FreeNAS 9.2.0 and IPFW

[ChrisUK1978]

Hi all,

I note with interest that recent FreeNAS builds come with IPFW compiled with the IPFIREWALL_DEFAULT_TO_ALLOW kernel option - this is great news!

I have a local FreeNAS box and an offsite FreeNAS box running in a VM on a commercial backup service (I'll not mention which as I'm discussing vulnerabilities below).

I do regular rsync backups via ssh-tunnel to the offsite backup to keep my data available and secure. As the offsite is running in a VM, the provider does not provide a firewall and expects the VMs to protect themselves.

The backup service is relatively well known for hosting FreeNAS VMs and cannot offer individual customers custom firewall rules. I am noticing a lot of root login attempts. I have ensured only certificate based logins and have disabled password logins, but would like to lock the install further.

The offsite ideally needs all ports closing apart from ssh and http, and the latter two restricting to my local IP addresses so that only I can access them.

I therefore need a firewall running on the offsite FreeNAS box and have tried to get IPFW to co-operate. Thus far a reboot seems to overwrite /etc and /usr/local/etc where I am attempting to modify the configs (I appreciate an upgrade may undo all this - I am prepared to reconfigure on upgrade) - despite mount -uw / before I start.

My questions;

1. Can the default FreeNAS IPFW installation be configured at all?
2. How might I go about configuring for a persistent firewall?

I know people are, quite rightly, advising not to put FreeNAS onto a public facing network, but sometimes its the only option. I think providing a means to protect the box, and ideally adding a rule engine for the firewall to the GUI would be a worthy and well-used addition.

Many thanks.

Kind regards,
Chris.

 

[Dusan]

I therefore need a firewall running on the offsite FreeNAS box and have tried to get IPFW to co-operate. Thus far a reboot seems to overwrite /etc and /usr/local/etc where I am attempting to modify the configs (I appreciate an upgrade may undo all this - I am prepared to reconfigure on upgrade) - despite mount -uw / before I start.

/etc is a ramdisk and therefore will be wiped on reboot. /usr/local/etc is a symlink to /etc/local, so the same applies here. You need to edit these fles: /conf/base/etc (/conf/base/etc is used to initialize /etc)

2. How might I go about configuring for a persistent firewall?

Either edit the files in /conf/base/etc or create your own firewall script and set it as a Pre Init Script (http://doc.freenas.org/index.php/Init/Shutdown_Scripts) -- this will even survive an upgrade.

 

[ChrisUK1978]

Hi Dusan,

Top tip! Once you work out where to edit its surprisingly easy...

Many thanks for taking the time to point me in the right direction - my auth.log is practically empty and my security log is filling up nicely.

Cheers,
Chris.

 

[ChrisUK1978]

/etc is a ramdisk and therefore will be wiped on reboot. /usr/local/etc is a symlink to /etc/local, so the same applies here. You need to edit these fles: /conf/base/etc (/conf/base/etc is used to initialize /etc)

Either edit the files in /conf/base/etc or create your own firewall script and set it as a Pre Init Script (http://doc.freenas.org/index.php/Init/Shutdown_Scripts) -- this will even survive an upgrade.

Just a quick update for others following this approach; it no longer seems to work in FreeNAS 9.2.1.7 - it seems something is overriding the rc.conf setting with to leave only the standard permit all rule (same as firewall-type = OPEN).

Similarly setting the script as a pre-init script also is overridden as it is happening too early in the process.

Setting the script to POST-INIT seems to work and should, as Dusan suggests, should survive a reset.

Cheers,
Chris.