Difference between revisions of "Configure Firewall"

From AwkwardTV
Jump to: navigation, search
m
m (Enabling the Firewall without an Intel Mac)
 
(36 intermediate revisions by 9 users not shown)
Line 1: Line 1:
[http://busjavka.ifrance.com/hex-canalsat-est/index.html hex canalsat est] [http://angeljazz711.ifrance.com/illegale.html illegale] [http://fluffy-mind.ifrance.com/kiappona.html kiappona] [http://snakeystil.ifrance.com/jeegar-com/index.html jeegar com] [http://risdimpuka.ifrance.com/leava-wherever-you/index.html leava wherever you are] [http://fluffy-mind.ifrance.com/keane-lyrics-everybody.html keane lyrics everybody s changing] [http://pupsik1993.ifrance.com/loga-tanon.html loga tanon] [http://chasingspaces.ifrance.com/graduatoriepermanenti/index.html graduatoriepermanenti] [http://child-ofadot.ifrance.com/isola-aldabra-seychelles.html isola aldabra seychelles] [http://alexandraa80.ifrance.com/laura-ghislandi/index.html laura ghislandi] [http://child-ofadot.ifrance.com/immagini-prno-di-britney.html immagini prno di britney spears] [http://angeljazz711.ifrance.com/infermiere.html infermiere] [http://chasingspaces.ifrance.com/gotica-dark/index.html gotica dark] [http://starcross33.ifrance.com/lbero-it/index.html lbero it] [http://chasingspaces.ifrance.com/go-pato/index.html go pato] [http://cuivenarius.ifrance.com/huey-dumbar-las.html huey dumbar las noches video] [http://pupsik1993.ifrance.com/laboratori-scuola.html laboratori scuola dell infanzia] [http://busjavka.ifrance.com/ho-visto/index.html ho visto] [http://katzella.ifrance.com/hackv7-extr-141/index.html hackv7 extr 141] [http://carbonphoenix.ifrance.com/jeeg-tellina.html jeeg tellina] [http://chasingspaces.ifrance.com/hip-hop-mp3/index.html hip hop mp3] [http://listmishyk.ifrance.com/kiosque/index.html kiosque] [http://plyuh-vios.ifrance.com/in-the-shadown.html in the shadown] [http://eliasn5gh.ifrance.com/liquefy-the.html liquefy the servant] [http://oddonpurpose.ifrance.com/luka-ton-e.html luka ton e] [http://taylors-acolyte.ifrance.com/i-video-di-mina.html i video di mina] [http://katzella.ifrance.com/handsome-family/index.html handsome family] [http://angeljazz711.ifrance.com/il-cuore-come-amore.html il cuore come amore] [http://taylors-acolyte.ifrance.com/ifilm-di-toto.html ifilm di toto] [http://oddonpurpose.ifrance.com/live-is-live.html live is live] [http://snakeystil.ifrance.com/jaime/index.html jaime] [http://fluffy-mind.ifrance.com/kinder-roteo.html kinder roteo] [http://cuivenarius.ifrance.com/he-s-all-right.html he s all right] [http://katzella.ifrance.com/hector-y-titto/index.html hector y titto] [http://plyuh-vios.ifrance.com/il-jazz.html il jazz] [http://oddonpurpose.ifrance.com/lebt-den-der-holz.html lebt den der holz michel noch] [http://katzella.ifrance.com/halleluja-download/index.html halleluja download] [http://snakeystil.ifrance.com/jenny-bertson/index.html jenny bertson] [http://plyuh-vios.ifrance.com/immagini-hard-bizarre.html immagini hard bizarre gratuite no dialer] [http://snakeystil.ifrance.com/jeunnes-mecs/index.html jeunnes mecs] [http://eliasn5gh.ifrance.com/linkinpark-com.html linkinpark com] [http://katzella.ifrance.com/hirai-ken-hitomi/index.html hirai ken hitomi] [http://snakeystil.ifrance.com/juanes-mada-valgo/index.html juanes mada valgo sin tu amor] [http://katzella.ifrance.com/hives/index.html hives] [http://fluffy-mind.ifrance.com/kumral-bomba.html kumral bomba] [http://carbonphoenix.ifrance.com/justine-timberlake.html justine timberlake] [http://alexandraa80.ifrance.com/la-questione-in-israele/index.html la questione in israele] [http://fluffy-mind.ifrance.com/kancelaria.html kancelaria] [http://child-ofadot.ifrance.com/il-cappotto-di-astrakan.html il cappotto di astrakan] [http://eliasn5gh.ifrance.com/leggende-sui-terremoti.html leggende sui terremoti in friuli] [http://cuivenarius.ifrance.com/hotel-di-roma.html hotel di roma] [http://pupsik1993.ifrance.com/long-kanker.html long kanker] [http://busjavka.ifrance.com/hug-grant/index.html hug grant] [http://carbonphoenix.ifrance.com/jonny-depp.html jonny depp] [http://pupsik1993.ifrance.com/letteronza.html letteronza] [http://plyuh-vios.ifrance.com/i-clandestini.html i clandestini riccardo cocciante] [http://pupsik1993.ifrance.com/les-amants-de-saint-jean.html les amants de saint jean] [http://katzella.ifrance.com/henri-manchini/index.html henri manchini] [http://cuivenarius.ifrance.com/how-boy.html how boy] [http://chasingspaces.ifrance.com/hotmaill/index.html hotmaill] [http://plyuh-vios.ifrance.com/il-mito-di-protagora.html il mito di protagora platone] [http://risdimpuka.ifrance.com/lorena-scaccia/index.html lorena scaccia] [http://taylors-acolyte.ifrance.com/ibiza-dj.html ibiza dj] [http://eliasn5gh.ifrance.com/lodi-a-dio-altissimo.html lodi a dio altissimo] [http://angeljazz711.ifrance.com/il-sergente-nella.html il sergente nella neve] [http://risdimpuka.ifrance.com/la-scuola-in/index.html la scuola in america] [http://fluffy-mind.ifrance.com/kavalla-la-valea-di.html kavalla la valea di ianina] [http://carbonphoenix.ifrance.com/just-for-yuo-di-lionel.html just for yuo di lionel richie] [http://angeljazz711.ifrance.com/in-quiete.html in quiete] [http://fluffy-mind.ifrance.com/kowalska-to-co-dobre.html kowalska to co dobre mp3] [http://chasingspaces.ifrance.com/guatemala-com/index.html guatemala com] [http://katzella.ifrance.com/hotel-lugano/index.html hotel lugano] [http://fluffy-mind.ifrance.com/karen-matzenbacher.html karen matzenbacher] [http://plyuh-vios.ifrance.com/in-tutti-i-mie-giorni.html in tutti i mie giorni] [http://thecrownless.ifrance.com/iris-goo-goo/index.html iris goo goo dolls] [http://plyuh-vios.ifrance.com/ice-in-the-sunshine.html ice in the sunshine] [http://oddonpurpose.ifrance.com/lito.html lito] [http://risdimpuka.ifrance.com/lisa-minelli/index.html lisa minelli] [http://chasingspaces.ifrance.com/gianmaria-testa/index.html gianmaria testa] [http://thecrownless.ifrance.com/istito-del-marketing/index.html istito del marketing] [http://chasingspaces.ifrance.com/hiloudaki/index.html hiloudaki] [http://taylors-acolyte.ifrance.com/i-wish.html i wish] [http://thecrownless.ifrance.com/il-libanese/index.html il libanese] [http://busjavka.ifrance.com/hotel-blu-paradiso/index.html hotel blu paradiso] [http://pupsik1993.ifrance.com/lavita-e.html lavita e] [http://angeljazz711.ifrance.com/istuzione-it-patentino.html istuzione it patentino] [http://pupsik1993.ifrance.com/les-folies-de-pigalle.html les folies de pigalle] [http://katzella.ifrance.com/hijack/index.html hijack] [http://eliasn5gh.ifrance.com/latif-dogan.html latif dogan] [http://angeljazz711.ifrance.com/inti-illimani-alturas.html inti illimani alturas] [http://pupsik1993.ifrance.com/legge-sul-lavoro-art.html legge sul lavoro art 26 ordinanza 3] [http://cuivenarius.ifrance.com/hands-to-heaven.html hands to heaven by breathe] [http://snakeystil.ifrance.com/juliana-paes-leme/index.html juliana paes leme] [http://angeljazz711.ifrance.com/il-re-pastore-sinfonia.html il re pastore sinfonia] [http://angeljazz711.ifrance.com/itinerario-su.html itinerario su madrid] [http://snakeystil.ifrance.com/juliana-silveira-nua/index.html juliana silveira nua] [http://plyuh-vios.ifrance.com/il-corriere-di.html il corriere di romagna] [http://taylors-acolyte.ifrance.com/immagini-mms.html immagini mms] [http://child-ofadot.ifrance.com/il-video-di-love-is-only.html il video di love is only a feeling darkn] [http://carbonphoenix.ifrance.com/just-the-way.html just the way you ar] [http://snakeystil.ifrance.com/jasmin-tabatabai/index.html jasmin tabatabai] [http://fluffy-mind.ifrance.com/kissing-you.html kissing you] [http://katzella.ifrance.com/il-testamento/index.html il testamento] [http://snakeystil.ifrance.com/jacki-guerrido/index.html jacki guerrido] [http://thecrownless.ifrance.com/insisto/index.html insisto] [http://katzella.ifrance.com/hongnhun/index.html hongnhun] [http://listmishyk.ifrance.com/katja-kissin/index.html katja kissin] [http://taylors-acolyte.ifrance.com/il-minuetto.html il minuetto] [http://carbonphoenix.ifrance.com/just-my-imagination.html just my imagination gem boy] [http://thecrownless.ifrance.com/il-convento-lonato/index.html il convento lonato] [http://listmishyk.ifrance.com/kodak-ritocco-foto/index.html kodak ritocco foto] [http://plyuh-vios.ifrance.com/il-gazetti-italiani.html il gazetti italiani] [http://taylors-acolyte.ifrance.com/i-dot-t-know.html i dot t know] [http://xxxenichkaa.ifrance.com/la-calle-de-las.html la calle de las sirenas] [http://angeljazz711.ifrance.com/industry.html industry] [http://snakeystil.ifrance.com/julio-acosta/index.html julio acosta con baby rasta] [http://cuivenarius.ifrance.com/hysteria.html hysteria] [http://oddonpurpose.ifrance.com/ligabue-1990.html ligabue 1990] [http://snakeystil.ifrance.com/jfive-feat-charlie-chaplin/index.html jfive feat charlie chaplin] [http://oddonpurpose.ifrance.com/lubeck.html lubeck] [http://starcross33.ifrance.com/lemon-tree/index.html lemon tree] [http://risdimpuka.ifrance.com/le-tagliatelle-di-nonna/index.html le tagliatelle di nonna pina] [http://risdimpuka.ifrance.com/laft-oustide-alone/index.html laft oustide alone] [http://child-ofadot.ifrance.com/ipertesto.html ipertesto] [http://oddonpurpose.ifrance.com/lloto.html lloto] [http://child-ofadot.ifrance.com/itinerario-tra.html itinerario tra roma e kiev] [http://xxxenichkaa.ifrance.com/la-liberta-di.html la liberta di giorgio gaber] [http://katzella.ifrance.com/horror-com/index.html horror com] [http://taylors-acolyte.ifrance.com/ilenia-lazzarin.html ilenia lazzarin] [http://carbonphoenix.ifrance.com/jenny-del-pino.html jenny del pino] [http://carbonphoenix.ifrance.com/jessicarizzofilm-com.html jessicarizzofilm com] [http://xxxenichkaa.ifrance.com/le-uova-da-mangiare.html le uova da mangiare] [http://fluffy-mind.ifrance.com/kirsten-caroline.html kirsten caroline nuda] [http://taylors-acolyte.ifrance.com/i-trucchi-di-heavy.html i trucchi di heavy metal fakk 2] [http://katzella.ifrance.com/home-and-dray/index.html home and dray pet shop boys] [http://chasingspaces.ifrance.com/hotel-havana/index.html hotel havana] [http://xxxenichkaa.ifrance.com/lingua-infiammata.html lingua infiammata] [http://katzella.ifrance.com/if-i-ain-t-got-out/index.html if i ain t got out] [http://oddonpurpose.ifrance.com/ljubi-menja-po.html ljubi menja po francuzsku] [http://chasingspaces.ifrance.com/god-save-the-king/index.html god save the king] [http://pupsik1993.ifrance.com/lorenzi-lorenzo.html lorenzi lorenzo] [http://busjavka.ifrance.com/hotel-zampillo-it/index.html hotel zampillo it] [http://eliasn5gh.ifrance.com/log-v7.html log v7] [http://eliasn5gh.ifrance.com/log-bianchina.html log bianchina v7] [http://snakeystil.ifrance.com/jeden-osieml/index.html jeden osieml] [http://cuivenarius.ifrance.com/hr-net-com.html hr net com] [http://plyuh-vios.ifrance.com/intellettuali-e-totalitarismi.html intellettuali e totalitarismi] [http://fluffy-mind.ifrance.com/kerry-dyer.html kerry dyer] [http://chasingspaces.ifrance.com/grazia-deledda/index.html grazia deledda] [http://oddonpurpose.ifrance.com/los-cinco-latinos.html los cinco latinos] [http://busjavka.ifrance.com/hunzinger/index.html hunzinger] [http://carbonphoenix.ifrance.com/jessica-simpson-porno.html jessica simpson porno] [http://plyuh-vios.ifrance.com/il-bimbo-dentro-tiziano.html il bimbo dentro tiziano ferro] [http://xxxenichkaa.ifrance.com/la-trama-in.html la trama in inglese di il ritratto di do] [http://cuivenarius.ifrance.com/happy-xmas-song.html happy xmas song text] [http://oddonpurpose.ifrance.com/lia19-com.html lia19 com] [http://alexandraa80.ifrance.com/le-barzellette-di-totti/index.html le barzellette di totti] [http://eliasn5gh.ifrance.com/link-porno-gratis.html link porno gratis] [http://xxxenichkaa.ifrance.com/lavorazione-gole-di-suino.html lavorazione gole di suino] [http://plyuh-vios.ifrance.com/i-piu-bei-trans.html i piu bei trans] [http://katzella.ifrance.com/hotels/index.html hotels] [http://risdimpuka.ifrance.com/la-terza-luna/index.html la terza luna] [http://eliasn5gh.ifrance.com/lo-starno-percorso.html lo starno percorso 883] [http://snakeystil.ifrance.com/jou-make-me-wane/index.html jou make me wane] [http://taylors-acolyte.ifrance.com/inno-della-gioia.html inno della gioia] [http://alexandraa80.ifrance.com/l-anziano-nella/index.html l anziano nella famiglia] [http://oddonpurpose.ifrance.com/la-chica-de-ayer.html la chica de ayer] [http://snakeystil.ifrance.com/jane-seymour/index.html jane seymour] [http://busjavka.ifrance.com/hollybarry/index.html hollybarry] [http://katzella.ifrance.com/hexbin/index.html hexbin] [http://pupsik1993.ifrance.com/l-apprendimento-winfred.html l apprendimento winfred f hill] [http://carbonphoenix.ifrance.com/joy.html joy] [http://listmishyk.ifrance.com/kall/index.html kall] [http://child-ofadot.ifrance.com/il-fiume-danubio.html il fiume danubio] [http://pupsik1993.ifrance.com/left-outisde.html left outisde alone] [http://risdimpuka.ifrance.com/liz-hurlei/index.html liz hurlei] [http://starcross33.ifrance.com/luci-a-sa-siro/index.html luci a sa siro] [http://xxxenichkaa.ifrance.com/lavori-manuali-casa.html lavori manuali casa] [http://alexandraa80.ifrance.com/la-distancia/index.html la distancia] [http://alexandraa80.ifrance.com/l-ultimo-bacio/index.html l ultimo bacio] [http://snakeystil.ifrance.com/jack-hensley/index.html jack hensley] [http://thecrownless.ifrance.com/internet-gratis/index.html internet gratis] [http://cuivenarius.ifrance.com/hostess-porno.html hostess porno] [http://thecrownless.ifrance.com/i-biglietti-per/index.html i biglietti per fiorello a milano 2004] [http://taylors-acolyte.ifrance.com/i-segna-zodiacali.html i segna zodiacali] [http://taylors-acolyte.ifrance.com/immaggini-gratis.html immaggini gratis] [http://katzella.ifrance.com/il-mondo-di-frutta/index.html il mondo di frutta candita] [http://alexandraa80.ifrance.com/laura-morante/index.html laura morante nuda] [http://alexandraa80.ifrance.com/loghi-gratuiti/index.html loghi gratuiti] [http://fluffy-mind.ifrance.com/kidman-sul-water.html kidman sul water] [http://thecrownless.ifrance.com/infidelity/index.html infidelity] [http://cuivenarius.ifrance.com/holidae-inn.html holidae inn] [http://starcross33.ifrance.com/lima-spa-vicenza/index.html lima spa vicenza] [http://snakeystil.ifrance.com/i-love-this-sex/index.html i love this sex] [http://pupsik1993.ifrance.com/lottery-results.html lottery results] [http://taylors-acolyte.ifrance.com/italia-karaoke.html italia karaoke] [http://taylors-acolyte.ifrance.com/inventiva.html inventiva] [http://oddonpurpose.ifrance.com/lacuna-coli.html lacuna coli] [http://listmishyk.ifrance.com/kuck-it/index.html kuck it] [http://busjavka.ifrance.com/http-iguinho-ig/index.html http iguinho ig com br iguinho fox htm] == Note ==
+
== Note ==
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''There is no need to hack up a way to disable the firewall.'''
 
'''There is no need to hack up a way to disable the firewall.'''
  
  
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pr
+
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pre>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
5A8
 
e>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
 
  
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
Line 14: Line 12:
 
65535 allow ip from any to any
 
65535 allow ip from any to any
 
</pre>
 
</pre>
 
 
  
 
== Enabling the Firewall ==
 
== Enabling the Firewall ==
Line 23: Line 19:
 
* Copy one you like from an Intel Mac
 
* Copy one you like from an Intel Mac
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
* [http://wiki.awkwardtv.org/wiki/Install_System_Preferences Install System Preferences] from an Intel Mac and configure as usual.
+
* [[Install System Preferences]] from an Intel Mac and configure as usual.
 +
 
 +
== Enabling the Firewall without an Intel Mac ==
 +
 
 +
It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac.  '''Be warned''' - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.
 +
 
 +
Create the following file as firewall_config.sh in /Users/frontrow.  It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw".  Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.
 +
#!/bin/sh
 +
sudo ipfw -f flush
 +
#sudo ipfw -f list
 +
 +
#exclude loopback traffic
 +
sudo ipfw add 00003 allow all from any to any via lo0
 +
 +
#Deny any spoofed loopback/multicast traffic
 +
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
 +
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
 +
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
 +
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in
 +
 +
#Allow outgoing/established
 +
sudo ipfw add 02050 allow tcp from any to any out
 +
sudo ipfw add 02060 allow tcp from any to any established
 +
 +
#Allow anything from LAN
 +
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any
 +
 +
#Block everything else
 +
sudo ipfw add 12190 deny log tcp from any to any
 +
sudo ipfw add 65535 allow ip from any to any
 +
 
 +
Make sure this script is executable
 +
chmod 755 firewall_config.sh
 +
 
 +
Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):
 +
/Users/frontrow/firewall_config.sh
  
 
[[Category:How-to]]
 
[[Category:How-to]]

Latest revision as of 03:22, 11 January 2009

Note

The AppleTV seems to ship with no firewall rules configured. There is no need to hack up a way to disable the firewall.


In MacOS X, at boot time,
/usr/libexec/FirewallTool
runs, which reads the file
/Library/Preferences/com.apple.sharing.firewall.plist

Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:

-bash-2.05b$ sudo ipfw list
65535 allow ip from any to any

Enabling the Firewall

It is likely that copying over FirewallTool from an Intel Mac will enable MacOS firewall configuration at boot time. In addition, it is neccesary to create /Library/Preferences/com.apple.sharing.firewall.plist. If the prefs plist file does not exist, FirewallTool will not configure ipfw. There are several ways to create this file:

Enabling the Firewall without an Intel Mac

It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac. Be warned - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.

Create the following file as firewall_config.sh in /Users/frontrow. It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw". Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.

#!/bin/sh
sudo ipfw -f flush
#sudo ipfw -f list

#exclude loopback traffic
sudo ipfw add 00003 allow all from any to any via lo0

#Deny any spoofed loopback/multicast traffic
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in

#Allow outgoing/established
sudo ipfw add 02050 allow tcp from any to any out
sudo ipfw add 02060 allow tcp from any to any established

#Allow anything from LAN
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any

#Block everything else
sudo ipfw add 12190 deny log tcp from any to any
sudo ipfw add 65535 allow ip from any to any

Make sure this script is executable

chmod 755 firewall_config.sh

Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):

/Users/frontrow/firewall_config.sh