Difference between revisions of "Configure Firewall"

From AwkwardTV
Jump to: navigation, search
m
m (Enabling the Firewall without an Intel Mac)
 
(38 intermediate revisions by 9 users not shown)
Line 1: Line 1:
[http://kocarawf.125mb.com/blog/l-alieno.htm l alieno] [http://dleslis.125mb.com/resources/ddr-toshiba.htm ddr toshiba] [http://hahosmer.angelfire.com/html/frigoriferi-whirlpool.htm frigoriferi whirlpool no frost] [http://paryker.125mb.com/styles/movimenti-sociali/ movimenti sociali] [http://bedrew.125mb.com/prolunga-casse.htm prolunga casse] [http://gitedy.125mb.com/blog/carte-italiane/ carte italiane] [http://bedrew.125mb.com/nero-burning.htm nero burning] [http://hoadmoni.125mb.com/styles/frigorifero/ frigorifero 483 3] [http://hoadmoni.125mb.com/styles/kalhana/ kalhana] [http://tibrown.125mb.com/description/xbox-live/ xbox live anche senza carta di credito nella nuova generazione] [http://spdinnie.angelfire.com/html/dvd-movie/ dvd movie factory] [http://elernst.angelfire.com/articles/unlock-lg.htm unlock lg u8210] [http://yonosoyyo.angelfire.com/directory/immobiliare-brunelli.htm immobiliare brunelli] [http://tibrown.125mb.com/description/ford-c/ ford c max km zero] [http://spdinnie.angelfire.com/html/mixer-con/ mixer con bpm] [http://elernst.angelfire.com/articles/www-computer.htm www computer esami ecdl it] [http://hahosmer.angelfire.com/html/parascintille.htm parascintille] [http://tibrown.125mb.com/description/farina-soia/ farina soia] [http://stjollay.125mb.com/topic/www-jaeger/ www jaeger lecoultre com] [http://sawilson.125mb.com/data/hp-photosmart.htm hp photosmart 720] [http://nescogin.125mb.com/content/underage-free.htm underage free pics] [http://gistrate.angelfire.com/html/bachata-nuoro.htm bachata nuoro] [http://wiellico.125mb.com/html/tastiera-wireless.htm tastiera wireless lx] [http://nescogin.125mb.com/content/ministerios-rey.htm ministerios rey de reyes] [http://nescogin.125mb.com/content/madame-web.htm madame web] [http://hoadmoni.125mb.com/styles/cuffie-sony/ cuffie sony senza filo] [http://grdugans.angelfire.com/text/dawn.htm dawn] [http://bedrew.125mb.com/notebok-hp.htm notebok hp] [http://wiellico.125mb.com/html/un-uomo.htm un uomo tranquillo film dvd] [http://blhestrie.125mb.com/web/la-squadriglia/ la squadriglia dei falchi rossi] [http://mamans.125mb.com/topic/archos-av.htm archos av 400] [http://dacornel.125mb.com/data/assistenza-tecnica.htm assistenza tecnica acer bari] [http://paryker.125mb.com/styles/citroen-c/ citroen c2 2004] [http://hoadmoni.125mb.com/styles/nonno-superman/ nonno superman] [http://hahosmer.angelfire.com/html/testo-un.htm testo un amore cosi grande] [http://wiellico.125mb.com/html/canzone-vasco.htm canzone vasco rossi] [http://spdinnie.angelfire.com/html/videotelefono-mobile/ videotelefono mobile] [http://yonosoyyo.angelfire.com/directory/hotel-antibes.htm hotel antibes] [http://blhestrie.125mb.com/web/caldaia-imetec/ caldaia imetec] [http://bedrew.125mb.com/qosmio-double.htm qosmio double layer toshiba portatili] [http://bedrew.125mb.com/hp-scanjet.htm hp scanjet 5590c] [http://awihimmeru.angelfire.com/auto-noleggio.htm auto noleggio capri] [http://mamans.125mb.com/topic/panasonic-rasoi.htm panasonic rasoi] [http://gistrate.angelfire.com/html/as-rock.htm as rock k7s41] [http://hoadmoni.125mb.com/styles/isabel-parra/ isabel parra] [http://slavfondmeister.angelfire.com/styles/hp-designjet.htm hp designjet 110 plus nr] [http://ruwier.125mb.com/evo-nv/ evo n1020v] [http://spdinnie.angelfire.com/html/geografia-italia/ geografia italia] [http://fikimber.125mb.com/lib/volo-rovigo.htm volo rovigo] [http://kocarawf.125mb.com/blog/guta-nu.htm guta nu ma lasa inima] [http://bedrew.125mb.com/ooh-chico.htm ooh chico] [http://stjollay.125mb.com/topic/carey-scandalo/ carey scandalo in tv] [http://blhestrie.125mb.com/web/extrem-biker/ extrem biker] [http://yonosoyyo.angelfire.com/directory/la-casa.htm la casa stregata] [http://wiellico.125mb.com/html/technology-experience.htm technology experience] [http://sibeatri.angelfire.com/html/gli-elfi/ gli elfi] [http://yonosoyyo.angelfire.com/directory/play-station.htm play station 2 silver] [http://degaylor.125mb.com/www-universita/ www universita la sapienza it] [http://sewehner.125mb.com/articles/stampante-epson/ stampante epson a2] [http://hahosmer.angelfire.com/html/james-dean.htm james dean in cofanetto] [http://sewehner.125mb.com/articles/tomtom-go/ tomtom go 700 slow food] [http://mamans.125mb.com/topic/ricoh-aficio.htm ricoh aficio 2018d] [http://mcclaise.angelfire.com/description/logitech-laser/ logitech laser mouse cordless mx610] [http://dleslis.125mb.com/resources/charlie-parker.htm charlie parker] [http://dleslis.125mb.com/resources/chirurgo-plastico.htm chirurgo plastico] [http://hoadmoni.125mb.com/styles/sfondi-per/ sfondi per pc] [http://dleslis.125mb.com/resources/file-torrent.htm file torrent] [http://sawilson.125mb.com/data/www-lancome.htm www lancome it] [http://mamans.125mb.com/topic/acer-wlmi.htm acer wlmi 4002] [http://champ-alnite.angelfire.com/mx-.htm mx 5 sport] [http://ruwier.125mb.com/nick-of/ nick of time] [http://tibrown.125mb.com/description/immagini-gatto/ immagini gatto] [http://morudd.angelfire.com/web/sudamerica-viaggi/ sudamerica viaggi] [http://awihimmeru.angelfire.com/holux-gps.htm holux gps bluetooth gr236 slim] [http://sewehner.125mb.com/articles/angeli-e/ angeli e insetti] [http://dleslis.125mb.com/resources/jvc-vhs.htm jvc vhs] [http://champ-alnite.angelfire.com/inni-rugby.htm inni rugby] [http://gitedy.125mb.com/blog/trentino-alto/ trentino alto adige alberghi pensioni] [http://mamans.125mb.com/topic/romeo-and.htm romeo and juliet dire strait] [http://gitedy.125mb.com/blog/trevi-dvd/ trevi dvd 3007] [http://vegrigsb.angelfire.com/resources/midi-fille.htm midi fille slow] [http://wiellico.125mb.com/html/edelweiss-starring.htm edelweiss starring] [http://kocarawf.125mb.com/blog/immagini-di.htm immagini di winnie the pooh] [http://slavfondmeister.angelfire.com/styles/torresan-mobili.htm torresan mobili] [http://wiellico.125mb.com/html/kv-.htm kv010  usb 2 0 kvm switch sitecom] [http://tibrown.125mb.com/description/go-now/ go now] [http://slavfondmeister.angelfire.com/styles/klv-lmrx.htm klv l42mrx1] [http://degaylor.125mb.com/hoover-aspirapolveri/ hoover aspirapolveri parquet] [http://requidim.angelfire.com/web/anthony-santos.htm anthony santos] [http://dacornel.125mb.com/data/frigoriferi.htm frigoriferi] [http://ruwier.125mb.com/trans-a/ trans a roma] [http://amarymuk.angelfire.com/html/nokia-route.htm nokia route 66 mobile italia 2005] [http://blhestrie.125mb.com/web/ys-napishtim/ ys napishtim] [http://sibeatri.angelfire.com/html/mp/ mp 100] [http://morudd.angelfire.com/web/dragostea-bin/ dragostea bin ozone] [http://tibrown.125mb.com/description/lampade-esterni/ lampade esterni] [http://sewehner.125mb.com/articles/bambola-assassina/ bambola assassina 2] [http://stjollay.125mb.com/topic/copione-di/ copione di grease] [http://wiellico.125mb.com/html/valigetta-metallica.htm valigetta metallica] [http://mcclaise.angelfire.com/description/eos-italia/ eos italia] [http://woharwoo.angelfire.com/data/rispondi-a/ rispondi a sto telefono] [http://grdugans.angelfire.com/text/clarence-sms.htm clarence sms] [http://bedrew.125mb.com/escor-treviso.htm escor treviso] [http://ruwier.125mb.com/ford-via/ ford via della pisana] [http://nescogin.125mb.com/content/malcom.htm malcom] [http://tibrown.125mb.com/description/citroen-pluriel/ citroen pluriel hdi] [http://sewehner.125mb.com/articles/televisori-thomson/ televisori thomson 20] [http://hahosmer.angelfire.com/html/inculate-video.htm inculate video] [http://grdugans.angelfire.com/text/coda.htm coda 70] [http://elernst.angelfire.com/articles/centro-fuoristada.htm centro fuoristada in molise] [http://sewehner.125mb.com/articles/enlaces-de/ enlaces de belinda] [http://degaylor.125mb.com/fax-scanner/ fax scanner] [http://paryker.125mb.com/styles/stereo-/ stereo 28 tv color] [http://spdinnie.angelfire.com/html/mp-canzone/ mp3 canzone] [http://blhestrie.125mb.com/web/lisa-hunt/ lisa hunt] [http://tibrown.125mb.com/description/hp/ hp 6122] [http://vegrigsb.angelfire.com/resources/pedal-pumping.htm pedal pumping] [http://blhestrie.125mb.com/web/corde-ernie/ corde ernie ball] [http://blhestrie.125mb.com/web/yamaha-ysp/ yamaha ysp1] [http://fikimber.125mb.com/lib/touch-my.htm touch my tala] [http://bedrew.125mb.com/athlon-x.htm athlon64 x2 4200 2 2ghz 2x512kb] [http://woharwoo.angelfire.com/data/campbell/ campbell] [http://grdugans.angelfire.com/text/hard-disk.htm hard disk da 10 000 rpm sata] [http://fikimber.125mb.com/lib/annunci-trans.htm annunci trans in lombardia] [http://champ-alnite.angelfire.com/a-gps.htm a620 gps mouse] [http://nescogin.125mb.com/content/babki.htm babki] [http://bedrew.125mb.com/emminem.htm emminem] [http://nescogin.125mb.com/content/alms.htm al1715ms  17] [http://paryker.125mb.com/styles/continuavano/ continuavano] [http://ruwier.125mb.com/rover-/ rover 25 14 club] [http://nescogin.125mb.com/content/ballade-des.htm ballade des pendus la] [http://mamans.125mb.com/topic/albergo-livigno.htm albergo livigno] [http://dleslis.125mb.com/resources/persia.htm persia] [http://grdugans.angelfire.com/text/lg-ls.htm lg l1930s] [http://bedrew.125mb.com/ferrari-f.htm ferrari f355 auto] [http://mamans.125mb.com/topic/photo-s.htm photo 1290s] [http://mamans.125mb.com/topic/filtro-polvere.htm filtro polvere] [http://kocarawf.125mb.com/blog/il-passo.htm il passo sospeso della cicogna] [http://tibrown.125mb.com/description/salsa-sensual/ salsa sensual] [http://dacornel.125mb.com/data/kirincup.htm kirincup] [http://sewehner.125mb.com/articles/gigi-t/ gigi t bone] [http://tibrown.125mb.com/description/radiografia-torace/ radiografia torace] [http://fikimber.125mb.com/lib/bubble-bobbles.htm bubble bobbles 2] [http://degaylor.125mb.com/palmare-hp/ palmare hp 1710] [http://mamans.125mb.com/topic/patrizia-rosetti.htm patrizia rosetti video] [http://vegrigsb.angelfire.com/resources/gzmg-videocamere.htm gzmg videocamere] [http://hahosmer.angelfire.com/html/aspirapolvere-w.htm aspirapolvere 1000w] [http://dacornel.125mb.com/data/erpes.htm erpes] [http://nescogin.125mb.com/content/eagle-fish.htm eagle fish mark 320] [http://woharwoo.angelfire.com/data/universita-di/ universita di scienze] [http://yarobiso.angelfire.com/text/madison.htm madison] [http://mamans.125mb.com/topic/nuova-audi.htm nuova audi a6 3 serie diesel auto nuove] [http://tibrown.125mb.com/description/trombettisti/ trombettisti] [http://amarymuk.angelfire.com/html/gps-bluetooth.htm gps bluetooth per nokia] [http://blhestrie.125mb.com/web/motorola-ricetrasmettitori/ motorola ricetrasmettitori] [http://gistrate.angelfire.com/html/kit-decoder.htm kit decoder satellitare] [http://amarymuk.angelfire.com/html/bologna-kef.htm bologna kef] [http://champ-alnite.angelfire.com/medion.htm medion] [http://blhestrie.125mb.com/web/inizio-partita/ inizio partita italia svezia] [http://stjollay.125mb.com/topic/zaranj/ zaranj] [http://anethel.angelfire.com/nuova-astra.htm nuova astra] [http://nescogin.125mb.com/content/tv-plasma.htm tv plasma hitachi hdtv] [http://mamans.125mb.com/topic/banca-sondrio.htm banca sondrio] [http://hoadmoni.125mb.com/styles/imperialismo/ imperialismo] [http://mamans.125mb.com/topic/polygon-cruncher.htm polygon cruncher] [http://spdinnie.angelfire.com/html/steckborn/ steckborn] [http://sewehner.125mb.com/articles/deep-space/ deep space 1] [http://wiellico.125mb.com/html/albergo-montreal.htm albergo montreal] [http://dleslis.125mb.com/resources/rischio-sicuro.htm rischio sicuro] [http://awihimmeru.angelfire.com/tiziano-ferro.htm tiziano ferro feat jamelia] [http://mamans.125mb.com/topic/bitter-sweet.htm bitter sweet sympony] [http://awihimmeru.angelfire.com/pannello-fotovoltaico.htm pannello fotovoltaico] [http://sewehner.125mb.com/articles/mercedes-classe/ mercedes classe c 2005] [http://gitedy.125mb.com/blog/samsung-x/ samsung x200] [http://stjollay.125mb.com/topic/gina-monzo/ gina monzo] [http://dleslis.125mb.com/resources/acer-tv.htm acer tv lcd] [http://sewehner.125mb.com/articles/www-grand/ www grand hotel excelsio ap it] [http://morudd.angelfire.com/web/i-am/ i am hitomi yaida] [http://wiellico.125mb.com/html/kenwood-dvf.htm kenwood dvf] [http://nescogin.125mb.com/content/cellulite-rimedi.htm cellulite rimedi naturali] [http://sibeatri.angelfire.com/html/byke/ byke] [http://wiellico.125mb.com/html/dermato.htm dermato] [http://kocarawf.125mb.com/blog/i-quiz.htm i quiz] [http://elernst.angelfire.com/articles/calendario-alessia.htm calendario alessia ventura] [http://fikimber.125mb.com/lib/www-bbcmundo.htm www bbcmundo com] [http://bedrew.125mb.com/puramente-casuale.htm puramente casuale] [http://wiellico.125mb.com/html/kano-stato.htm kano (stato)] [http://ruwier.125mb.com/la-grande/ la grande corsa] [http://amarymuk.angelfire.com/html/www-plaboy.htm www plaboy com] [http://mamans.125mb.com/topic/birba.htm birba] [http://degaylor.125mb.com/teac-hdpuk/ teac hd15puk] [http://mamans.125mb.com/topic/soma-dollara.htm soma dollara] [http://gitedy.125mb.com/blog/balla-kannone/ balla kannone] [http://requidim.angelfire.com/web/nuove-foto.htm nuove foto canalis] [http://anethel.angelfire.com/annette-bening.htm annette bening] [http://hoadmoni.125mb.com/styles/sauna-pompei/ sauna pompei chiasso] [http://sewehner.125mb.com/articles/percorsi-esame/ percorsi esame maturita] [http://paryker.125mb.com/styles/home-crown/ home crown] [http://hahosmer.angelfire.com/html/balanus.htm balanus] [http://tibrown.125mb.com/description/rotoloni-regine/ rotoloni regine] == Note ==
+
== Note ==
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''There is no need to hack up a way to disable the firewall.'''
 
'''There is no need to hack up a way to disable the firewall.'''
  
  
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pr
+
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pre>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
5A8
 
e>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
 
  
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
Line 14: Line 12:
 
65535 allow ip from any to any
 
65535 allow ip from any to any
 
</pre>
 
</pre>
 
 
  
 
== Enabling the Firewall ==
 
== Enabling the Firewall ==
Line 23: Line 19:
 
* Copy one you like from an Intel Mac
 
* Copy one you like from an Intel Mac
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
* [http://wiki.awkwardtv.org/wiki/Install_System_Preferences Install System Preferences] from an Intel Mac and configure as usual.
+
* [[Install System Preferences]] from an Intel Mac and configure as usual.
 +
 
 +
== Enabling the Firewall without an Intel Mac ==
 +
 
 +
It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac.  '''Be warned''' - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.
 +
 
 +
Create the following file as firewall_config.sh in /Users/frontrow.  It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw".  Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.
 +
#!/bin/sh
 +
sudo ipfw -f flush
 +
#sudo ipfw -f list
 +
 +
#exclude loopback traffic
 +
sudo ipfw add 00003 allow all from any to any via lo0
 +
 +
#Deny any spoofed loopback/multicast traffic
 +
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
 +
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
 +
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
 +
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in
 +
 +
#Allow outgoing/established
 +
sudo ipfw add 02050 allow tcp from any to any out
 +
sudo ipfw add 02060 allow tcp from any to any established
 +
 +
#Allow anything from LAN
 +
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any
 +
 +
#Block everything else
 +
sudo ipfw add 12190 deny log tcp from any to any
 +
sudo ipfw add 65535 allow ip from any to any
 +
 
 +
Make sure this script is executable
 +
chmod 755 firewall_config.sh
 +
 
 +
Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):
 +
/Users/frontrow/firewall_config.sh
  
 
[[Category:How-to]]
 
[[Category:How-to]]

Latest revision as of 03:22, 11 January 2009

Note

The AppleTV seems to ship with no firewall rules configured. There is no need to hack up a way to disable the firewall.


In MacOS X, at boot time,
/usr/libexec/FirewallTool
runs, which reads the file
/Library/Preferences/com.apple.sharing.firewall.plist

Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:

-bash-2.05b$ sudo ipfw list
65535 allow ip from any to any

Enabling the Firewall

It is likely that copying over FirewallTool from an Intel Mac will enable MacOS firewall configuration at boot time. In addition, it is neccesary to create /Library/Preferences/com.apple.sharing.firewall.plist. If the prefs plist file does not exist, FirewallTool will not configure ipfw. There are several ways to create this file:

Enabling the Firewall without an Intel Mac

It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac. Be warned - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.

Create the following file as firewall_config.sh in /Users/frontrow. It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw". Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.

#!/bin/sh
sudo ipfw -f flush
#sudo ipfw -f list

#exclude loopback traffic
sudo ipfw add 00003 allow all from any to any via lo0

#Deny any spoofed loopback/multicast traffic
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in

#Allow outgoing/established
sudo ipfw add 02050 allow tcp from any to any out
sudo ipfw add 02060 allow tcp from any to any established

#Allow anything from LAN
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any

#Block everything else
sudo ipfw add 12190 deny log tcp from any to any
sudo ipfw add 65535 allow ip from any to any

Make sure this script is executable

chmod 755 firewall_config.sh

Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):

/Users/frontrow/firewall_config.sh