Difference between revisions of "Configure Firewall"

From AwkwardTV
Jump to: navigation, search
m
m (Enabling the Firewall without an Intel Mac)
 
(13 intermediate revisions by 7 users not shown)
Line 1: Line 1:
[http://lerofne.info/sitopersonali/ Sito personali con webcam] [http://moratet.info/tawnyroberts.html Tawny roberts video gratis] [http://isitale.info/articles/palalottomatica.html Palalottomatica piantina] [http://isitale.info/articles/paddockgirls.html Paddock girls] [http://meximep.info/tettebulma.html Tette bulma] [http://jasenti.info/blog/pryngeps.html Pryngeps] [http://moratet.info/teencumshot.html Teen cumshot fucked] [http://lyndjie.info/sfondihellokitty.html Sfondi hello kitty] [http://itliks.info/pozzetto/ Pozzetto] [http://kliorte.info/sapereitdizionario/ Sapere it dizionario] [http://kevcan.info/pragaalbergo.html Praga albergo] [http://laseris.info/scoparevideo.html Scopare video] [http://melolis.info/senoalessandra/ Seno alessandra schiavo] [http://kwyndex.info/text/relazioni.html Relazioni sociali roma] [http://isitale.info/articles/panteranera.html Pantera nera] [http://moratet.info/tatuaggipiede.html Tatuaggi piede] [http://jirvoje.info/pissinggirl.html Pissing girl] [http://kirtose.info/topic/racconto.html Racconto storia marito cornuto] [http://kliorte.info/samuelebersani/ Samuele bersani] [http://lylovec.info/sudcarolinaristorante/ Sud carolina ristorante] [http://lerofne.info/sitoufficiale/ Sito ufficiale roberta missoni] [http://jisegyn.info/pescareilsarago/ Pescare il sarago] [http://laseris.info/scrittedi.html Scritte di benvenuto glitter] [http://jisegyn.info/patriziarossetto/ Patrizia rossetto hard] [http://jirvoje.info/pitonereticolato.html Pitone reticolato] [http://jirvoje.info/pisellonevideo.html Pisellone video] [http://lylovec.info/superfighegratis/ Super fighe gratis] [http://melolis.info/setteringlese/ Setter inglese tricolore] [http://natesos.info/toscanavino/ Toscana vino cava] [http://isitale.info/articles/panasoniccentralini.html Panasonic centralini] [http://lyndjie.info/sigmundfreud.html Sigmund freud] [http://jasenti.info/blog/protestati.html Protestati carta credito] [http://kwyndex.info/text/recuperocontatti.html Recupero contatti messenger] [http://lerofne.info/solovololast/ Solo volo last minute] [http://natesos.info/tortadecorazioni/ Torta decorazioni] [http://kwyndex.info/text/residencesdomenico.html Residence s domenico ischia it] [http://lyndjie.info/sexyshopit.html Sexyshop it] [http://mikylir.info/spyvoyeursex.html Spy voyeur sex] [http://lyndjie.info/sfondoanimale.html Sfondo animale maiale] [http://jisegyn.info/pavimentiin/ Pavimenti in resina milano] [http://meximep.info/tettone.html Tettone] [http://laseris.info/scopateestreme.html Scopate estreme] [http://joekla.info/blog/rolexorologio.html Rolex orologio] [http://lyndjie.info/simonapari.html Simona pari] [http://itliks.info/pornazzo/ Pornazzo grtis] [http://kirtose.info/topic/raiclikit.html Raiclik it] [http://kliorte.info/scacchistiit/ Scacchisti it] [http://jisegyn.info/pegperego/ Peg perego] [http://jisegyn.info/pianetasaturno/ Pianeta saturno] [http://jirvoje.info/polizzaroulotte.html Polizza roulotte] [http://melolis.info/sextvgratis/ Sex tv gratis] [http://isitale.info/articles/ostellobedbreakfast.html Ostello bed breakfast parigi] [http://kliorte.info/salvatoreangelucci/ Salvatore angelucci paola] [http://laseris.info/sedicenniporche.html Sedicenni porche] [http://jasenti.info/blog/pronunciainglese.html Pronuncia inglese] [http://kevcan.info/prestitolecce.html Prestito lecce] [http://jirvoje.info/poesiaamicizia.html Poesia amicizia] [http://lyndjie.info/sgabelloergonomici.html Sgabello ergonomici] [http://kliorte.info/sanmartinodi/ San martino di castrozza] [http://jirvoje.info/porcazozza.html Porca zozza] [http://kwyndex.info/text/renaultmegane.html Renault megane scenic] [http://kirtose.info/topic/raccontimamma.html Racconti mamma] [http://isitale.info/articles/palmademaiorca.html Palma de maiorca] [http://kwyndex.info/text/regaliesselunga.html Regali esselunga] [http://lyndjie.info/shrinkwrap.html Shrink wrap] [http://moratet.info/temanatale.html Tema natale] [http://natesos.info/traducitesti/ Traduci testi] [http://natesos.info/trailersfilm/ Trailers film porno] [http://kliorte.info/satkey/ Satkey] [http://lerofne.info/sorchepelose/ Sorche pelose] [http://jisegyn.info/pcportatile/ Pc portatile computer] [http://lerofne.info/skuolait/ Skuola it] [http://melolis.info/serraturaporta/ Serratura porta blindate dierre torino] [http://kevcan.info/prestitonovi.html Prestito novi di modena] [http://itliks.info/portonescorrevole/ Portone scorrevole] [http://kwyndex.info/text/ricevimento.html Ricevimento bari] [http://moratet.info/tatuaggiluna.html Tatuaggi luna] [http://meximep.info/tetteesagerate.html Tette esagerate] [http://kirtose.info/topic/ramonabadescu.html Ramona badescu] [http://jisegyn.info/piastrelleper/ Piastrelle per cucine in muratura] [http://moratet.info/teennude.html Teen nude] [http://kwyndex.info/text/residencetoscana.html Residence toscana] [http://moratet.info/telefoninomotorola.html Telefonino motorola] [http://kevcan.info/prestitoinpdap.html Prestito inpdap personale] [http://lyndjie.info/shakespeareamleto.html Shakespeare amleto] [http://joekla.info/blog/ristorantebarano.html Ristorante barano d ischia] [http://natesos.info/toplessamatoriali/ Topless amatoriali] [http://meximep.info/testopercolpa.html Testo per colpa di chi zucchero] [http://laseris.info/sciacca.html Sciacca] [http://joekla.info/blog/sabbiatura.html Sabbiatura] [http://kwyndex.info/text/rasate.html Rasate] [http://lylovec.info/tabellinasoftware/ Tabellina software] [http://meximep.info/tetrisgioco.html Tetris gioco] [http://melolis.info/sexegratuit/ Sexe gratuit] [http://lylovec.info/taroccotelefono/ Tarocco telefono] [http://kirtose.info/topic/ragazzearrapate.html Ragazze arrapate] [http://kliorte.info/sardegnavacanza/ Sardegna vacanza volo] [http://kwyndex.info/text/residenceischia.html Residence ischia] [http://itliks.info/portorecanati/ Porto recanati] [http://jirvoje.info/polimiit.html Polimi it] [http://jisegyn.info/perlaneraitvideo/ Perla nera it video] [http://joekla.info/blog/sadomaso.html Sadomaso gratis] [http://meximep.info/tettonecadenti.html Tettone cadenti] [http://natesos.info/traduttoreon/ Traduttore on line] [http://meximep.info/testoringthe.html Testo ring the alarm beyonce knowles] [http://kwyndex.info/text/resellerhosting.html Reseller hosting] [http://melolis.info/sessoconla/ Sesso con la cognata] [http://itliks.info/pornostargratis/ Pornostar gratis] [http://kirtose.info/topic/ragazzawebcam.html Ragazza webcam sesso] [http://kirtose.info/topic/raccontidiincesto.html Racconti di incesto famigliare] [http://lerofne.info/sitoscambio/ Sito scambio coppia] [http://jirvoje.info/pircinglabbra.html Pircing labbra] [http://natesos.info/tourvelieromediterraneo/ Tour veliero mediterraneo] [http://kirtose.info/topic/ragazze-spiate.html Ragazze-spiate] [http://kirtose.info/topic/quindicenni.html Quindicenni nude] [http://jasenti.info/blog/programmasms.html Programma sms bomber] [http://jasenti.info/blog/programmascaricare.html Programma scaricare mp3 gratis] [http://mikylir.info/sportestremo.html Sport estremo trentino alto adige] [http://jirvoje.info/planisfero.html Planisfero stati] [http://laseris.info/scuolamoda.html Scuola moda cagliari] [http://jisegyn.info/penisenlargement/ Penis enlargement pill] [http://joekla.info/blog/risultatiamniocentesi.html Risultati amniocentesi] [http://lylovec.info/summerland/ Summerland telesimo] [http://meximep.info/tesiit.html Tesi it] [http://lerofne.info/siticonalfabeti/ Siti con alfabeti glitterati] [http://jirvoje.info/polizzarca.html Polizza rca] [http://isitale.info/articles/palermoshopping.html Palermo shopping] [http://kwyndex.info/text/ricerchevideo.html Ricerche video porno gay gratis] [http://joekla.info/blog/rubinettolavello.html Rubinetto lavello] [http://moratet.info/temidante.html Temi dante] [http://jisegyn.info/pessionnuda/ Pession nuda] [http://laseris.info/scorpione.html Scorpione] [http://mikylir.info/sperlonga.html Sperlonga] [http://kirtose.info/topic/quizesegnali.html Quiz e segnali stradali] [http://kliorte.info/scaricaregratis/ Scaricare gratis avast antivirus italiano] [http://meximep.info/testigigidalessio.html Testi gigi dalessio] [http://kwyndex.info/text/relatedwwwvivastreet.html Related www vivastreet alice it sicilia] [http://laseris.info/screensever.html Screen sever] [http://kirtose.info/topic/raccontisesso.html Racconti sesso incesto] [http://joekla.info/blog/rolexprezzi.html Rolex prezzi] [http://lerofne.info/softwaregestionale/ Software gestionale personalizzato] [http://kwyndex.info/text/ricercausato.html Ricerca usato automobile] [http://joekla.info/blog/rognoncini.html Rognoncini fiamma] [http://melolis.info/sexycoppieit/ Sexy coppieit] [http://jirvoje.info/porchevacche.html Porche vacche] [http://lyndjie.info/siusagelatina.html Si usa gelatina vaso fiore] [http://meximep.info/testlingua.html Test lingua inglese] [http://joekla.info/blog/robertobolle.html Roberto bolle] [http://jasenti.info/blog/pugliavacanza.html Puglia vacanza residence] [http://melolis.info/serviziofotografico/ Servizio fotografico lombardia] [http://moratet.info/teenpissing.html Teen pissing] [http://kevcan.info/prestitotrevi.html Prestito trevi lazio] [http://jirvoje.info/pompinare.html Pompinare golose] [http://meximep.info/tettoneenormi.html Tettone enormi] [http://moratet.info/telegiornaliste.html Telegiornaliste] [http://melolis.info/sessocognata/ Sesso cognata] [http://laseris.info/segaanastro.html Sega a nastro] [http://lerofne.info/skinwinamp/ Skin winamp hamtaro] [http://kwyndex.info/text/regalocucciolo.html Regalo cucciolo] [http://kwyndex.info/text/regolebasket.html Regole basket] [http://jasenti.info/blog/puntocroce.html Punto croce pimbolo] [http://isitale.info/articles/paginapersonale.html Pagina personale porno] [http://meximep.info/tesinagratis.html Tesina gratis istituto alberghieri] [http://melolis.info/sessoorale/ Sessoorale com] [http://meximep.info/tettepiugrosse.html Tette piu grosse del mondo] [http://moratet.info/tatuaggiostella.html Tatuaggio stella] [http://itliks.info/pornovideoanteprima/ Porno video anteprima] [http://laseris.info/selennuda.html Selen nuda foto] [http://jisegyn.info/pescatraina/ Pesca traina] [http://lylovec.info/successione/ Successione generazionale finanza] [http://kevcan.info/prestitovalle.html Prestito valle aosta] [http://kevcan.info/preteensex.html Preteen sex nuda] [http://jirvoje.info/pixiedacolorare.html Pixie da colorare] [http://natesos.info/torinole/ Torino le gru] [http://jirvoje.info/porchenapoletane.html Porche napoletane] [http://kwyndex.info/text/ricercanumeri.html Ricerca numeri telefonici] [http://meximep.info/tettefotogratis.html Tette foto gratis] [http://kliorte.info/scamarciofoto/ Scamarcio foto] [http://lylovec.info/tartufo/ Tartufo] [http://natesos.info/toyotacelica/ Toyota celica t20 tuning] [http://lerofne.info/slipincontinenza/ Slip incontinenza] [http://kwyndex.info/text/regginareal.html Reggina real madrid] [http://itliks.info/pornoclipgratis/ Porno clip gratis] [http://laseris.info/scuolemedie.html Scuole medie private roma] [http://melolis.info/serviziocomunicazione/ Servizio comunicazione azienda] [http://lerofne.info/soppalcoarredamento/ Soppalco arredamento] [http://joekla.info/blog/rodox.html Rodox] [http://jasenti.info/blog/provideradsl.html Provider adsl umbria] [http://isitale.info/articles/pagamento.html Pagamento rata] [http://kliorte.info/scambista/ Scambista] [http://jasenti.info/blog/puttaneacatania.html Puttane a catania] [http://lyndjie.info/sexystriptease.html Sexy strip tease] [http://kliorte.info/sborrateamatoriali/ Sborrate amatoriali] [http://jisegyn.info/perizoma/ Perizoma amatoriale] [http://melolis.info/sestrilevante/ Sestri levante albergo] [http://moratet.info/index4_100.html main page] [http://mikylir.info/spiaredonnenude.html Spiare donne nude] [http://joekla.info/blog/ronsonpenna.html Ronson penna] [http://lyndjie.info/sfondo3d.html Sfondo 3d natalizio] [http://itliks.info/pornoemoticons/ Porno emoticons] [http://jasenti.info/blog/pussyorg.html Pussyorg] [http://lylovec.info/superpippa/ Superpippa] [http://laseris.info/sciaticaterapia.html Sciatica terapia] [http://jisegyn.info/petardascom/ Petardascom] [http://natesos.info/transsuperdotati/ Trans superdotati] [http://isitale.info/articles/pandorapeaks.html Pandora peaks] [http://lylovec.info/supermercati/ Supermercati gs] [http://kliorte.info/savonaalbergo/ Savona albergo hotel] [http://lerofne.info/smsinvia/ Sms invia] [http://laseris.info/selengallery.html Selen gallery] [http://lerofne.info/sistemadomotica/ Sistema domotica] [http://mikylir.info/stipsi.html Stipsi] [http://natesos.info/trailersvideo/ Trailers video porno] [http://jasenti.info/blog/puntochatit.html Punto chatit] [http://kwyndex.info/text/ranmax.html Ranma x] [http://lerofne.info/sorrentohotel/ Sorrento hotel reservation] [http://lerofne.info/soletattoo/ Sole tattoo] [http://natesos.info/traslocaresubito/ Traslocare subito] [http://kwyndex.info/text/ricettapesce.html Ricetta pesce spada] [http://lyndjie.info/shoppingparma.html Shopping parma] == Note ==
+
== Note ==
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''There is no need to hack up a way to disable the firewall.'''
 
'''There is no need to hack up a way to disable the firewall.'''
  
  
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which re
+
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pre>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
5A8
 
ads the file <pr
 
5A8
 
e>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
 
  
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
Line 16: Line 12:
 
65535 allow ip from any to any
 
65535 allow ip from any to any
 
</pre>
 
</pre>
 
 
  
 
== Enabling the Firewall ==
 
== Enabling the Firewall ==
Line 25: Line 19:
 
* Copy one you like from an Intel Mac
 
* Copy one you like from an Intel Mac
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
* [http://wiki.awkwardtv.org/wiki/Install_System_Preferences Install System Preferences] from an Intel Mac and configure as usual.
+
* [[Install System Preferences]] from an Intel Mac and configure as usual.
 +
 
 +
== Enabling the Firewall without an Intel Mac ==
 +
 
 +
It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac.  '''Be warned''' - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.
 +
 
 +
Create the following file as firewall_config.sh in /Users/frontrow.  It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw".  Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.
 +
#!/bin/sh
 +
sudo ipfw -f flush
 +
#sudo ipfw -f list
 +
 +
#exclude loopback traffic
 +
sudo ipfw add 00003 allow all from any to any via lo0
 +
 +
#Deny any spoofed loopback/multicast traffic
 +
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
 +
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
 +
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
 +
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in
 +
 +
#Allow outgoing/established
 +
sudo ipfw add 02050 allow tcp from any to any out
 +
sudo ipfw add 02060 allow tcp from any to any established
 +
 +
#Allow anything from LAN
 +
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any
 +
 +
#Block everything else
 +
sudo ipfw add 12190 deny log tcp from any to any
 +
sudo ipfw add 65535 allow ip from any to any
 +
 
 +
Make sure this script is executable
 +
chmod 755 firewall_config.sh
 +
 
 +
Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):
 +
/Users/frontrow/firewall_config.sh
  
 
[[Category:How-to]]
 
[[Category:How-to]]

Latest revision as of 03:22, 11 January 2009

Note

The AppleTV seems to ship with no firewall rules configured. There is no need to hack up a way to disable the firewall.


In MacOS X, at boot time,
/usr/libexec/FirewallTool
runs, which reads the file
/Library/Preferences/com.apple.sharing.firewall.plist

Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:

-bash-2.05b$ sudo ipfw list
65535 allow ip from any to any

Enabling the Firewall

It is likely that copying over FirewallTool from an Intel Mac will enable MacOS firewall configuration at boot time. In addition, it is neccesary to create /Library/Preferences/com.apple.sharing.firewall.plist. If the prefs plist file does not exist, FirewallTool will not configure ipfw. There are several ways to create this file:

Enabling the Firewall without an Intel Mac

It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac. Be warned - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.

Create the following file as firewall_config.sh in /Users/frontrow. It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw". Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.

#!/bin/sh
sudo ipfw -f flush
#sudo ipfw -f list

#exclude loopback traffic
sudo ipfw add 00003 allow all from any to any via lo0

#Deny any spoofed loopback/multicast traffic
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in

#Allow outgoing/established
sudo ipfw add 02050 allow tcp from any to any out
sudo ipfw add 02060 allow tcp from any to any established

#Allow anything from LAN
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any

#Block everything else
sudo ipfw add 12190 deny log tcp from any to any
sudo ipfw add 65535 allow ip from any to any

Make sure this script is executable

chmod 755 firewall_config.sh

Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):

/Users/frontrow/firewall_config.sh