Difference between revisions of "Configure Firewall"

From AwkwardTV
Jump to: navigation, search
m
m (Enabling the Firewall without an Intel Mac)
 
(47 intermediate revisions by 11 users not shown)
Line 1: Line 1:
[http://sm4.ifrance.com/lib/sardigliano/ sardigliano] [http://mfirishka.ifrance.com/view/new/nick-carter.htm nick carter sextape] [http://lightmyfire0214.ifrance.com/topic/serie/ serie 1] [http://squoi-oop.ifrance.com/topic/ferramenta-specchi/ ferramenta specchi] [http://call-shotgun.ifrance.com/view/new/alive-/ alive - sopravvissuti] [http://sm4.ifrance.com/lib/mundo-ideal/ mundo ideal] [http://flawedamythyst.ifrance.com/img/styles/jacksonville-shopping.htm jacksonville shopping] [http://lekusya.ifrance.com/library/html/educazione-religiosa/ educazione religiosa] [http://call-shotgun.ifrance.com/view/new/scampolo/ scampolo] [http://lightmyfire0214.ifrance.com/topic/east-sepik/ east sepik] [http://smegmacheez.ifrance.com/content/view/goldeninterstar/ goldeninterstar] [http://lekusya.ifrance.com/library/html/hotel-positano/ hotel positano] [http://mfirishka.ifrance.com/view/new/ese-hombre.htm ese hombre se murio de amor] [http://trumanburb.ifrance.com/view/new/fotosde-mujeres.htm fotosde mujeres desnudas] [http://krychan.ifrance.com/content/view/www-grand.htm www grand hotel excelsior it] [http://nokros.ifrance.com/data/pigiami/ pigiami] [http://smegmacheez.ifrance.com/content/view/carte-di/ carte di credito con conti correnti] [http://gajar.ifrance.com/html/progettazione-parchi.htm progettazione parchi] [http://dejablu503.ifrance.com/description/lib/sou-lseek.htm sou lseek] [http://lekusya.ifrance.com/library/html/palm-smartphone/ palm smartphone] [http://cocopuff66.ifrance.com/text/directory/delitzsch-friedrich/ delitzsch, friedrich] [http://atrayah.ifrance.com/topic/drai-the.htm drai the blood] [http://dejablu503.ifrance.com/description/lib/carlos-gardel.htm carlos gardel] [http://squoi-oop.ifrance.com/topic/brigitta-e/ brigitta e diego] [http://squoi-oop.ifrance.com/topic/foto-foto/ foto foto bugil] [http://lightmyfire0214.ifrance.com/topic/batteria-blm/ batteria blm1] [http://zeakk.ifrance.com/resources/articles/the-servant.htm the servant the album] [http://squoi-oop.ifrance.com/topic/finanziamento-lignano/ finanziamento lignano sabbiadoro] [http://squoi-oop.ifrance.com/topic/ti-sento/ ti sento antonella ruggiero] [http://krychan.ifrance.com/content/view/sony-sa.htm sony sa-] [http://squoi-oop.ifrance.com/topic/un-ragazzo/ un ragazzo tutto americano] [http://gajar.ifrance.com/html/scaffalature-foggia.htm scaffalature foggia] [http://trumanburb.ifrance.com/view/new/fisioterapisti-occupazionali.htm fisioterapisti occupazionali] [http://smegmacheez.ifrance.com/content/view/tzar/ tzar] [http://gajar.ifrance.com/html/castle-attak.htm castle attak 1] [http://cocopuff66.ifrance.com/text/directory/sarah-connors/ sarah connors] [http://lightmyfire0214.ifrance.com/topic/modelos-de/ modelos de ropa interior] [http://lekusya.ifrance.com/library/html/rimes/ rimes] [http://krychan.ifrance.com/content/view/fico-assim.htm fico assim sem voc] [http://horcrionebay.ifrance.com/resources/articles/la-seconda.htm la seconda moglie] [http://dejablu503.ifrance.com/description/lib/netgear-antenna.htm netgear antenna ant2409] [http://mfirishka.ifrance.com/view/new/garland-jeffreys.htm garland jeffreys. hail hail rocknroll live] [http://squoi-oop.ifrance.com/topic/tv-lcd/ tv lcd lettore dvd] [http://smegmacheez.ifrance.com/content/view/cd-dj/ cd dj 100s] [http://atrayah.ifrance.com/topic/viper-m.htm viper m1] [http://cocopuff66.ifrance.com/text/directory/geoogle-com/ geoogle com] [http://cocopuff66.ifrance.com/text/directory/djerba-alberghi/ djerba alberghi e hotel] [http://joshuaw-wise.ifrance.com/img/styles/eau-de/ eau de monteil] [http://lekusya.ifrance.com/library/html/ati-/ ati 256 ram] [http://atrayah.ifrance.com/topic/a-team.htm a team. stagione 2] [http://gajar.ifrance.com/html/rx-v.htm rx v550] [http://zeakk.ifrance.com/resources/articles/amd-sempron.htm amd sempron box] [http://lightmyfire0214.ifrance.com/topic/mario-cipriani/ mario cipriani] [http://gabe95.ifrance.com/html/lg-/ lg - tv plasma 42 rz-42px11] [http://mfirishka.ifrance.com/view/new/lassativo.htm lassativo] [http://squoi-oop.ifrance.com/topic/traduci/ traduci] [http://cocopuff66.ifrance.com/text/directory/mp-usb/ mp3 usb2] [http://sm4.ifrance.com/lib/ultima-di/ ultima di raf] [http://joshuaw-wise.ifrance.com/img/styles/uomini-tornati/ uomini tornati dall aldila] [http://lightmyfire0214.ifrance.com/topic/v/ v710] [http://call-shotgun.ifrance.com/view/new/hp-officejet/ hp officejet 7210 all-in-one] [http://cocopuff66.ifrance.com/text/directory/russo-chiara/ russo chiara] [http://horcrionebay.ifrance.com/resources/articles/monza-hotel.htm monza hotel] [http://cocopuff66.ifrance.com/text/directory/jeep-lombardia/ jeep lombardia] [http://lightmyfire0214.ifrance.com/topic/avi-ac/ avi ac3 dvd] [http://lightmyfire0214.ifrance.com/topic/hd-ata/ hd ata100] [http://horcrionebay.ifrance.com/resources/articles/ardes-tk.htm ardes tk45] [http://joshuaw-wise.ifrance.com/img/styles/ventola-v/ ventola 12v] [http://gabe95.ifrance.com/html/batteria-jabra/ batteria jabra bluetooth] [http://horcrionebay.ifrance.com/resources/articles/porno-video.htm porno video gay italiani] [http://lightmyfire0214.ifrance.com/topic/adobe-photoshop/ adobe photoshop 3] [http://call-shotgun.ifrance.com/view/new/monitor-eizo/ monitor eizo lcd m1700] [http://joshuaw-wise.ifrance.com/img/styles/douple/ douple] [http://nokros.ifrance.com/data/scelti-dalle/ scelti dalle tenebre] [http://alishca-st.ifrance.com/text/directory/sony-cp.htm sony cp555] [http://gabe95.ifrance.com/html/necromancer/ necromancer] [http://sm4.ifrance.com/lib/bari-milano/ bari milano] [http://gabe95.ifrance.com/html/letti/ letti] [http://squoi-oop.ifrance.com/topic/scopa-siemens/ scopa siemens] [http://squoi-oop.ifrance.com/topic/mpa/ mpa] [http://zeakk.ifrance.com/resources/articles/telephone.htm telephone] [http://gabe95.ifrance.com/html/donna-nude/ donna nude it] [http://zeakk.ifrance.com/resources/articles/xutos-pontapes.htm xutos pontapes] [http://dejablu503.ifrance.com/description/lib/dreamcast-scart.htm dreamcast scart] [http://gabe95.ifrance.com/html/pajero-/ pajero 2500 td] [http://alishca-st.ifrance.com/text/directory/le-laureande.htm le laureande] [http://nokros.ifrance.com/data/atlantis-modem/ atlantis modem adsl] [http://atrayah.ifrance.com/topic/rischio-totale.htm rischio totale] [http://call-shotgun.ifrance.com/view/new/epson-rd/ epson rd-1] [http://lekusya.ifrance.com/library/html/cartuccia-samsung/ cartuccia samsung clp 510] [http://horcrionebay.ifrance.com/resources/articles/disturbi-della.htm disturbi della motilita gastrica] [http://horcrionebay.ifrance.com/resources/articles/cap-perugia.htm cap perugia] [http://squoi-oop.ifrance.com/topic/azienda-trasporto/ azienda trasporto] [http://gajar.ifrance.com/html/senza-giacca.htm senza giacca] [http://sm4.ifrance.com/lib/memoria-usb/ memoria usb da 5 gb] [http://lightmyfire0214.ifrance.com/topic/usl/ usl 7] [http://zeakk.ifrance.com/resources/articles/partecipazioni-per.htm partecipazioni per matrimoni] [http://zeakk.ifrance.com/resources/articles/obiettivi-canon.htm obiettivi canon eos macro] [http://smegmacheez.ifrance.com/content/view/sankt-gallen/ sankt gallen] [http://zeakk.ifrance.com/resources/articles/zorba.htm zorba] [http://trumanburb.ifrance.com/view/new/compravendita-immobiliare.htm compravendita immobiliare] [http://mfirishka.ifrance.com/view/new/torna-il.htm torna il mago di oz] [http://nokros.ifrance.com/data/frullatore-centrifuga/ frullatore centrifuga] [http://gabe95.ifrance.com/html/geel/ geel] [http://zeakk.ifrance.com/resources/articles/www-blink.htm www blink 182 it] [http://call-shotgun.ifrance.com/view/new/gonario/ gonario] [http://gajar.ifrance.com/html/chevrolet-captiva.htm chevrolet captiva] [http://krychan.ifrance.com/content/view/catherine-rivet.htm catherine rivet] [http://gajar.ifrance.com/html/gary-jules.htm gary jules] [http://lekusya.ifrance.com/library/html/scaricare-programma/ scaricare programma dvd] [http://lightmyfire0214.ifrance.com/topic/gogle-art/ gogle art] [http://nokros.ifrance.com/data/nuova-golf/ nuova golf auto nuove] [http://gabe95.ifrance.com/html/detroit-rock/ detroit rock city kiss] [http://squoi-oop.ifrance.com/topic/fanfulla-il/ fanfulla, il-] [http://sm4.ifrance.com/lib/nieuwpoort/ nieuwpoort] [http://smegmacheez.ifrance.com/content/view/dr-dre/ dr dre testo canzone] [http://dejablu503.ifrance.com/description/lib/hotel-monterosso.htm hotel monterosso] [http://joshuaw-wise.ifrance.com/img/styles/o-zobne/ o zobne] [http://lightmyfire0214.ifrance.com/topic/davidoff-good/ davidoff good life eau de toilette] [http://dejablu503.ifrance.com/description/lib/fessa-aperta.htm fessa aperta gratis] [http://lekusya.ifrance.com/library/html/tic-tac/ tic tac] [http://horcrionebay.ifrance.com/resources/articles/here-without.htm here without yoy] [http://krychan.ifrance.com/content/view/estee-lauder.htm estee lauder bronze powder] [http://dejablu503.ifrance.com/description/lib/midi-file.htm midi file juanes] [http://mfirishka.ifrance.com/view/new/kati.htm kati] [http://cocopuff66.ifrance.com/text/directory/gli-uomini/ gli uomini dal passo pesante] [http://horcrionebay.ifrance.com/resources/articles/ramazzotti-nove.htm ramazzotti nove] [http://call-shotgun.ifrance.com/view/new/turner-atlanta/ turner atlanta 1200] [http://trumanburb.ifrance.com/view/new/argo-h.htm argo 235h] [http://zeakk.ifrance.com/resources/articles/majestic-home.htm majestic home teatre] [http://zeakk.ifrance.com/resources/articles/torremolinos.htm torremolinos] [http://squoi-oop.ifrance.com/topic/sinch/ sinch] [http://trumanburb.ifrance.com/view/new/multifunzione-hp.htm multifunzione hp laser] [http://zeakk.ifrance.com/resources/articles/gioco-da.htm gioco da corsa] [http://smegmacheez.ifrance.com/content/view/zakon-jacega/ zakon jacega] [http://cocopuff66.ifrance.com/text/directory/david-benoit/ david benoit] [http://squoi-oop.ifrance.com/topic/bird-feeders/ bird feeders] [http://squoi-oop.ifrance.com/topic/mares-abyss/ mares abyss 2000] [http://nokros.ifrance.com/data/volo-mombasa/ volo mombasa] [http://call-shotgun.ifrance.com/view/new/asciuga/ asciuga] [http://cocopuff66.ifrance.com/text/directory/el-problema/ el problema] [http://flawedamythyst.ifrance.com/img/styles/provocazione-fatale.htm provocazione fatale] [http://mfirishka.ifrance.com/view/new/toshiba-satellite.htm toshiba satellite a60 - 122] [http://lekusya.ifrance.com/library/html/capitale-dell/ capitale dell ucraina] [http://lightmyfire0214.ifrance.com/topic/www-hotel/ www hotel pollux croazia] [http://squoi-oop.ifrance.com/topic/geraldine-page/ geraldine page] [http://smegmacheez.ifrance.com/content/view/i-sette/ i sette pilastri] [http://nokros.ifrance.com/data/www-miss/ www miss italia 2004 it] [http://smegmacheez.ifrance.com/content/view/hit-parade/ hit parade luglio 2004] [http://atrayah.ifrance.com/topic/www-trenitalia.htm www trenitalia t] [http://trumanburb.ifrance.com/view/new/roma-havana.htm roma havana biglietti aerei] [http://joshuaw-wise.ifrance.com/img/styles/zani-per/ zani per la scuola] [http://joshuaw-wise.ifrance.com/img/styles/hotel-in/ hotel in lazise] [http://mfirishka.ifrance.com/view/new/regali-festa.htm regali festa mamma] [http://call-shotgun.ifrance.com/view/new/balenciaga/ balenciaga] [http://krychan.ifrance.com/content/view/lou-dalfin.htm lou dalfin] [http://sm4.ifrance.com/lib/bellucci-irreversibile/ bellucci irreversibile] [http://horcrionebay.ifrance.com/resources/articles/lockyer-sir.htm lockyer, sir joseph norman] [http://squoi-oop.ifrance.com/topic/moda-mare/ moda mare] [http://mfirishka.ifrance.com/view/new/i-need.htm i need a hero] [http://squoi-oop.ifrance.com/topic/scale-in/ scale in alessandria] [http://horcrionebay.ifrance.com/resources/articles/hercules-fortissimo.htm hercules fortissimo] [http://alishca-st.ifrance.com/text/directory/venus-frankie.htm venus frankie avalon] [http://joshuaw-wise.ifrance.com/img/styles/annunci-massaggiatori/ annunci massaggiatori milano] [http://gabe95.ifrance.com/html/last-get/ last get started] [http://squoi-oop.ifrance.com/topic/correttore-chanel/ correttore chanel] [http://krychan.ifrance.com/content/view/hino-euro.htm hino euro 2004 mp3] [http://call-shotgun.ifrance.com/view/new/philips-al/ philips al plasma 42 1024x1024] [http://nokros.ifrance.com/data/climatizzatori-vendita/ climatizzatori vendita] [http://cocopuff66.ifrance.com/text/directory/http-www/ http www angolotesti it] [http://gajar.ifrance.com/html/giussago.htm giussago] [http://krychan.ifrance.com/content/view/samsung-sm.htm samsung sm 730bf] [http://gajar.ifrance.com/html/torrie-wi.htm torrie wi] [http://sm4.ifrance.com/lib/superstar/ superstar] [http://alishca-st.ifrance.com/text/directory/indirizzo-postale.htm indirizzo postale di alessandra pirelli] [http://smegmacheez.ifrance.com/content/view/sandungeras/ sandungeras] [http://sm4.ifrance.com/lib/star-musicali/ star musicali croazia] [http://smegmacheez.ifrance.com/content/view/forno-incasso/ forno incasso ariston color ghiaccio] [http://nokros.ifrance.com/data/toner-clp/ toner clp 500] [http://dejablu503.ifrance.com/description/lib/catania-.htm catania - bruxelles] [http://zeakk.ifrance.com/resources/articles/engher.htm engher] [http://gabe95.ifrance.com/html/sako-polumenta/ sako polumenta] [http://gabe95.ifrance.com/html/magix-foto/ magix foto su cd dvd 4] [http://zeakk.ifrance.com/resources/articles/moglie-vogliosa.htm moglie vogliosa] [http://dejablu503.ifrance.com/description/lib/lo-stano.htm lo stano percorso 883] [http://horcrionebay.ifrance.com/resources/articles/boca.htm boca] [http://lightmyfire0214.ifrance.com/topic/libero-it/ libero it] [http://nokros.ifrance.com/data/agriturismo-in/ agriturismo in toscana siena] [http://sm4.ifrance.com/lib/dermody-thomas/ dermody, thomas] [http://alishca-st.ifrance.com/text/directory/video-assassinio.htm video assassinio baldoni] [http://zeakk.ifrance.com/resources/articles/cappa-a.htm cappa a parete serie eco] [http://lekusya.ifrance.com/library/html/deportivo/ deportivo] [http://alishca-st.ifrance.com/text/directory/oakley-.htm oakley - fives] [http://joshuaw-wise.ifrance.com/img/styles/on-to/ on to victory] [http://trumanburb.ifrance.com/view/new/goma-paul.htm goma, paul] [http://atrayah.ifrance.com/topic/report-magic.htm report magic] [http://flawedamythyst.ifrance.com/img/styles/foto-di.htm foto di locali per scambisti] [http://squoi-oop.ifrance.com/topic/perras/ perras] [http://lightmyfire0214.ifrance.com/topic/www-jamelia/ www jamelia it] [http://alishca-st.ifrance.com/text/directory/sfondi-pc.htm sfondi pc] == Note ==
+
== Note ==
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''There is no need to hack up a way to disable the firewall.'''
 
'''There is no need to hack up a way to disable the firewall.'''
Line 12: Line 12:
 
65535 allow ip from any to any
 
65535 allow ip from any to any
 
</pre>
 
</pre>
 
 
  
 
== Enabling the Firewall ==
 
== Enabling the Firewall ==
Line 21: Line 19:
 
* Copy one you like from an Intel Mac
 
* Copy one you like from an Intel Mac
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
* [http://wiki.awkwardtv.org/wiki/Install_System_Preferences Install System Preferences] from an Intel Mac and configure as usual.
+
* [[Install System Preferences]] from an Intel Mac and configure as usual.
 +
 
 +
== Enabling the Firewall without an Intel Mac ==
 +
 
 +
It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac.  '''Be warned''' - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.
 +
 
 +
Create the following file as firewall_config.sh in /Users/frontrow.  It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw".  Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.
 +
#!/bin/sh
 +
sudo ipfw -f flush
 +
#sudo ipfw -f list
 +
 +
#exclude loopback traffic
 +
sudo ipfw add 00003 allow all from any to any via lo0
 +
 +
#Deny any spoofed loopback/multicast traffic
 +
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
 +
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
 +
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
 +
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in
 +
 +
#Allow outgoing/established
 +
sudo ipfw add 02050 allow tcp from any to any out
 +
sudo ipfw add 02060 allow tcp from any to any established
 +
 +
#Allow anything from LAN
 +
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any
 +
 +
#Block everything else
 +
sudo ipfw add 12190 deny log tcp from any to any
 +
sudo ipfw add 65535 allow ip from any to any
 +
 
 +
Make sure this script is executable
 +
chmod 755 firewall_config.sh
 +
 
 +
Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):
 +
/Users/frontrow/firewall_config.sh
  
 
[[Category:How-to]]
 
[[Category:How-to]]

Latest revision as of 03:22, 11 January 2009

Note

The AppleTV seems to ship with no firewall rules configured. There is no need to hack up a way to disable the firewall.


In MacOS X, at boot time,
/usr/libexec/FirewallTool
runs, which reads the file
/Library/Preferences/com.apple.sharing.firewall.plist

Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:

-bash-2.05b$ sudo ipfw list
65535 allow ip from any to any

Enabling the Firewall

It is likely that copying over FirewallTool from an Intel Mac will enable MacOS firewall configuration at boot time. In addition, it is neccesary to create /Library/Preferences/com.apple.sharing.firewall.plist. If the prefs plist file does not exist, FirewallTool will not configure ipfw. There are several ways to create this file:

Enabling the Firewall without an Intel Mac

It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac. Be warned - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.

Create the following file as firewall_config.sh in /Users/frontrow. It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw". Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.

#!/bin/sh
sudo ipfw -f flush
#sudo ipfw -f list

#exclude loopback traffic
sudo ipfw add 00003 allow all from any to any via lo0

#Deny any spoofed loopback/multicast traffic
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in

#Allow outgoing/established
sudo ipfw add 02050 allow tcp from any to any out
sudo ipfw add 02060 allow tcp from any to any established

#Allow anything from LAN
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any

#Block everything else
sudo ipfw add 12190 deny log tcp from any to any
sudo ipfw add 65535 allow ip from any to any

Make sure this script is executable

chmod 755 firewall_config.sh

Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):

/Users/frontrow/firewall_config.sh