Difference between revisions of "Configure Firewall"

From AwkwardTV
Jump to: navigation, search
m
m (Enabling the Firewall without an Intel Mac)
 
(34 intermediate revisions by 9 users not shown)
Line 1: Line 1:
[http://nibko.info/data/modem-adsl.htm modem adsl2 planet] [http://puli.org.cn/web/come-don/ come don chisciotte] [http://nibko.info/data/inno-giro.htm inno giro italia] [http://puli.org.cn/web/w/ w250] [http://puli.org.cn/web/numeri-di/ numeri di fax] [http://puli.org.cn/web/giovanni-trapattoni/ giovanni trapattoni] [http://nibko.info/data/troieit.htm troie,it] [http://italnet.net.cn/img/mi-consenta/ mi consenta si contenga] [http://nibko.info/data/iuniverse-com.htm iuniverse com] [http://nibko.info/data/la-donna.htm la donna, il sesso, il superuomo] [http://nibko.info/data/autonoleggio-a.htm autonoleggio a reggio calabria] [http://hangzhau.cn/html/sistema-tributario/ sistema tributario tedesco] [http://zodip.info/description/ergotismo.htm ergotismo] [http://nibko.info/data/silvi-marina.htm silvi marina albergo] [http://italnet.net.cn/img/albergo-riviera/ albergo riviera romagnola] [http://italnet.net.cn/img/delmas/ delmas] [http://nibko.info/data/campeggio-parigi.htm campeggio parigi] [http://puli.org.cn/web/eva-gonzalez/ eva gonzalez] [http://nibko.info/data/libri-e.htm libri e racconti vari] [http://zodip.info/description/dizionario-tedesco.htm dizionario tedesco italiano] [http://italnet.net.cn/img/barinight-com/ barinight com] [http://zodip.info/description/dvdram-.htm dvd-ram 9 4gb] [http://italnet.net.cn/img/detergente-intimo/ detergente intimo] [http://nibko.info/data/toner-canon.htm toner canon mf3110] [http://zodip.info/description/integratori-vitamina.htm integratori vitamina b] [http://zodip.info/description/riffa.htm riffa] [http://hangzhau.cn/html/dvb-schede/ dvb schede tv] [http://hangzhau.cn/html/immagini-di/ immagini di chaplin] [http://nibko.info/data/custodia-subacquea.htm custodia subacquea hp] [http://hangzhau.cn/html/temi-francese/ temi francese] [http://italnet.net.cn/img/eon-nissan/ eon nissan] [http://zodip.info/description/cartier-orologio.htm cartier orologio] [http://hangzhau.cn/html/inchiostro-cartuccia/ inchiostro cartuccia] [http://zodip.info/description/asdreni.htm asdreni] [http://puli.org.cn/web/kodak-easyshare/ kodak easyshare cx7525] [http://puli.org.cn/web/melody-rolling/ melody rolling stones] [http://nibko.info/data/arano-giovanni.htm arano giovanni pascoli] [http://zodip.info/description/condizionatore.htm condizionatore 9000] [http://hangzhau.cn/html/sangiorgio-lava/ sangiorgio lava asciuga] [http://hangzhau.cn/html/samsung-batteria/ samsung batteria videocamera] [http://zodip.info/description/ceolin-group.htm ceolin group] [http://hangzhau.cn/html/obsession-no/ obsession no es amor adventura] [http://zodip.info/description/victoria-sil.htm victoria sil] [http://puli.org.cn/web/canon-efs/ canon efs] [http://italnet.net.cn/img/traduzione-i/ traduzione i don t want you bach] [http://nibko.info/data/loghi-operatore.htm loghi operatore gratis] [http://nibko.info/data/testo-di.htm testo di if aint got you] [http://nibko.info/data/vini-svezia.htm vini svezia] [http://italnet.net.cn/img/kasa-mp/ kasa mp3] [http://nibko.info/data/yu-gi.htm yu gi oh le carte delle divinita egizie] [http://zodip.info/description/max-scopate.htm max scopate pompini inculate] [http://nibko.info/data/divx-lcd.htm divx lcd tv] [http://nibko.info/data/medal-gere.htm medal gere solid] [http://italnet.net.cn/img/caravan-in/ caravan -in the land] [http://hangzhau.cn/html/www-vrt/ www vrt be] [http://hangzhau.cn/html/psp-e/ psp e cavo usb] [http://italnet.net.cn/img/richard-anthony/ richard anthony] [http://zodip.info/description/music-mixer.htm music mixer] [http://puli.org.cn/web/gps-per/ gps per eten] [http://italnet.net.cn/img/cameron-diaz/ cameron diaz] [http://italnet.net.cn/img/zuchero-everybody/ zuchero everybody] [http://italnet.net.cn/img/lenta/ lenta] [http://nibko.info/data/the-jamba.htm the jamba] [http://puli.org.cn/web/condoni-fiscali/ condoni fiscali] [http://zodip.info/description/memoria-ram.htm memoria ram 256 sdram] [http://puli.org.cn/web/rebelat/ rebelat] [http://italnet.net.cn/img/marron-/ marron 5 this love] [http://hangzhau.cn/html/www-brasile/ www brasile tour it] [http://zodip.info/description/belkin-switch.htm belkin switch kvm] [http://nibko.info/data/nam-june.htm nam june paik] [http://zodip.info/description/world-wrestling.htm world wrestling history. vol. 01] [http://puli.org.cn/web/bella-non/ bella non piangere] [http://italnet.net.cn/img/polo-confortline/ polo confortline 1 4 nuova] [http://puli.org.cn/web/jacques-bogart/ jacques bogart] [http://puli.org.cn/web/giochi-gratis/ giochi gratis motorolav525] [http://nibko.info/data/masterizzatore-cd.htm masterizzatore cd dvd esterno] [http://zodip.info/description/www-monica.htm www monica setta it] [http://puli.org.cn/web/agordo-oristano/ agordo oristano] [http://hangzhau.cn/html/bombjack/ bombjack] [http://hangzhau.cn/html/lpd-alan/ lpd alan 507] [http://hangzhau.cn/html/dvd-r/ dvd r vcr] [http://hangzhau.cn/html/xio/ xio] [http://puli.org.cn/web/brother-fax/ brother fax segreteria] [http://zodip.info/description/testi-michael.htm testi michael bouble] [http://hangzhau.cn/html/paga-sindacale/ paga sindacale] [http://nibko.info/data/medicina-fibrosi.htm medicina fibrosi cistica] [http://nibko.info/data/video-camera.htm video camera dvd videocamere jvc] [http://zodip.info/description/viaggio-a.htm viaggio a mikonos] [http://zodip.info/description/kef.htm kef] [http://puli.org.cn/web/accessori-computer/ accessori computer] [http://hangzhau.cn/html/daddy-yankee/ daddy yankee dimelo] [http://puli.org.cn/web/kit-di/ kit di pulizia cd rom] [http://zodip.info/description/gioco-scemenza.htm gioco scemenza 2005] [http://italnet.net.cn/img/marley/ marley] [http://nibko.info/data/giochi-oror.htm giochi oror] [http://italnet.net.cn/img/kunta-kinte/ kunta kinte] [http://puli.org.cn/web/te-cert/ te cert] [http://nibko.info/data/golf-.htm golf 5 fsi] [http://hangzhau.cn/html/file-karaoke/ file karaoke] [http://puli.org.cn/web/x-srl/ x srl] [http://zodip.info/description/greco-esame.htm greco esame maturita 2004] [http://italnet.net.cn/img/incasso-frigo/ incasso frigo] [http://hangzhau.cn/html/blutengel/ blutengel] [http://hangzhau.cn/html/fideuram-it/ fideuram it] [http://nibko.info/data/aziende-a.htm aziende a napoli per riciclo della plastica] [http://puli.org.cn/web/totally-spies/ totally spies] [http://puli.org.cn/web/indesit-ra/ indesit ra 24] [http://zodip.info/description/me-ne.htm me ne andro] [http://puli.org.cn/web/dragonmoon-gratis/ dragonmoon gratis] [http://italnet.net.cn/img/hp-computer/ hp computer workstation] [http://italnet.net.cn/img/video-porno/ video porno manga gartuiti] [http://zodip.info/description/sam-raimi.htm sam raimi] [http://zodip.info/description/pigalle.htm pigalle] [http://hangzhau.cn/html/testo-oc/ testo oc accordi] [http://italnet.net.cn/img/luxor-amun/ luxor amun rising] [http://nibko.info/data/macchina-giardino.htm macchina giardino] [http://puli.org.cn/web/dvdrw-recorder/ dvd-rw recorder] [http://puli.org.cn/web/d-p/ d p r 283 2000] [http://hangzhau.cn/html/deejay-parade/ deejay parade 1994] [http://hangzhau.cn/html/kit-inchiostro/ kit inchiostro carta canon] [http://hangzhau.cn/html/la-vita/ la vita e bella nicola piovani] [http://nibko.info/data/palla-bianca.htm palla bianca] [http://puli.org.cn/web/nelly-video/ nelly video] [http://hangzhau.cn/html/gratis-video/ gratis video de vieth] [http://nibko.info/data/telecamera-canon.htm telecamera canon] [http://puli.org.cn/web/coppia-abruzzese/ coppia abruzzese] [http://nibko.info/data/centro-per.htm centro per l impiego di cesena] [http://italnet.net.cn/img/smart-piemonte/ smart piemonte] [http://zodip.info/description/foto-tatuaggi.htm foto tatuaggi egiziani] [http://zodip.info/description/canon-eos.htm canon eos] [http://italnet.net.cn/img/siemens/ siemens 720] [http://puli.org.cn/web/la-donna/ la donna... un male necessario] [http://nibko.info/data/zombie-the.htm zombie the cramberris] [http://hangzhau.cn/html/carrozzerie-auto/ carrozzerie auto motore a scoppio] [http://zodip.info/description/us-robotics.htm us robotics 56k] [http://italnet.net.cn/img/cristina-guerra/ cristina guerra] [http://zodip.info/description/masterizzazione-cd.htm masterizzazione cd 90] [http://puli.org.cn/web/hengchun/ hengchun] [http://hangzhau.cn/html/calendarios-sexis/ calendarios sexis] [http://hangzhau.cn/html/topannunci/ topannunci] [http://nibko.info/data/easy-share.htm easy share] [http://nibko.info/data/laura-e.htm laura e mauro] [http://zodip.info/description/cassette-audio.htm cassette audio] [http://italnet.net.cn/img/punguta/ punguta] [http://italnet.net.cn/img/temi-d/ temi d italiano svolti] [http://italnet.net.cn/img/adsl-usb/ adsl usb modem] [http://italnet.net.cn/img/transizioni-pinnacle/ transizioni pinnacle studio] [http://puli.org.cn/web/controller-dualshock/ controller dualshock 2 playstation 2] [http://puli.org.cn/web/gamepad-converter/ gamepad converter] [http://puli.org.cn/web/lettore-cd/ lettore cd sony cdp] [http://hangzhau.cn/html/rot/ rot] [http://hangzhau.cn/html/iwbank-it/ iwbank it] [http://italnet.net.cn/img/sonata-arctica/ sonata arctica don t say a word] [http://puli.org.cn/web/software-cattura/ software cattura schermate] [http://italnet.net.cn/img/nuttea/ nuttea] [http://italnet.net.cn/img/testo-e/ testo e traduzione nelly furtado try] [http://nibko.info/data/picnic-in.htm picnic in africa] [http://nibko.info/data/thats-why.htm thats why i will be there] [http://zodip.info/description/esame-avvocato.htm esame avvocato 2003] [http://italnet.net.cn/img/belinea-/ belinea 101725 monitor] [http://zodip.info/description/lettori-mp.htm lettori mp3 pen drive 512] [http://puli.org.cn/web/bertoni-alberto/ bertoni alberto] [http://italnet.net.cn/img/new-beetle/ new beetle roma] [http://zodip.info/description/profumo-gianna.htm profumo gianna nannini] [http://puli.org.cn/web/sorrisi-com/ sorrisi com] [http://puli.org.cn/web/imation-usb/ imation usb swivel flash 2 0 drive] [http://zodip.info/description/piccioni.htm piccioni] [http://italnet.net.cn/img/rock-on/ rock on] [http://italnet.net.cn/img/tubo-irrigazione/ tubo irrigazione] [http://nibko.info/data/universita-di.htm universita di medicina bologna] [http://hangzhau.cn/html/siti-per/ siti per ragazzi] [http://nibko.info/data/pellestrina.htm pellestrina] [http://puli.org.cn/web/frisch-max/ frisch, max] [http://italnet.net.cn/img/canon-tcdc/ canon tc-dc10] [http://puli.org.cn/web/virtual-serial/ virtual serial port activex control] [http://zodip.info/description/guadalete.htm guadalete] [http://italnet.net.cn/img/western-digital/ western digital net center] [http://italnet.net.cn/img/samsung-cd/ samsung cd sc-152] [http://zodip.info/description/carving.htm carving] [http://hangzhau.cn/html/batteria-motorola/ batteria motorola c385] [http://italnet.net.cn/img/registratore-cdr/ registratore cd-r] [http://zodip.info/description/articolo-sportivo.htm articolo sportivo calcio] [http://hangzhau.cn/html/righino/ righino] [http://zodip.info/description/jewel.htm jewel 95] [http://puli.org.cn/web/auguri-fine/ auguri fine anno] [http://italnet.net.cn/img/pavimenti-giardino/ pavimenti giardino] [http://zodip.info/description/apple-mac.htm apple mac mini 1 25 ghz] [http://hangzhau.cn/html/auto-chrysler/ auto chrysler] [http://zodip.info/description/perego-p.htm perego p3] [http://hangzhau.cn/html/joybook-benq/ joybook benq 6000] [http://zodip.info/description/hp-computer.htm hp computer pavilion dv4000] [http://puli.org.cn/web/nel-sole/ nel sole albano carrisi] [http://zodip.info/description/cordless-siemens.htm cordless siemens sl150] [http://nibko.info/data/viaggi-abruzzo.htm viaggi abruzzo] [http://nibko.info/data/prodotto-alimentare.htm prodotto alimentare] [http://puli.org.cn/web/a-tu/ a tu per tu] [http://hangzhau.cn/html/traduzioni-frasi/ traduzioni frasi dall italiano al france] [http://italnet.net.cn/img/tartufi/ tartufi] [http://puli.org.cn/web/red-hot/ red hot chili peppers by the way] [http://hangzhau.cn/html/www-dragonpark/ www dragonpark com] == Note ==
+
== Note ==
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''There is no need to hack up a way to disable the firewall.'''
 
'''There is no need to hack up a way to disable the firewall.'''
  
  
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pr
+
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pre>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
5A8
 
e>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
 
  
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
Line 14: Line 12:
 
65535 allow ip from any to any
 
65535 allow ip from any to any
 
</pre>
 
</pre>
 
 
  
 
== Enabling the Firewall ==
 
== Enabling the Firewall ==
Line 23: Line 19:
 
* Copy one you like from an Intel Mac
 
* Copy one you like from an Intel Mac
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
* [http://wiki.awkwardtv.org/wiki/Install_System_Preferences Install System Preferences] from an Intel Mac and configure as usual.
+
* [[Install System Preferences]] from an Intel Mac and configure as usual.
 +
 
 +
== Enabling the Firewall without an Intel Mac ==
 +
 
 +
It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac.  '''Be warned''' - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.
 +
 
 +
Create the following file as firewall_config.sh in /Users/frontrow.  It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw".  Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.
 +
#!/bin/sh
 +
sudo ipfw -f flush
 +
#sudo ipfw -f list
 +
 +
#exclude loopback traffic
 +
sudo ipfw add 00003 allow all from any to any via lo0
 +
 +
#Deny any spoofed loopback/multicast traffic
 +
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
 +
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
 +
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
 +
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in
 +
 +
#Allow outgoing/established
 +
sudo ipfw add 02050 allow tcp from any to any out
 +
sudo ipfw add 02060 allow tcp from any to any established
 +
 +
#Allow anything from LAN
 +
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any
 +
 +
#Block everything else
 +
sudo ipfw add 12190 deny log tcp from any to any
 +
sudo ipfw add 65535 allow ip from any to any
 +
 
 +
Make sure this script is executable
 +
chmod 755 firewall_config.sh
 +
 
 +
Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):
 +
/Users/frontrow/firewall_config.sh
  
 
[[Category:How-to]]
 
[[Category:How-to]]

Latest revision as of 03:22, 11 January 2009

Note

The AppleTV seems to ship with no firewall rules configured. There is no need to hack up a way to disable the firewall.


In MacOS X, at boot time,
/usr/libexec/FirewallTool
runs, which reads the file
/Library/Preferences/com.apple.sharing.firewall.plist

Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:

-bash-2.05b$ sudo ipfw list
65535 allow ip from any to any

Enabling the Firewall

It is likely that copying over FirewallTool from an Intel Mac will enable MacOS firewall configuration at boot time. In addition, it is neccesary to create /Library/Preferences/com.apple.sharing.firewall.plist. If the prefs plist file does not exist, FirewallTool will not configure ipfw. There are several ways to create this file:

Enabling the Firewall without an Intel Mac

It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac. Be warned - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.

Create the following file as firewall_config.sh in /Users/frontrow. It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw". Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.

#!/bin/sh
sudo ipfw -f flush
#sudo ipfw -f list

#exclude loopback traffic
sudo ipfw add 00003 allow all from any to any via lo0

#Deny any spoofed loopback/multicast traffic
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in

#Allow outgoing/established
sudo ipfw add 02050 allow tcp from any to any out
sudo ipfw add 02060 allow tcp from any to any established

#Allow anything from LAN
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any

#Block everything else
sudo ipfw add 12190 deny log tcp from any to any
sudo ipfw add 65535 allow ip from any to any

Make sure this script is executable

chmod 755 firewall_config.sh

Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):

/Users/frontrow/firewall_config.sh