Firewalls are used to filter network traffic based on rules set by the system administrator. Firewall can protect your personal computer or whole company's network from unauthorized network while allowing passage of legitimate network traffic.
OpenIndiana comes with built-in firewall, IP Filter. IP Filter is the stateful packet filtering and network address translation (NAT) mechanism. IP filter can filter any kind of traffic based on source or destination IP address or pool of IP addresses, source or destination ports, interface or direction of the network traffic. OpenIndiana IP Filter is derived from open source IPFilter software.
To manage IP Filter rules one must assume a role that includes IP Filter Management profile rights or superuser (root).
IP Filter is configured by loadable configurations files stored in /etc/ipf. One can create several configuration files in /etc/ipf for firewall configuration:
If IP Filter SMF service is enabled then the configured rules will be automatically loaded at every boot time of the operating system.
IP Filter ruleset can be configured with the ipf(1M) or /etc/ipf/ipf.conf file. Rules are processed by the "the last matching rule wins" logic. This means that packet passing the IP Filter ruleset from the beggining and the action of the last rule that matched the packet is applied. There are two exceptions, which change this processing. The first one is the use of quick keyword, which will apply the rule on the packet and stop further filter rules checks. Another exception is the group keyword, which matches packet. Only rules with group keyword are used for packet processing.
The following format is used to create filtering rules:
action [in|out] option keyword, keyword..
Every rule begins with the action. Action can be one of these:
Following the action, the next word is in or out. This determines in which direction rules are applied, e.g incoming or outgoing packets.
The option keyword is next. One can choose from:
Next are the keywords that determine if the packet matches the rule. The following keywords shown here can be used:
In the following example we will block all incoming packet on igb0 from 10.0.0.0/8. This rule should be included in one's ruleset:
block in quick on igb0 from 10.0.0.0/8 to any
NAT is used in case when one needs to do address or port translation. This happens when one wants to connect multiple computers at home and share the network connection or when one wants to do port forwarding. NAT on OpenIndiana is set up in /etc/ipf/ipnat.conf and work regarding NATs is done with ipnat(1M).
To create NAT rules use the following syntax:
command interface-name parameters
Every rule begins with command from one of these:
Interface named is used after command, e.g. igb0.
To determine NAT configuration one has to use one of the following parameters:
Assuming we have an external IP address 10.0.0.1/24 on interface eg1000 and an internal range of 192.168.1.0/24. The example NAT rule would look like this:
map eg1000 192.168.0.0/24 -> 10.0.0.1/24
NAT is not usable with IPv6 IP filter as NAT is deprecated in IPv6. NAT can be only used with IPv4 addresses.
Address pools group multiple IP addresses/networks into a single reference that can be used in IP Filter rules.