|
Документ взят из кэша поисковой машины. Адрес
оригинального документа
: http://rtm-cs.sinp.msu.ru/manual/howto/mini/Cipe+Masq.html
Дата изменения: Thu May 4 20:18:37 2000 Дата индексирования: Mon Oct 1 21:25:08 2012 Кодировка: |
This is the Linux Cipe+Masquerading mini-HOWTO. It shows how to setup a Virtual Private Network between your LAN and other LAN's using Cipe on linux masquerading firewall machines. It also shows an example masquerading firewall configuration.
C)opyright 1998, 1999 Anthony Ciaravalo, acj@home.com
Unless otherwise stated, Linux HOWTO documents are copyrighted by their respective authors. Linux HOWTO documents may be reproduced and distributed in whole or in part, in any medium physical or electronic, as long as this copyright notice is retained on all copies. Commercial redistribution is allowed and encouraged; however, the author would like to be notified of any such distributions.
All translations, derivative works, or aggregate works incorporating any Linux HOWTO documents must be covered under this copyright notice. That is, you may not produce a derivative work from a HOWTO and impose additional restrictions on its distribution. Exceptions to these rules may be granted under certain conditions; please contact the Linux HOWTO coordinator at the address given below.
If you have questions, please contact Tim Bynum, the Linux HOWTO coordinator, at tjbynum@wallybox.cei.net or linux-howto@metalab.unc.edu
Use of the information and examples in this document is at your own risk. There are many security issues involved when connecting networks across the internet. Even though information is encrypted, an improperly configured firewall may result in a security breach. Precautions can be taken to protect your cipe connections, but it does not guarantee 100% security. The author does not guarantee the information provided in this document will provide a secure networking environment. Even though I have tried to be as accurate as possible creating this document, I am not responsible for any problems or damages incurred due to actions taken based on the information in this document.
Send questions, comments, suggestions, or corrections to acj@home.com.
This howto was written based on Cipe versions 1.0.1 and 1.2.0. See reference section for link to Cipe home page.
This howto assumes you already configured your kernel to support IP masquerade. See references below for information on configuring your kernel for a linux firewall.
This setup uses a star/hub configuration. It will set up a cipe connection from Machine A to Machine B and another from Machine A to Machine C.
Machine A
eth0: 192.168.1.1
eth1: real ip 1
/ \
/ \
Machine B Machine C
eth0: 192.168.2.1 eth0:192.168.3.1
eth1: real ip 2 eth1: real ip 3
eth0 is the local network (fake address)
eth1 is the internet address (real address)
Port A is any valid port you would like to choose
Port B is any other valid port you would like to choose
Key A is any valid key you would like to choose (read cipe doc for info)
Key B is any valid key you would like to choose
The ip-up scripts currently only allow class c traffic through the cipe interface. If you wish for machine B to communicate with Machine C then you will need to change the appropriate ip-up and ip-down scripts. Specifically, you need to change the ptpaddr and myaddr netmasks. There are two ip-up scripts, one for ipchains and one for ipfwadm. Same with the ip-down scripts. Change the appropriate incoming, outgoing, and forwarding cipe interface firewall rules netmask from /24 to /16. Any cipe firewall rule changes you make in ip-up for ipfwadm, make sure the ip-down script reflects the change so it will be properly removed from the list when the interface goes down. For the ipchains file, anything added in a chain does not need ip-down reflection since ip-down will flush all the rules in the user defined chain.
You will also need to uncomment the network route in the rc.cipe for Machine B and C that adds each others network to their route table.
#uncomment 1 below
#name for cipe 1.0.x
#device cip3b0
#name for cipe 1.2.x
device cipcb0
# remote internal (fake) ip address
ptpaddr 192.168.2.1
# my cipe (fake) ip address
ipaddr 192.168.1.1
# my real ip address and cipe port
me (real ip 1):(port A)
# remote real ip address and cipe port
peer (real ip 2):(port A)
#unique 128 bit key
key (Key A)
#uncomment 1 below
#name for cipe 1.0.x
#device cip3b1
#name for cipe 1.2.x
device cipcb1
# remote internal (fake) ip address
ptpaddr 192.168.3.1
# my cipe (fake) ip address
ipaddr 192.168.1.1
# my real ip address and cipe port
me (real ip 1):(port B)
# remote real ip address and cipe port
peer (real ip 3):(port B)
#unique 128 bit key
key (Key B)
!#/bin/bash
#rc.cipe 3/29/1999
#Send questions or comments to acj@home.com.
#Setup script path
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#Options filenames in cipe directory for cipe interfaces
options="options.machineB options.machineC"
#Automatically obtain options filenames from cipe directory
#options=`/bin/ls /etc/cipe/options.*`
#Uncomment 1 below for the cipe module name
#cipemod="cip3b" #for cipe 1.0
cipemod="cipcb" #for cipe 1.2
#Check for cipe module and load if not already loaded
grep $cipemod /proc/modules >/dev/null
if [ "$?" = "1" ]; then
echo Loading cipe module.
modprobe $cipemod
if [ "$?" = "1" ]; then
echo Error loading cipe module...exiting.
exit
fi
else
echo Cipe module already loaded.
fi
#Remove any existing cipe interfaces
cipeif=`cat /proc/net/dev | cut -f1 -d: | grep $cipemod`
if [ "$cipeif" != "" ]; then
echo Removing existing cipe interface(s).
for i in $cipeif; do
ifconfig $i down
done
fi
#Setup cipe interfaces
echo -n "Setting up cipe interface(s): "
for config in $options; do
echo -n $config" "
ciped -o $config
done
echo
echo
#Add routes for other remote networks via cipe interface(s)
#route add -net x.x.x.x netmask x.x.x.x gw x.x.x.x
All machines on network 192.168.1.0 must have 192.168.1.1 as gateway. If you don't it will not work.
#uncomment 1 below
#name for cipe 1.0.x
#device cip3b0
#name for cipe 1.2.x
device cipcb0
#remote internal (fake) ip address
ptpaddr 192.168.1.1
# my cipe (fake) ip address
ipaddr 192.168.2.1
# my real ip address and cipe port
me (real ip 1):(port A)
# remote real ip address and cipe port
peer (real ip 2):(port A)
#unique 128 bit key
key (Key A)
!#/bin/bash
#rc.cipe 3/29/1999
#Send questions or comments to acj@home.com.
#Setup script path
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#Options filenames in cipe directory for cipe interfaces
options="options.machineA"
#Automatically obtain options filenames from cipe directory
#options=`/bin/ls /etc/cipe/options.*`
#Uncomment 1 below for the cipe module name
#cipemod="cip3b" #for cipe 1.0
cipemod="cipcb" #for cipe 1.2
#Check for cipe module and load if not already loaded
grep $cipemod /proc/modules >/dev/null
if [ "$?" = "1" ]; then
echo Loading cipe module.
modprobe $cipemod
if [ "$?" = "1" ]; then
echo Error loading cipe module...exiting.
exit
fi
else
echo Cipe module already loaded.
fi
#Remove any existing cipe interfaces
cipeif=`cat /proc/net/dev | cut -f1 -d: | grep $cipemod`
if [ "$cipeif" != "" ]; then
echo Removing existing cipe interface(s).
for i in $cipeif; do
ifconfig $i down
done
fi
#Setup cipe interfaces
echo -n "Setting up cipe interface(s): "
for config in $options; do
echo -n $config" "
ciped -o $config
done
echo
echo
#Add routes for other remote networks via cipe interface(s)
#route add -net x.x.x.x netmask x.x.x.x gw x.x.x.x
#route to machine C network
#route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.3.1
All machines on network 192.168.2.0 must have 192.168.2.1 as gateway. If you don't it will not work.
#uncomment 1 below
#name for cipe 1.0.x
#device cip3b0
#name for cipe 1.2.x
device cipcb0
#remote internal (fake) ip address
ptpaddr 192.168.1.1
# my cipe (fake) ip address
ipaddr 192.168.3.1
# my real ip address and cipe port
me (real ip 3):(port B)
#remote real ip address and cipe port
peer (real ip 1):(port B)
#unique 128 bit key
key (Key B)
!#/bin/bash
#rc.cipe 3/29/1999
#Send questions or comments to acj@home.com.
#Setup script path
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#Options filenames in cipe directory for cipe interfaces
options="options.machineA"
#Automatically obtain options filenames from cipe directory
#options=`/bin/ls /etc/cipe/options.*`
#Uncomment 1 below for the cipe module name
#cipemod="cip3b" #for cipe 1.0
cipemod="cipcb" #for cipe 1.2
#Check for cipe module and load if not already loaded
grep $cipemod /proc/modules >/dev/null
if [ "$?" = "1" ]; then
echo Loading cipe module.
modprobe $cipemod
if [ "$?" = "1" ]; then
echo Error loading cipe module...exiting.
exit
fi
else
echo Cipe module already loaded.
fi
#Remove any existing cipe interfaces
cipeif=`cat /proc/net/dev | cut -f1 -d: | grep $cipemod`
if [ "$cipeif" != "" ]; then
echo Removing existing cipe interface(s).
for i in $cipeif; do
ifconfig $i down
done
fi
#Setup cipe interfaces
echo -n "Setting up cipe interface(s): "
for config in $options; do
echo -n $config" "
ciped -o $config
done
echo
echo
#Add routes for other remote networks via cipe interface(s)
#route add -net x.x.x.x netmask x.x.x.x gw x.x.x.x
#route to machine B network
#route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.2.1
All machines on network 192.168.2.0 must have 192.168.2.1 as gateway. If you don't it will not work.
#!/bin/bash
# ip-up <interface> <myaddr> <daemon-pid> <local> <remote> <arg>
#3/29/1999
#An example ip-up script for the older 1.x 2.x kernels using ipfwadm that
#will setup routes and firewall rules to connect your local class c network
#to a remote class c network.
#The rules are configured to prevent spoofing and stuffed routing between
#the networks. There are also additional security enhancements commented
#out towards the bottom of the script.
#Send questions or comments to acj@home.com.
#--------------------------------------------------------------------------
#Set some script variables
device=$1 # the CIPE interface
me=$2 # our UDP address
pid=$3 # the daemon's process ID
ipaddr=$4 # IP address of our CIPE device
vptpaddr=$5 # IP address of the remote CIPE device
option=$6 # argument supplied via options
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#comment/uncomment to enable/disbale kernel logging for all unauthorized
#access attempts. Must be same as ip-down script in order to remove rules.
log="-o"
#--------------------------------------------------------------------------
umask 022
# just a logging example
#echo "UP $*" >> /var/adm/cipe.log
# many systems like these pid files
#echo $3 > /var/run/$device.pid
#--------------------------------------------------------------------------
#add route entry for remote cipe network
network=`expr $ptpaddr : '\([0-9]*\.[0-9]*\.[0-9]*\.\)'`0
route add -net $network netmask 255.255.255.0 dev $device
#need to add route entry for host in 2.0 kernels
route add -host $ptpaddr dev $device
#--------------------------------------------------------------------------
#cipe interface incoming firewall rules
#must be inserted into list in reverse order
#deny all other incoming packets to cipe interface
ipfwadm -I -i deny -W $device -S 0/0 -D 0/0 $log
#accept incoming packets from remotenet to localnet on cipe interface
ipfwadm -I -i accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#accept incoming packets from localnet to remotenet on cipe interface
ipfwadm -I -i accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#deny incoming packets, cipe interface, claiming to be from localnet; log
ipfwadm -I -i deny -W $device -S $ipaddr/24 -D $ipaddr/24 $log
#--------------------------------------------------------------------------
#cipe interface outgoing firewall rules
#must be inserted into list in reverse order
#deny all other outgoing packets from cipe interface
ipfwadm -O -i deny -W $device -S 0/0 -D 0/0 $log
#accept outgoing from remotenet to localnet on cipe interface
ipfwadm -O -i accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#accept outgoing from localnet to remotenet on cipe interface
ipfwadm -O -i accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#deny outgoing to localnet from localnet, cipe interface, deny; log
ipfwadm -O -i deny -W $device -S $ipaddr/24 -D $ipaddr/24 $log
#--------------------------------------------------------------------------
#The forwarding is configured so machines on your local network do not get
#masqueraded to the remote network. This provides better access control
#between networks. Must be inserted into list in reverse order
#deny all other forwarding through cipe interface; log
ipfwadm -F -i deny -W $device -S 0/0 -D 0/0 $log
#accept forwarding from remotenet to localnet on cipe interfaces
ipfwadm -F -i accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#accept forwarding from localnet to remotenet on cipe interfaces
ipfwadm -F -i accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#--------------------------------------------------------------------------
#Make sure forwarding is enabled in the kernel. The kernel by default may
#have forwarding disabled.
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
#--------------------------------------------------------------------------
#Optional security enhancement - set default forward policy to
#DENY or REJECT. If your forwarding default policy is DENY/REJECT
#you will need to add the following rules to your main forward chain. It
#is a good idea to have all default policies set for DENY or
#REJECT.
#define machine interfaces
#localif="eth0"
#staticif="eth1" ;cable modem users
#staticif="ppp0" ;dialup users
#a real sloppy way to get the peer ip address from the options file - a new
#argument with peer ip:port passed to script would be nice.
#both lines need to be uncommented
#peerfile=`grep $device /etc/cipe/options.* | cut -f1 -d:`
#peer=`grep peer $peerfile | cut -f1 -d: | awk '{print $2}'`
#must log peer ip address for ip-down script
#echo $peer > /var/run/$device.peerip
#accept forwarding from localnet to remotenet on internal network interface
#ipfwadm -F -i accept -W $localif -S $ipaddr/24 -D $ptpaddr/24
#accept forwarding from remotenet to localnet on internal network interface
#ipfwadm -F -i accept -W $localif -S $ptpaddr/24 -D $ipaddr/24
#accept forwarding on staticif from me to peer
#myaddr=`echo $me | cut -f1 -d:`
#ipfwadm -F -i accept -W $staticif -S $myaddr -D $peer
#--------------------------------------------------------------------------
#Other optional security enhancement
#block all incoming requests from everywhere to our cipe udp port
#except our peer's udp port
#need to determine udp ports for the cipe interfaces
#get our udp port
#if [ "$option" = "" ]; then
# myport=`echo $me | cut -f2 -d:`
#else
# myport=$option
#fi
#get remote udp port -- peerfile variable must be set above
#peerport=`grep peer $peerfile | cut -f2 -d:`
#must log peer udp port for ip-down script
#echo $peerport > /var/run/$device.peerport
#get our ip address
#myaddr=`echo $me | cut -f1 -d:`
#deny and log all requests to cipe udp port must be inserted first
#ipfwadm -I -i deny -P udp -W $staticif -S 0/0 -D $myaddr $myport $log
#accept udp packets from peer at udp cipe port to my udp cipe port
#ipfwadm -I -i accept -P udp -W $staticif -S $peer $peerport \
#-D $myaddr $myport
exit 0
#!/bin/bash
# ip-up <interface> <myaddr> <daemon-pid> <local> <remote> <arg>
#3/29/1999
#An example ip-up script for the newer 2.1/2.2 kernels using ipchains that
#will setup routes and firewall rules to connect your local class c network
#to a remote class c network. This script creates 3 user defined chains
#-input, output, and forward - for each cipe interface, based on the
#interface name. It will then insert a rule into each of the built-in
#input, output, and forward chains to use the user defined chains. The
#rules are configured to prevent spoofing and stuffed routing between the
#networks. There are also additional security enhancements commented out
#towards the bottom of the script.
#Send questions or comments to acj@home.com.
#--------------------------------------------------------------------------
#Set some script variables
device=$1 # the CIPE interface
me=$2 # our UDP address
pid=$3 # the daemon's process ID
ipaddr=$4 # IP address of our CIPE device
ptpaddr=$5 # IP address of the remote CIPE device
option=$6 # argument supplied via options
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#comment/uncomment to enable/disbale kernel logging for all unauthorized
#access attempts. Must be same as ip-down script in order to remove rules.
log="-l"
#--------------------------------------------------------------------------
umask 022
# just a logging example
#echo "UP $*" >> /var/adm/cipe.log
# many systems like these pid files
#echo $3 > /var/run/$device.pid
#--------------------------------------------------------------------------
#add route entry for remote cipe network
network=`expr $ptpaddr : '\([0-9]*\.[0-9]*\.[0-9]*\.\)'`0
route add -net $network netmask 255.255.255.0 dev $device
#--------------------------------------------------------------------------
#create new ipchain for cipe interface input rules
ipchains -N $device"i"
#flush all rules in chain (sanity flush)
ipchains -F $device"i"
#deny incoming packets, cipe interface, claiming to be from localnet; log
ipchains -A $device"i" -j DENY -i $device -s $ipaddr/24 -d $ipaddr/24 $log
#accept incoming packets from localnet to remotenet on cipe interface
ipchains -A $device"i" -j ACCEPT -i $device -s $ipaddr/24 -d $ptpaddr/24
#accept incoming packets from remotenet to localnet on cipe interface
ipchains -A $device"i" -j ACCEPT -i $device -s $ptpaddr/24 -d $ipaddr/24
#deny all other incoming packets
ipchains -A $device"i" -j DENY -s 0/0 -d 0/0 $log
#--------------------------------------------------------------------------
#create new ipchain for cipe interface output rules
ipchains -N $device"o"
#flush all rules in chain (sanity flush)
ipchains -F $device"o"
#deny outgoing to localnet from localnet, cipe interface, deny; log
ipchains -A $device"o" -j DENY -i $device -s $ipaddr/24 -d $ipaddr/24 $log
#accept outgoing from localnet to remotenet on cipe interface
ipchains -A $device"o" -j ACCEPT -i $device -s $ipaddr/24 -d $ptpaddr/24
#accept outgoing from remotenet to localnet on cipe interface
ipchains -A $device"o" -j ACCEPT -i $device -s $ptpaddr/24 -d $ipaddr/24
#deny all other outgoing packets
ipchains -A $device"o" -j DENY -s 0/0 -d 0/0 $log
#--------------------------------------------------------------------------
#The forward chain is configured so machines on your local network do not
#get masqueraded to the remote network. This provides better access
#control between networks.
#create new ipchain for cipe interface forward rules
ipchains -N $device"f"
#flush all rules in chain (sanity flush)
ipchains -F $device"f"
#accept forwarding from localnet to remotenet on cipe interfaces
ipchains -A $device"f" -j ACCEPT -i $device -s $ipaddr/24 -d $ptpaddr/24
#accept forwarding from remotenet to localnet on cipe interfaces
ipchains -A $device"f" -j ACCEPT -i $device -s $ptpaddr/24 -d $ipaddr/24
#deny all other forwarding; log
ipchains -A $device"f" -j DENY -s 0/0 -d 0/0 $log
#--------------------------------------------------------------------------
#Make sure forwarding is enabled in the kernel. New kernels by default have
#forwarding disabled.
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
#--------------------------------------------------------------------------
#insert rules to main input, output, and forward chains to enable new rules
#for the cipe interface
ipchains -I input -i $device -j $device"i"
ipchains -I output -i $device -j $device"o"
ipchains -I forward -i $device -j $device"f"
#--------------------------------------------------------------------------
#Optional security enhancement - set built-in forward chain policy to
#DENY or REJECT. If your main forward chain default policy is DENY/REJECT
#you will need to add the following rules to your main forward chain. It
#is a good idea to have all built-in chain default policies set for DENY or
#REJECT.
#define machine interfaces
#localif="eth0"
#staticif="eth1" ;cable modem users
#staticif="ppp0" ;dialup users
#a real sloppy way to get the peer ip address from the options file - a new
#argument with peer ip:port passed to script would be nice.
#both lines need to be uncommented
#peerfile=`grep $device /etc/cipe/options.* | cut -f1 -d:`
#peer=`grep peer $peerfile | cut -f1 -d: | awk '{print $2}'`
#must log peer ip address for ip-down script
#echo $peer > /var/run/$device.peerip
#accept forwarding from localnet to remotenet on internal network interface
#ipchains -I forward -j ACCEPT -i $localif -s $ipaddr/24 -d $ptpaddr/24
#accept forwarding from remotenet to localnet on internal network interface
#ipchains -I forward -j ACCEPT -i $localif -s $ptpaddr/24 -d $ipaddr/24
#accept forwarding on staticif from me to peer
#myaddr=`echo $me | cut -f1 -d:`
#ipchains -I forward -j ACCEPT -i $staticif -s $myaddr -d $peer
#--------------------------------------------------------------------------
#Other optional security enhancement
#block all incoming requests from everywhere to our cipe udp port
#except our peer's udp port
#need to determine udp ports for the cipe interfaces
#get our udp port
#if [ "$option" = "" ]; then
# myport=`echo $me | cut -f2 -d:`
#else
# myport=$option
#fi
#get remote udp port -- peerfile variable must be set above
#peerport=`grep peer $peerfile | cut -f2 -d:`
#must log peer udp port for ip-down script
#echo $peerport > /var/run/$device.peerport
#get our ip address
#myaddr=`echo $me | cut -f1 -d:`
#deny and log all requests to cipe udp port must be inserted first
#ipchains -I input -j DENY -p udp -i $staticif -s 0/0 \
#-d $myaddr $myport $log
#accept udp packets from peer at udp cipe port to my udp cipe port
#ipchains -I input -j ACCEPT -p udp -i $staticif -s $peer $peerport \
# -d $myaddr $myport
#--------------------------------------------------------------------------
# Set up spoofing protection in kernel as an additional security measure
#--------------------------------------------------------------------------
#Why do I have spoofing protection in the firewall rules in addition to
#this script that sets up spoof protection for each interface in the
#kernel? Guess I'm paranoid.
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
echo -n "Setting up IP spoofing protection..."
iface="/proc/sys/net/ipv4/conf/$device/rp_filter"
echo 1 > $iface
echo "done."
else
echo "Cannot setup spoof protection in kernel for $device" \
| mail -s"Security Warning: $device" root
exit 1
fi
exit 0
#!/bin/bash
# ip-down <interface> <myaddr> <daemon-pid> <local> <remote> <arg>
#3/29/1999
#An example ip-down script for the older 1.x 2.x kernels using ipfwadm that
#will remove firewall rules that were setup to connect your local class c
#network to a remote class c network.
#--------------------------------------------------------------------------
#Set some script variables
device=$1 # the CIPE interface
me=$2 # our UDP address
pid=$3 # the daemon's process ID
ipaddr=$4 # IP address of our CIPE device
ptpaddr=$5 # IP address of the remote CIPE device
option=$6 # argument supplied via options
PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin"
#comment/uncomment to enable/disbale kernel logging for all unauthorized
#access attempts. Must be same as ip-down script in order to remove rules.
log="-o"
#--------------------------------------------------------------------------
umask 022
# just a logging example
#echo "DOWN $*" >> /var/adm/cipe.log
# many systems like these pid files
#rm -f /var/run/$device.pid
#--------------------------------------------------------------------------
#cipe interface incoming firewall rules
#delete (deny all other incoming packets to cipe interface)
ipfwadm -I -d deny -W $device -S 0/0 -D 0/0 $log
#delete (accept incoming packets from remotenet to localnet on cipe
#interface)
ipfwadm -I -d accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#delete (accept incoming packets from localnet to remotenet on cipe
#interface)
ipfwadm -I -d accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#delete (deny incoming packets, cipe interface, claiming to be from
#localnet and log)
ipfwadm -I -d deny -W $device -S $ipaddr/24 -D $ipaddr/24 $log
#--------------------------------------------------------------------------
#cipe interface incoming firewall rules
#delete (deny all other outgoing packets from cipe interface)
ipfwadm -O -d deny -W $device -S 0/0 -D 0/0 $log
#delete (accept outgoing from remotenet to localnet on cipe interface)
ipfwadm -O -d accept -W $device -S $ptpaddr/24 -D $ipaddr/24
#delete (accept outgoing from localnet to remotenet on cipe interface)
ipfwadm -O -d accept -W $device -S $ipaddr/24 -D $ptpaddr/24
#delete (deny outgoing to localnet from localnet, cipe interface, deny
#and log)
ipfwadm -O -d deny -W $device -S $ipaddr/24 -D $ipaddr/24 $log
#--------------------------------------------------------------------------
#cipe interface forwarding firewall rules
#delete (deny all other forwarding through cipe interface; log)
ipfwadm -F -d deny -W $device -S 0/0 -D 0/0 $log