Difference between revisions of "Configure Firewall"

From AwkwardTV
Jump to: navigation, search
m
m (Enabling the Firewall without an Intel Mac)
 
(42 intermediate revisions by 9 users not shown)
Line 1: Line 1:
[http://klohy.info/img/styles/zia-teresina.htm zia teresina] [http://budget7i.info/lib/calcio-/ calcio  di rigore] [http://manoke.cn/topic/palestre-presso/ palestre presso piazza naziona] [http://manoke.cn/topic/nomi-in/ nomi in cinese] [http://xionny.cn/topic/testo-senza/ testo senza dubbio articolo31] [http://svike.info/view/new/logitech-flat.htm logitech flat] [http://soler.net.cn/data/uma-casa.htm uma casa] [http://wedner.info/content/view/canzoncine-e.htm canzoncine e filastrocche] [http://manoke.cn/topic/i-don/ i don t wanna know di mario winans] [http://svike.info/view/new/first-lady.htm first lady] [http://soler.net.cn/data/voli-roma.htm voli roma palermo] [http://primonona.info/content/view/natchez-nazione/ natchez (nazione)] [http://budget7i.info/lib/dla-slucha/ dla slucha] [http://manoke.cn/topic/seka-key/ seka key] [http://svike.info/view/new/tavolo-porta.htm tavolo porta computer] [http://xionny.cn/topic/lavoro-al/ lavoro al  bar] [http://soler.net.cn/data/trio-aria.htm trio aria lb] [http://svike.info/view/new/lightening.htm lightening] [http://sneck.info/data/vendita-online/ vendita online intimo donna] [http://budget7i.info/lib/infineon/ infineon 512] [http://soler.net.cn/data/custodia-playstation.htm custodia playstation playgear pocket] [http://svike.info/view/new/giacca-tecnica.htm giacca tecnica abbigliamento moto] [http://soler.net.cn/data/midi-vasco.htm midi vasco] [http://veggis.org.cn/resources/articles/cellulari-wind.htm cellulari wind] [http://primonona.info/content/view/kearne-every/ kearne every boys change] [http://joperan.org/data/polti-new/ polti new concept] [http://manoke.cn/topic/buyer-tecnico/ buyer (tecnico) (regione emilia romagna - bologna provincia)] [http://budget7i.info/lib/memoria-da/ memoria da 256] [http://joperan.org/data/barzelletta-su/ barzelletta su berlusconi] [http://polex.com.cn/resources/articles/confronto-tra.htm confronto tra ariosto e tasso] [http://xionny.cn/topic/golden-bowl/ golden bowl, the-] [http://soler.net.cn/data/m-motorola.htm m3588 motorola] [http://klohy.info/img/styles/historia-de.htm historia de chihuahua] [http://primonona.info/content/view/luoghi-incontro/ luoghi incontro coppie esibizioniste] [http://funkall.us/images/small/megaworks/ megaworks 5 1] [http://klohy.info/img/styles/toshiba-mx.htm toshiba m30x 147] [http://wedner.info/content/view/tasso-cambio.htm tasso cambio sterlina euro] [http://klohy.info/img/styles/telecomando-logitech.htm telecomando logitech] [http://polex.com.cn/resources/articles/noleggio-bagni.htm noleggio bagni chimici] [http://wedner.info/content/view/sale-congresso.htm sale congresso] [http://sneck.info/data/gay-vip/ gay vip] [http://funkall.us/images/small/la-magnifica/ la magnifica preda] [http://wedner.info/content/view/prestito-vittorio.htm prestito vittorio veneto] [http://wedner.info/content/view/linotype.htm linotype] [http://wedner.info/content/view/superdotati-campania.htm superdotati campania] [http://joperan.org/data/bizarre-prive/ bizarre prive] [http://veggis.org.cn/resources/articles/la-sagra.htm la sagra dei mille] [http://klohy.info/img/styles/christchurch-hotel.htm christchurch hotel] [http://budget7i.info/lib/zero-articoli/ zero articoli] [http://joperan.org/data/panini/ panini] [http://sneck.info/data/carolina-gf/ carolina gf 4] [http://wedner.info/content/view/talkabout-motorola.htm talkabout motorola telefonia] [http://veggis.org.cn/resources/articles/un-posto.htm un posto al soul] [http://veggis.org.cn/resources/articles/batterie.htm batterie 7110] [http://soler.net.cn/data/clona.htm clona] [http://soler.net.cn/data/jalna.htm jalna] [http://joperan.org/data/sex-pistol/ sex pistol] [http://primonona.info/content/view/partanna/ partanna] [http://klohy.info/img/styles/numana-blu.htm numana blu camping] [http://sneck.info/data/chicco-lampada/ chicco lampada] [http://funkall.us/images/small/pittura-a/ pittura a calce foto] [http://klohy.info/img/styles/house-of.htm house of the time] [http://klohy.info/img/styles/quando-alice.htm quando alice ruppe lo specchio] [http://soler.net.cn/data/nokia-.htm nokia 6101 i] [http://wedner.info/content/view/prov.htm prov] [http://polex.com.cn/resources/articles/la-comparsita.htm la comparsita] [http://sneck.info/data/cardiofrequenzimetro-a/ cardiofrequenzimetro a5 polar] [http://xionny.cn/topic/lampada-videoproiettore/ lampada videoproiettore acer] [http://svike.info/view/new/evanescence-dvd.htm evanescence dvd] [http://wedner.info/content/view/nemorale.htm nemorale] [http://primonona.info/content/view/raimstein/ raimstein] [http://joperan.org/data/abbigliamento-al/ abbigliamento al dettaglio] [http://joperan.org/data/fotoannunci-trans/ fotoannunci trans] [http://xionny.cn/topic/sale-marino/ sale marino integrale] [http://soler.net.cn/data/zoppas-pd.htm zoppas pd 18 r] [http://xionny.cn/topic/strade-americane/ strade americane] [http://svike.info/view/new/lettore-mp.htm lettore mp3 e chiave] [http://wedner.info/content/view/boble-buble.htm boble buble] [http://veggis.org.cn/resources/articles/reggione-campania.htm reggione campania] [http://funkall.us/images/small/vino-falanghina/ vino falanghina] [http://joperan.org/data/lampada-di/ lampada di emergenza] [http://polex.com.cn/resources/articles/lettori-dvd.htm lettori dvd dvx sony] [http://soler.net.cn/data/dadyyankee.htm dadyyankee] [http://klohy.info/img/styles/mobili-antichi.htm mobili antichi scrivanie arredamento] [http://xionny.cn/topic/mp-graph/ mp graph] [http://manoke.cn/topic/www-hotelparadiso/ www hotelparadiso] [http://manoke.cn/topic/lettore-memory/ lettore memory card 4 in 1] [http://svike.info/view/new/gioco-biliardo.htm gioco biliardo gratis] [http://wedner.info/content/view/malmo.htm malmo] [http://veggis.org.cn/resources/articles/video-asiatiche.htm video asiatiche] [http://primonona.info/content/view/tiroide-gatti/ tiroide gatti anziani] [http://polex.com.cn/resources/articles/attenti-a.htm attenti a quei due... ancora insieme] [http://klohy.info/img/styles/scopare-biella.htm scopare biella] [http://joperan.org/data/illuminazione-a/ illuminazione a dinamo] [http://svike.info/view/new/travelpilot-e.htm travelpilot e1] [http://wedner.info/content/view/video-dell.htm video dell ostaggio decapitato in iraq] [http://budget7i.info/lib/test-medicina/ test medicina] [http://xionny.cn/topic/najlepsze-pozostanie/ najlepsze pozostanie] [http://funkall.us/images/small/ricette-cucina/ ricette cucina it] [http://svike.info/view/new/iran-porno.htm iran porno] [http://wedner.info/content/view/stellina.htm stellina 1970] [http://xionny.cn/topic/www-abidjan/ www abidjan net] [http://joperan.org/data/coen-joel/ coen, joel] [http://polex.com.cn/resources/articles/www-twt.htm www twt it] [http://funkall.us/images/small/il-chitarrista/ il chitarrista graziani] [http://sneck.info/data/venezia-parigi/ venezia parigi] [http://polex.com.cn/resources/articles/romeo-an.htm romeo an juliet] [http://klohy.info/img/styles/infrazione-stradale.htm infrazione stradale] [http://funkall.us/images/small/www-ergoitalia/ www ergoitalia it] [http://xionny.cn/topic/tunisian-songs/ tunisian songs] [http://budget7i.info/lib/fly-guy/ fly guy] [http://veggis.org.cn/resources/articles/video-party.htm video party] [http://joperan.org/data/sony-wireless/ sony wireless home theatre] [http://svike.info/view/new/acquistare-diamante.htm acquistare diamante] [http://polex.com.cn/resources/articles/philips-.htm philips - tv lcd 20] [http://svike.info/view/new/sito-ufficiale.htm sito ufficiale biaggio antonacci] [http://veggis.org.cn/resources/articles/lettini-pali.htm lettini pali tommy] [http://manoke.cn/topic/nx/ nx6110 740] [http://funkall.us/images/small/kodak-camera/ kodak camera dock] [http://soler.net.cn/data/home-page.htm home page google] [http://soler.net.cn/data/edoardo.htm edoardo 7] [http://sneck.info/data/conto-corrente/ conto corrente postale] [http://funkall.us/images/small/la-guerra/ la guerra dei gavettoni] [http://klohy.info/img/styles/one-night.htm one night in bangkok] [http://soler.net.cn/data/recupero-dato.htm recupero dato hd danneggiati] [http://joperan.org/data/prova-di/ prova di tecnica e organizzazione aziend] [http://polex.com.cn/resources/articles/yvonne-sanson.htm yvonne sanson] [http://primonona.info/content/view/video-enema/ video enema] [http://sneck.info/data/moto-coltivatore/ moto coltivatore] [http://soler.net.cn/data/welschnofen.htm welschnofen] [http://budget7i.info/lib/cmt-a/ cmt a50] [http://sneck.info/data/live-erotic/ live erotic hot bio room chat free] [http://klohy.info/img/styles/olympus-wide.htm olympus wide zoom] [http://soler.net.cn/data/seagate-gb.htm seagate 400gb sata] [http://xionny.cn/topic/donkey-country/ donkey country] [http://joperan.org/data/obiettivo-nikon/ obiettivo nikon af 70 300] [http://soler.net.cn/data/registratori-dvd.htm registratori dvd vcr] [http://manoke.cn/topic/effetti-musicali/ effetti musicali per dj] [http://xionny.cn/topic/figus/ figus] [http://xionny.cn/topic/sddd/ sddd] [http://soler.net.cn/data/volo-aereo.htm volo aereo da milano a atene] [http://budget7i.info/lib/www-allenatore/ www allenatore com] [http://budget7i.info/lib/batteria-fx/ batteria fx1] [http://xionny.cn/topic/punto-/ punto 2005 mi] [http://sneck.info/data/energy-protector/ energy protector 600] [http://wedner.info/content/view/hammambouhadjar.htm hammam-bou-hadjar] [http://budget7i.info/lib/ordu-provincia/ ordu (provincia)] [http://sneck.info/data/borodin/ borodin] [http://funkall.us/images/small/palmari-ppc/ palmari ppc] [http://soler.net.cn/data/digicom-pc.htm digicom pc card usb 2] [http://wedner.info/content/view/kth-.htm kth - ob6200 256] [http://soler.net.cn/data/lx.htm lx 1170] [http://funkall.us/images/small/chingling/ ching-ling] [http://xionny.cn/topic/bejewel/ bejewel] [http://klohy.info/img/styles/cerca-le.htm cerca le parole] [http://svike.info/view/new/nv-gs.htm nv gs250] [http://manoke.cn/topic/testi-canzoni/ testi canzoni matia bazar] [http://polex.com.cn/resources/articles/girls-in.htm girls in love] [http://wedner.info/content/view/corriere-giorno.htm corriere giorno] [http://wedner.info/content/view/centro-assistenza.htm centro assistenza hp napoli] [http://wedner.info/content/view/palmare-eten.htm palmare eten m-500] [http://sneck.info/data/bmw-x/ bmw x5 in toscana] [http://manoke.cn/topic/notebook-toshiba/ notebook toshiba libretto u100] [http://veggis.org.cn/resources/articles/www-vietsex.htm www vietsex com] [http://sneck.info/data/epson-c/ epson c900] [http://klohy.info/img/styles/ethernet-pcmcia.htm ethernet pcmcia] [http://joperan.org/data/fox-porta/ fox porta 24 sui cellulari] [http://primonona.info/content/view/zafferano-bicchieri/ zafferano bicchieri] [http://manoke.cn/topic/archiviazione-elettronica/ archiviazione elettronica documento] [http://polex.com.cn/resources/articles/napoli-.htm napoli - parigi] [http://primonona.info/content/view/www-natalie/ www natalie imbrulia it] [http://budget7i.info/lib/epson-laser/ epson laser a3] [http://funkall.us/images/small/vips/ vips] [http://budget7i.info/lib/poesie-sull/ poesie sull amicizia] [http://wedner.info/content/view/milano-crotone.htm milano crotone] [http://soler.net.cn/data/sette-dollari.htm sette dollari sul rosso] [http://xionny.cn/topic/scanner-siemens/ scanner siemens] [http://klohy.info/img/styles/giuseppe-mango.htm giuseppe mango] [http://svike.info/view/new/mappa-concettuale.htm mappa concettuale su verga] [http://polex.com.cn/resources/articles/tom-go.htm tom go 300] [http://joperan.org/data/termometro-ad/ termometro ad infrarossi] [http://sneck.info/data/moderna-cucine/ moderna cucine] [http://joperan.org/data/facolta-universitaria/ facolta universitaria informatore medico] [http://sneck.info/data/godp/ godp] [http://xionny.cn/topic/lettore-usb/ lettore usb autoradio] [http://wedner.info/content/view/the-chosen.htm the chosen] [http://budget7i.info/lib/leviamo-le/ leviamo le ancore] [http://soler.net.cn/data/il-re.htm il re in anteprima] [http://polex.com.cn/resources/articles/h.htm h 2] [http://klohy.info/img/styles/menu-di.htm menu di capodanno] [http://wedner.info/content/view/lettore-mp.htm lettore mp3 packard audiostar] [http://manoke.cn/topic/yorkshire-south/ yorkshire, south] [http://xionny.cn/topic/umberto-poli/ umberto poli] [http://klohy.info/img/styles/poly-boy.htm poly boy] [http://joperan.org/data/canon-efs/ canon ef-s 55mm] [http://funkall.us/images/small/carica-batteria/ carica batteria solare] [http://primonona.info/content/view/oh-my/ oh my love] [http://veggis.org.cn/resources/articles/sweet-kiss.htm sweet kiss alin] [http://joperan.org/data/bo-tylko/ bo tylko ty] [http://primonona.info/content/view/lego-avventure/ lego avventure] == Note ==
+
== Note ==
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''There is no need to hack up a way to disable the firewall.'''
 
'''There is no need to hack up a way to disable the firewall.'''
  
  
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pr
+
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pre>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
5A8
 
e>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
 
  
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
Line 14: Line 12:
 
65535 allow ip from any to any
 
65535 allow ip from any to any
 
</pre>
 
</pre>
 
 
  
 
== Enabling the Firewall ==
 
== Enabling the Firewall ==
Line 23: Line 19:
 
* Copy one you like from an Intel Mac
 
* Copy one you like from an Intel Mac
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
* [http://wiki.awkwardtv.org/wiki/Install_System_Preferences Install System Preferences] from an Intel Mac and configure as usual.
+
* [[Install System Preferences]] from an Intel Mac and configure as usual.
 +
 
 +
== Enabling the Firewall without an Intel Mac ==
 +
 
 +
It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac.  '''Be warned''' - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.
 +
 
 +
Create the following file as firewall_config.sh in /Users/frontrow.  It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw".  Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.
 +
#!/bin/sh
 +
sudo ipfw -f flush
 +
#sudo ipfw -f list
 +
 +
#exclude loopback traffic
 +
sudo ipfw add 00003 allow all from any to any via lo0
 +
 +
#Deny any spoofed loopback/multicast traffic
 +
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
 +
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
 +
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
 +
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in
 +
 +
#Allow outgoing/established
 +
sudo ipfw add 02050 allow tcp from any to any out
 +
sudo ipfw add 02060 allow tcp from any to any established
 +
 +
#Allow anything from LAN
 +
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any
 +
 +
#Block everything else
 +
sudo ipfw add 12190 deny log tcp from any to any
 +
sudo ipfw add 65535 allow ip from any to any
 +
 
 +
Make sure this script is executable
 +
chmod 755 firewall_config.sh
 +
 
 +
Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):
 +
/Users/frontrow/firewall_config.sh
  
 
[[Category:How-to]]
 
[[Category:How-to]]

Latest revision as of 03:22, 11 January 2009

Note

The AppleTV seems to ship with no firewall rules configured. There is no need to hack up a way to disable the firewall.


In MacOS X, at boot time,
/usr/libexec/FirewallTool
runs, which reads the file
/Library/Preferences/com.apple.sharing.firewall.plist

Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:

-bash-2.05b$ sudo ipfw list
65535 allow ip from any to any

Enabling the Firewall

It is likely that copying over FirewallTool from an Intel Mac will enable MacOS firewall configuration at boot time. In addition, it is neccesary to create /Library/Preferences/com.apple.sharing.firewall.plist. If the prefs plist file does not exist, FirewallTool will not configure ipfw. There are several ways to create this file:

Enabling the Firewall without an Intel Mac

It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac. Be warned - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.

Create the following file as firewall_config.sh in /Users/frontrow. It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw". Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.

#!/bin/sh
sudo ipfw -f flush
#sudo ipfw -f list

#exclude loopback traffic
sudo ipfw add 00003 allow all from any to any via lo0

#Deny any spoofed loopback/multicast traffic
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in

#Allow outgoing/established
sudo ipfw add 02050 allow tcp from any to any out
sudo ipfw add 02060 allow tcp from any to any established

#Allow anything from LAN
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any

#Block everything else
sudo ipfw add 12190 deny log tcp from any to any
sudo ipfw add 65535 allow ip from any to any

Make sure this script is executable

chmod 755 firewall_config.sh

Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):

/Users/frontrow/firewall_config.sh