Difference between revisions of "Configure Firewall"

From AwkwardTV
Jump to: navigation, search
m
m (Enabling the Firewall without an Intel Mac)
 
(18 intermediate revisions by 8 users not shown)
Line 1: Line 1:
[http://kialford.ifrance.com/directory/nokia-black/ nokia black] [http://kemenke.ifrance.com/directory/yani.htm yani] [http://chelsxd.ifrance.com/directory/nelson-willie.htm nelson willie] [http://lucornew.ifrance.com/articles/nikon-mm/ nikon 105mm] [http://lucornew.ifrance.com/articles/nuovo-look/ nuovo look per il colore viola] [http://pulema.ifrance.com/small/zeta-reticuli.htm zeta reticuli] [http://flella.ifrance.com/styles/isola-elba.htm isola elba vacanze] [http://sckieffe.ifrance.com/content/gioco-gratis/ gioco gratis cellulare] [http://afreelancespork.ifrance.com/text/ricevitore-gps/ ricevitore gps 16 canali] [http://sonicmaind.ifrance.com/styles/europa-vs.htm europa vs italy] [http://nakramer.ifrance.com/small/settimini.htm settimini] [http://kemenke.ifrance.com/directory/nuova-toyota.htm nuova toyota benzina auto nuove] [http://poriddle.ifrance.com/articles/malanje-provincia/ malanje (provincia)] [http://qizzlary.ifrance.com/resources/americawest-com.htm americawest com] [http://drgreghousemd.ifrance.com/library/tomm-riccio/ tomm riccio] [http://nereinig.ifrance.com/styles/telecamera-digitale.htm telecamera digitale panasonic] [http://pulema.ifrance.com/small/a-tribute.htm a tribute to stevie ray vaughan] [http://stormclouds13.ifrance.com/description/media-integration.htm media integration] [http://xbr00t4lx.ifrance.com/directory/north-dakota.htm north dakota] [http://nakramer.ifrance.com/small/raccordo-a.htm raccordo a t] [http://poriddle.ifrance.com/articles/foto-gratis/ foto gratis di dragonballx] [http://sckieffe.ifrance.com/content/sono-saro/ sono saro saremo neruda] [http://poriddle.ifrance.com/articles/la-tombola/ la tombola] [http://afreelancespork.ifrance.com/text/david-live/ david live] [http://wagreenw.ifrance.com/text/continuazione-di.htm continuazione di 3 metri sopra il cielo] [http://stormclouds13.ifrance.com/description/tastiere-con.htm tastiere con pad] [http://sonicmaind.ifrance.com/styles/casa-rai.htm casa rai uno] [http://sonicmaind.ifrance.com/styles/recupero-dato.htm recupero dato formattati] [http://nereinig.ifrance.com/styles/tutte-e.htm tutte e nessuna] [http://lucornew.ifrance.com/articles/teologia/ teologia] [http://lucornew.ifrance.com/articles/gmini/ gmini 400] [http://lamalone.ifrance.com/web/brother-mfc/ brother mfc 7225n] [http://anskaggs.ifrance.com/resources/armani-profumi.htm armani profumi] [http://romonjon.ifrance.com/directory/per-un/ per un basin] [http://stasenka.ifrance.com/lib/bufo/ bufo] [http://mctungat.ifrance.com/text/giacche-jeans/ giacche jeans donna] [http://mctungat.ifrance.com/text/divas/ divas] [http://scalek.ifrance.com/styles/jocuri/ jocuri] [http://lamalone.ifrance.com/web/hoover-hca/ hoover hca383] [http://kialford.ifrance.com/directory/luigi-vii/ luigi vii] [http://poriddle.ifrance.com/articles/ballade-for/ ballade for adeline] [http://nereinig.ifrance.com/styles/numerazione-maglie.htm numerazione maglie inter 2004 2005] [http://qizzlary.ifrance.com/resources/vspd-allinone.htm vspd allinone] [http://stasenka.ifrance.com/lib/foto-camera/ foto camera digitale canon] [http://lucornew.ifrance.com/articles/venite-adoriamo/ venite adoriamo] [http://sckieffe.ifrance.com/content/apple-powerbook/ apple powerbook 12] [http://nakramer.ifrance.com/small/conrad-veidt.htm conrad veidt] [http://nakramer.ifrance.com/small/wisplus.htm wisplus] [http://mctungat.ifrance.com/text/alla-piazza/ alla piazza] [http://xbr00t4lx.ifrance.com/directory/vallo-della.htm vallo della] [http://poriddle.ifrance.com/articles/hotel-modena/ hotel modena] [http://drgreghousemd.ifrance.com/library/di-/ di 624 d link] [http://sckieffe.ifrance.com/content/wonderful-world/ wonderful world mp3] [http://qizzlary.ifrance.com/resources/programma-tabelle.htm programma tabelle millesimali] [http://scalek.ifrance.com/styles/sangue-sulla/ sangue sulla luna] [http://qizzlary.ifrance.com/resources/boxer-cavalli.htm boxer cavalli intimo uomo maschile] [http://poriddle.ifrance.com/articles/pellicce-/ pellicce  abbigliamento] [http://flella.ifrance.com/styles/bml.htm bml 3] [http://scalek.ifrance.com/styles/theme-pack/ theme pack gratuito per zoo tycoon] [http://xbr00t4lx.ifrance.com/directory/gto-great.htm gto great teacher onizuka disco 9] [http://sonicmaind.ifrance.com/styles/giochi-in.htm giochi in scatola per grandi] [http://pulema.ifrance.com/small/speed-dating.htm speed dating] [http://lamalone.ifrance.com/web/ford-usata/ ford usata] [http://sonicmaind.ifrance.com/styles/de-longhi.htm de longhi friggitrici] [http://mctungat.ifrance.com/text/castellammare/ castellammare] [http://nakramer.ifrance.com/small/testine-per.htm testine per epson 480] [http://kialford.ifrance.com/directory/tv-jvc/ tv jvc 42] [http://kialford.ifrance.com/directory/norme-uni/ norme uni] [http://paheidi.ifrance.com/blog/sony-pc/ sony pc videocamere] [http://xbr00t4lx.ifrance.com/directory/le-rose.htm le rose che non colsi] [http://wagreenw.ifrance.com/text/quello-che.htm quello che le donne non dicono fiorella] [http://paheidi.ifrance.com/blog/uno-strano/ uno strano percosrso] [http://stasenka.ifrance.com/lib/www-foxkids/ www foxkids com] [http://qizzlary.ifrance.com/resources/dvp.htm dvp 762] [http://poriddle.ifrance.com/articles/imbrago/ imbrago] [http://wagreenw.ifrance.com/text/holer.htm holer] [http://afreelancespork.ifrance.com/text/julia/ julia] [http://sonicmaind.ifrance.com/styles/ts-h.htm ts h107] [http://paheidi.ifrance.com/blog/mac-tiger/ mac tiger] [http://paheidi.ifrance.com/blog/offerta-hotel/ offerta hotel verona] [http://hapierce.ifrance.com/text/clio-esport/ clio esport] [http://hapierce.ifrance.com/text/flat-/ flat  tv lcd] [http://nakramer.ifrance.com/small/dusmanie-dusmanie.htm dusmanie dusmanie] [http://drgreghousemd.ifrance.com/library/ragazze-con/ ragazze con tette naturali] [http://xbr00t4lx.ifrance.com/directory/sony-centrino.htm sony centrino 1 2] [http://kemenke.ifrance.com/directory/gerardina-trovato.htm gerardina trovato] [http://flella.ifrance.com/styles/le-vip2.htm le vip nude] [http://flella.ifrance.com/styles/ford-focus.htm ford focus sw 2004] [http://nakramer.ifrance.com/small/florin-salam.htm florin salam daniel] [http://nereinig.ifrance.com/styles/mp-nec.htm mp3 nec e616v] [http://nakramer.ifrance.com/small/silvie-vartan.htm silvie vartan] [http://afreelancespork.ifrance.com/text/hot-blond/ hot blond] [http://mctungat.ifrance.com/text/briana-bancks/ briana bancks] [http://poriddle.ifrance.com/articles/bts-assistant/ bts assistant pme pmi] [http://kialford.ifrance.com/directory/digimax/ digimax 4] [http://flella.ifrance.com/styles/nomi-per.htm nomi per il tuo bebe] [http://chelsxd.ifrance.com/directory/gta-andreas.htm gta andreas pc] [http://kemenke.ifrance.com/directory/ram-sodimm.htm ram sodimm 512 ddr 400] [http://kialford.ifrance.com/directory/utell-com/ utell com] [http://qizzlary.ifrance.com/resources/video-gratuiti.htm video gratuiti sesso] [http://liilliil.freehostia.com/small/testo-di.htm testo di laura pausini] [http://muddernh.freehostia.com/small/porche-con/ porche con animali] [http://cute-krissie.freehostia.com/blog/cepeda.htm cepeda] [http://tapeshoes.freehostia.com/blog/dior-capture/ dior capture r6080] [http://bushidobrown.freehostia.com/directory/itr-isernia.htm itr isernia] [http://dano-mano.freehostia.com/html/villaggio-turistico/ villaggio turistico corsica] [http://bugge.freehostia.com/fiere-nel/ fiere nel veneto oggi 2 6 04] [http://lordavon.freehostia.com/resources/hairy-pussy.htm hairy pussy] [http://bigtyma.freehostia.com/description/golf-/ golf 150 cv] [http://shusik.freehostia.com/styles/fra-elia.htm fra elia] [http://bugge.freehostia.com/anita-sexy/ anita sexy] [http://mesteno.freehostia.com/justin-timberlake/ justin timberlake live from london] [http://dano-mano.freehostia.com/html/code-bez/ code bez tebe] [http://dano-mano.freehostia.com/html/casini-tommaso/ casini tommaso] [http://pilarcruz.freehostia.com/data/riciclaggio-tonner.htm riciclaggio tonner] [http://pilarcruz.freehostia.com/data/grancanaria.htm grancanaria] [http://tapeshoes.freehostia.com/blog/body-donna/ body donna] [http://pilarcruz.freehostia.com/data/hd-.htm hd 37 sharp] [http://yuki-yusia.freehostia.com/accademia-cinema/ accademia cinema] [http://liilliil.freehostia.com/small/traduzio-testi.htm traduzio testi] [http://liilliil.freehostia.com/small/www-stanleybet.htm www stanleybet it] [http://rosencrantz319.freehostia.com/data/olbia-napoli.htm olbia napoli biglietti aerei] [http://bugge.freehostia.com/dvd-con/ dvd con home theatre recorder] [http://rosencrantz319.freehostia.com/data/cartoline-net.htm cartoline net] [http://superchet.freehostia.com/bios-download/ bios download] [http://elita793.freehostia.com/web/rockin-rio/ rockin rio profumi] [http://yuki-yusia.freehostia.com/il-grido/ il grido] [http://lordavon.freehostia.com/resources/edoardo-bennato.htm edoardo bennato] [http://chipper2007.freehostia.com/styles/c-olympus.htm c50 olympus] [http://chipper2007.freehostia.com/styles/gozzo.htm gozzo] [http://bigtyma.freehostia.com/description/sofonisba/ sofonisba] [http://chipper2007.freehostia.com/styles/tour-.htm tour 2004 raf] [http://elita793.freehostia.com/web/storia-del/ storia del pensiero economico] [http://rosencrantz319.freehostia.com/data/lotta-per.htm lotta per la vita] [http://superchet.freehostia.com/getting-even/ getting even] [http://elita793.freehostia.com/web/iwan-i/ iwan i delfi] [http://tapeshoes.freehostia.com/blog/www-plaiboy/ www plaiboy it] [http://bushidobrown.freehostia.com/directory/lexmark-z.htm lexmark z615] [http://koopochka.freehostia.com/directory/sitecom-camera/ sitecom camera] [http://elita793.freehostia.com/web/land-rover/ land rover discovery 2 5 td] [http://lombax.freehostia.com/description/epson-r.htm epson r300 monitor] [http://superchet.freehostia.com/tomtom-mobile/ tomtom mobile italy] [http://rosencrantz319.freehostia.com/data/ibiza-.htm ibiza 1999 seat] [http://bugge.freehostia.com/sreca/ sreca] [http://yuki-yusia.freehostia.com/radioregistratori-mp/ radioregistratori mp3] [http://shusik.freehostia.com/styles/all-home.htm all home teatre lg] [http://cute-krissie.freehostia.com/blog/nanananana.htm nanananana] [http://lombax.freehostia.com/description/smart-nuova.htm smart nuova] [http://rosencrantz319.freehostia.com/data/videocamere-panasonic.htm videocamere panasonic batterie] [http://pilarcruz.freehostia.com/data/lorena-mckennitt.htm lorena mckennitt] [http://bushidobrown.freehostia.com/directory/avventure-di.htm avventure di oliver twist le] [http://bigtyma.freehostia.com/description/clipart-alimento/ clipart alimento] [http://superchet.freehostia.com/bob-sinclar/ bob sinclar s songs] [http://elita793.freehostia.com/web/britax-duo/ britax duo plus] [http://mesteno.freehostia.com/marcela-do/ marcela do bbb4] [http://lombax.freehostia.com/description/genero-dramatico.htm genero dramatico] [http://bugge.freehostia.com/penace/ penace] [http://liilliil.freehostia.com/small/host-usb.htm host usb] [http://lordavon.freehostia.com/resources/filmato-di.htm filmato di kenneth bigley] [http://koopochka.freehostia.com/directory/stricker-der/ stricker der] [http://chipper2007.freehostia.com/styles/cineland.htm cineland] [http://mesteno.freehostia.com/lobos/ lobos] [http://koopochka.freehostia.com/directory/calendario-anna/ calendario anna bruno bolzano 2006] [http://bigtyma.freehostia.com/description/biggie-best/ biggie best] [http://bugge.freehostia.com/hp-ca/ hp c9704a] [http://tapeshoes.freehostia.com/blog/domain/ domain] [http://yuki-yusia.freehostia.com/palmari-con/ palmari con telefono ipaq] [http://elita793.freehostia.com/web/singolo-bisex/ singolo bisex roma] [http://czalex.freehostia.com/articles/corso-di/ corso di teologia] [http://cute-krissie.freehostia.com/blog/industria-delle.htm industria delle telco trento] [http://liilliil.freehostia.com/small/auto-rover.htm auto rover 600] [http://bigtyma.freehostia.com/description/keane-somewhere/ keane somewhere only we know] [http://elita793.freehostia.com/web/health-insurance/ health insurance plan] [http://yuki-yusia.freehostia.com/autobianchi-y/ autobianchi y10] [http://rosencrantz319.freehostia.com/data/locali-hard.htm locali hard] [http://rosencrantz319.freehostia.com/data/viaccess-codes.htm viaccess codes] [http://lordavon.freehostia.com/resources/siti-trans.htm siti trans free] [http://yuki-yusia.freehostia.com/notebook/ notebook 6110] [http://mesteno.freehostia.com/menopausa-precoce/ menopausa precoce] [http://koopochka.freehostia.com/directory/danni-s/ danni s hot box] [http://chipper2007.freehostia.com/styles/maldive-vacanza.htm maldive vacanza] [http://bigtyma.freehostia.com/description/teenies/ teenies] [http://mesteno.freehostia.com/inland-empire/ inland empire] [http://cute-krissie.freehostia.com/blog/i-ragazzi.htm i ragazzi di via panisperna] [http://pilarcruz.freehostia.com/data/palmare-eten.htm palmare eten m500] [http://liilliil.freehostia.com/small/fiera-saie.htm fiera saie] [http://dano-mano.freehostia.com/html/mezzano-lago/ mezzano lago di] [http://shusik.freehostia.com/styles/software-freeware.htm software freeware download] [http://bushidobrown.freehostia.com/directory/delsey-expandream.htm delsey expandream] [http://bushidobrown.freehostia.com/directory/capo-cotta.htm capo cotta] [http://bigtyma.freehostia.com/description/auto-noleggio/ auto noleggio siena] [http://liilliil.freehostia.com/small/e-il.htm e il treno va] [http://bigtyma.freehostia.com/description/john-butler/ john butler] [http://superchet.freehostia.com/tema-di/ tema di maturita 2003 2004 italiano] [http://tapeshoes.freehostia.com/blog/morris-rebekka/ morris rebekka] [http://elita793.freehostia.com/web/io-ti/ io ti amo ma voglio ucciderti] [http://czalex.freehostia.com/articles/concessionari-land/ concessionari land rover roma] [http://muddernh.freehostia.com/small/barber-s/ barber s adagio] [http://lordavon.freehostia.com/resources/modelle-sexy.htm modelle sexy] [http://superchet.freehostia.com/lettori-mp/ lettori mp3 olympus] == Note ==
+
== Note ==
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''There is no need to hack up a way to disable the firewall.'''
 
'''There is no need to hack up a way to disable the firewall.'''
  
  
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pr
+
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pre>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
5A8
 
e>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
 
  
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
Line 14: Line 12:
 
65535 allow ip from any to any
 
65535 allow ip from any to any
 
</pre>
 
</pre>
 
 
  
 
== Enabling the Firewall ==
 
== Enabling the Firewall ==
Line 23: Line 19:
 
* Copy one you like from an Intel Mac
 
* Copy one you like from an Intel Mac
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
* [http://wiki.awkwardtv.org/wiki/Install_System_Preferences Install System Preferences] from an Intel Mac and configure as usual.
+
* [[Install System Preferences]] from an Intel Mac and configure as usual.
 +
 
 +
== Enabling the Firewall without an Intel Mac ==
 +
 
 +
It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac.  '''Be warned''' - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.
 +
 
 +
Create the following file as firewall_config.sh in /Users/frontrow.  It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw".  Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.
 +
#!/bin/sh
 +
sudo ipfw -f flush
 +
#sudo ipfw -f list
 +
 +
#exclude loopback traffic
 +
sudo ipfw add 00003 allow all from any to any via lo0
 +
 +
#Deny any spoofed loopback/multicast traffic
 +
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
 +
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
 +
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
 +
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in
 +
 +
#Allow outgoing/established
 +
sudo ipfw add 02050 allow tcp from any to any out
 +
sudo ipfw add 02060 allow tcp from any to any established
 +
 +
#Allow anything from LAN
 +
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any
 +
 +
#Block everything else
 +
sudo ipfw add 12190 deny log tcp from any to any
 +
sudo ipfw add 65535 allow ip from any to any
 +
 
 +
Make sure this script is executable
 +
chmod 755 firewall_config.sh
 +
 
 +
Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):
 +
/Users/frontrow/firewall_config.sh
  
 
[[Category:How-to]]
 
[[Category:How-to]]

Latest revision as of 03:22, 11 January 2009

Note

The AppleTV seems to ship with no firewall rules configured. There is no need to hack up a way to disable the firewall.


In MacOS X, at boot time,
/usr/libexec/FirewallTool
runs, which reads the file
/Library/Preferences/com.apple.sharing.firewall.plist

Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:

-bash-2.05b$ sudo ipfw list
65535 allow ip from any to any

Enabling the Firewall

It is likely that copying over FirewallTool from an Intel Mac will enable MacOS firewall configuration at boot time. In addition, it is neccesary to create /Library/Preferences/com.apple.sharing.firewall.plist. If the prefs plist file does not exist, FirewallTool will not configure ipfw. There are several ways to create this file:

Enabling the Firewall without an Intel Mac

It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac. Be warned - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.

Create the following file as firewall_config.sh in /Users/frontrow. It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw". Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.

#!/bin/sh
sudo ipfw -f flush
#sudo ipfw -f list

#exclude loopback traffic
sudo ipfw add 00003 allow all from any to any via lo0

#Deny any spoofed loopback/multicast traffic
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in

#Allow outgoing/established
sudo ipfw add 02050 allow tcp from any to any out
sudo ipfw add 02060 allow tcp from any to any established

#Allow anything from LAN
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any

#Block everything else
sudo ipfw add 12190 deny log tcp from any to any
sudo ipfw add 65535 allow ip from any to any

Make sure this script is executable

chmod 755 firewall_config.sh

Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):

/Users/frontrow/firewall_config.sh