following picture shows our configuration:
#
#          +--------------------------+
#          | Our internet host        |
#          | `piggy.edu'              |
#          +------+------------+------+
#       piggy.edu |            | piggy-2.edu
# <---------------+            +--------------->
# INTERNET                Our local network - all the
#                    hosts in the local network are
#                    to be protected from internet.
#
# IPACL access list (configuration file) we install on piggy.edu:
#

    #------------
    # The adresses of all the host's interfaces -
    # we have the loop interface and 2 ethernet boards
    #------------

SELF       = { "localhost", "piggy.com", "piggy-2.com" }

    #------------
    # The address set `LOCAL' describes all the hosts in
    # our local net. All hosts not in this set are
    # assumed to reside in the internet.
    #------------

NET_37     = 37.0.0.0 mask 0xff000000
NET_L2     = 236.5.3.0 mask 0xffffff00
LOCAL      = { NET_37, NET_L2, "dog.edu", 174.32.5.13 }

    #------------
    # Any host in our local net is allowed to use
    # the following services on our host
    #------------

OUR_SERVICES_FOR_LOCAL = {
   port "smtp/tcp",        # Mail
   port "nntp/tcp",        # News
   port "telnet/tcp",        # Telnet
   port "ftp/tcp",        # FTP
   port "ftp-data/tcp",        # FTP
   port "pop-3/tcp",        # Post office protocol (mail)
   port "domain/tcp",        # Name server
   port "domain/udp"        # Name server
}

    #------------
    # Any host in the INTERNET is allowed to connect to
    # the following services on piggy.edu
    #------------

OUR_SERVICES_FOR_INTERNET = {
   port "smtp/tcp",
   port "nntp/tcp",
   port "domain/tcp",
   port "domain/udp"
}

    #------------
    # Our host is allowed to connect to
    # the following services on every host in the local net
    #------------

LOCAL_SERVICES_FOR_US = {
   port "smtp/tcp"
}

    #------------
    # Our host is allowed to connect to
    # the following services on every host in the INTERNET
    #------------

INTERNET_SERVICES_FOR_US = {
   port "smtp/tcp",        # Mail
   port "nntp/tcp",        # News
   port "telnet/tcp",
   port "ftp/tcp",
   port "ftp-data/tcp",
   port "domain/tcp",
   port "domain/udp",
   port 1525/udp             # archie server
}

#****************** END OF DEFINITIONS ************************************

START:
   src in SELF         -> OUTGOING

    #------------
    # Handle incoming packets
    #------------

INCOMING:

    # We assume that everything, that is not part of
    # our local net comes from anywhere in the INTERNET

   src !in LOCAL    -> INCOMING_FROM_INTERNET

    #------------
    # Handle incoming packets from our local net
    #------------

INCOMING_FROM_LOCAL:

    # Connection to telnet, ftp, ...

   dst in OUR_SERVICES_FOR_LOCAL -> accept

    # Accept responses from SMTP, where we have connected to

   src in LOCAL_SERVICES_FOR_US -> accept

    # reject everything else

   deny

    #------------
    # Handle incoming packets from INTERNET
    #------------

INCOMING_FROM_INTERNET:

    # Connection for mail, news, DNS, ...

   dst in OUR_SERVICES_FOR_INTERNET   -> accept

    # accept responses from the services we connect to ...

   src in INTERNET_SERVICES_FOR_US   -> accept

    # reject everything else

   deny

    #------------
    # Handle outgoing packets
    #------------

OUTGOING:

    # Packets, that our host sends to itself

   dst in SELF        -> accept

    # We assume, that everything, that does not belong
    # to our local net is somewhere in the INTERNET

   dst !in LOCAL    -> OUTGOING_TO_INTERNET

    #------------
    # Check packets sent to our local network
    #------------

OUTGOING_TO_LOCAL:

    # Responses for telnet, ftp, ...

   src in OUR_SERVICES_FOR_LOCAL -> accept

    # Mail delivered from our host to a host in our local net

   dst in LOCAL_SERVICES_FOR_US -> accept

    # reject everything else

   deny

    #------------
    # Check packets sent to INTERNET
    #------------

OUTGOING_TO_INTERNET:

    # Responses for news, mail, domain, ...

   src in OUR_SERVICES_FOR_INTERNET    -> accept

    # Connections into the INTERNET, ...

   dst in INTERNET_SERVICES_FOR_US   -> accept

    # reject everything else

   deny