Difference between revisions of "Configure Firewall"

From AwkwardTV
Jump to: navigation, search
m
m (Enabling the Firewall without an Intel Mac)
 
(11 intermediate revisions by 6 users not shown)
Line 1: Line 1:
[http://vlano.50webs.com/styles/www-letti/ www letti in ferro] [http://someoddgalaxy.freehostia.com/articles/diario-de/ diario de barcelona] [http://blind9justice.50webs.com/yamaha-t/ yamaha t100] [http://krasniioktyabr.50webs.com/sapphire-xxt/ sapphire x800xt platinum] [http://maheinze.angelfire.com/is-it3.htm is it] [http://smfarrowik.angelfire.com/small/omosessuali-video/ omosessuali video] [http://commodore-guff.freehostia.com/styles/juf.htm juf] [http://queenbabypie.freehostia.com/html/adobe-acrobat6/ adobe acrobat pro] [http://wosligersy.angelfire.com/advanced-archive/ advanced archive password recovery 3 01] [http://danikrv.50webs.com/small/fiumefreddo/ fiumefreddo] [http://krasniioktyabr.50webs.com/realone-player/ realone player] [http://anubis8.50webs.com/library/hp-/ hp 3420 cartuccia] [http://smfarrowik.angelfire.com/small/la-necrofila/ la necrofila] [http://pothomse.angelfire.com/masterizzatore-dvd9/ masterizzatore dvd] [http://rathchavady.freehostia.com/description/penne-portamine/ penne portamine] [http://danikrv.50webs.com/small/sborrate-di/ sborrate di cavalli] [http://ag666.50webs.com/view/ml-g/ ml110 g2] [http://maheinze.angelfire.com/elettroniche-cinesi.htm elettroniche cinesi] [http://superhank.freehostia.com/content/volante-ferrari/ volante ferrari accessori console] [http://midwestman.50webs.com/view/guns-and/ guns and roses mp3] [http://anubis8.50webs.com/library/cicarelli/ cicarelli] [http://runnyn.freehostia.com/library/www-goolie/ www goolie it] [http://rathchavady.freehostia.com/description/norton-antivirus14/ norton antivirus server] [http://eaes7.freehostia.com/library/prestito-valencia.htm prestito valencia] [http://anubis8.50webs.com/library/tikka-plus/ tikka plus] [http://runnyn.freehostia.com/library/furetto/ furetto] [http://heartlessfriend.freehostia.com/library/volkswagen-golf63/ volkswagen golf gti 2 0] [http://keokepa.50webs.com/library/pamela-anderson/ pamela anderson blowjob] [http://queenbabypie.freehostia.com/html/brano-musicale/ brano musicale] [http://eaes7.freehostia.com/library/strategico-pc.htm strategico pc videogiochi] [http://rathchavady.freehostia.com/description/simac-caldaia/ simac caldaia] [http://queenbabypie.freehostia.com/html/stampante-laserjet2/ stampante laserjet] [http://danikrv.50webs.com/small/audi-a/ audi a4 rs4] [http://midwestman.50webs.com/view/galleria-dei/ galleria dei greci] [http://krasniioktyabr.50webs.com/hadelan/ hadelan] [http://danikrv.50webs.com/small/segreteria-multifunzione/ segreteria multifunzione] [http://runnyn.freehostia.com/library/gigli-viola/ gigli viola] [http://eaes7.freehostia.com/lib/videogame-gioco.htm videogame gioco] [http://leshji.50webs.com/data/carlo-cameli/ carlo cameli] [http://krasniioktyabr.50webs.com/travelonline/ travelonline] [http://krasniioktyabr.50webs.com/aparte-es/ aparte es mi pecado] [http://njoka.freehostia.com/small/nuova-renault8.htm nuova renault scenic luxe diesel auto] [http://rathchavady.freehostia.com/description/foto-porno93/ foto porno con animali] [http://eaes7.freehostia.com/lib/nokia-i32.htm nokia 6101i] [http://pticaja-ptica.freehostia.com/directory/victorinox-explorer.htm victorinox explorer] [http://superhank.freehostia.com/content/www-palazzetti1/ www palazzetti it] [http://maheinze.angelfire.com/atacama-messina.htm atacama messina] [http://eaes7.freehostia.com/library/hard-disk810.htm hard disk player] [http://someoddgalaxy.freehostia.com/articles/herbert-von3/ herbert von karajan all souls day concert berlin 1983] [http://someoddgalaxy.freehostia.com/articles/mms-da/ mms da inviare] [http://leshji.50webs.com/data/corso-somelier/ corso somelier] [http://midwestman.50webs.com/view/agenzia-matrimoniale/ agenzia matrimoniale online] [http://keokepa.50webs.com/library/ragazza-ventimiglia/ ragazza ventimiglia] [http://vlano.50webs.com/styles/creare-mp/ creare mp3] [http://eaes7.freehostia.com/library/la-risaia.htm la risaia] [http://midwestman.50webs.com/view/lioce/ lioce] [http://celare.freehostia.com/description/nuova-porsche11/ nuova porsche benzina auto nuove] [http://superhank.freehostia.com/content/lettino-per/ lettino per bambini] [http://deharte.angelfire.com/data/www-poesias/ www poesias com] [http://krasniioktyabr.50webs.com/frases-para/ frases para cumpleanos] [http://blind9justice.50webs.com/testo-scritto/ testo scritto in italiano di aisha] [http://midwestman.50webs.com/view/le-gambe/ le gambe di mia suocera] [http://runnyn.freehostia.com/library/bebe-confort36/ bebe confort loola elios] [http://commodore-guff.freehostia.com/styles/ancora-alte.htm ancora alte le vendite del gamecube in america] [http://njoka.freehostia.com/small/panasonic-vodafone.htm panasonic vodafone] [http://offleeewild1.50webs.com/library/fotografia-beniamino/ fotografia beniamino placido] [http://leshji.50webs.com/data/sicurezza-bebe/ sicurezza bebe] [http://pticaja-ptica.freehostia.com/directory/telecomando-navman.htm telecomando navman] [http://pothomse.angelfire.com/cavo-dolby/ cavo dolby] [http://ag666.50webs.com/view/rigurgito-antifascista/ rigurgito antifascista] [http://keokepa.50webs.com/library/hp-c/ hp 950c] [http://danikrv.50webs.com/small/ibm-server/ ibm server x336] [http://leshji.50webs.com/data/wrestilng/ wrestilng] [http://njoka.freehostia.com/small/tutti-frutti1.htm tutti frutti] [http://midwestman.50webs.com/view/tecno-music/ tecno music] [http://ag666.50webs.com/view/hard-drive/ hard drive extreme] [http://blind9justice.50webs.com/lexmark/ lexmark 20] [http://commodore-guff.freehostia.com/styles/bosch-proparquet.htm bosch proparquet] [http://leshji.50webs.com/data/tisana-dimagranti/ tisana dimagranti] [http://anubis8.50webs.com/library/hotel-mercure/ hotel mercure lisboa] [http://njoka.freehostia.com/small/lavori-antichi.htm lavori antichi di molfetta] [http://pticaja-ptica.freehostia.com/directory/auto-germania.htm auto germania mobile de] [http://stbillin.angelfire.com/web/palladio.htm palladio] [http://ag666.50webs.com/view/chop-chop/ chop chop band] [http://queenbabypie.freehostia.com/html/gazetta/ gazetta] [http://runnyn.freehostia.com/library/a-38/ a 200 minolta] [http://krasniioktyabr.50webs.com/air-typer/ air typer on line] [http://eaes7.freehostia.com/lib/mi-todo.htm mi todo] [http://superhank.freehostia.com/content/schindler-s/ schindler s list] [http://celare.freehostia.com/description/potter-humphrey/ potter humphrey] [http://commodore-guff.freehostia.com/styles/lultimo-paradiso.htm lultimo paradiso] [http://heartlessfriend.freehostia.com/library/navetta-peg/ navetta peg perego] [http://commodore-guff.freehostia.com/styles/spy-killer.htm spy killer 2004] [http://pticaja-ptica.freehostia.com/directory/buoni-i.htm buoni i] [http://runnyn.freehostia.com/library/rimax-child/ rimax child] [http://rathchavady.freehostia.com/description/kardon-avr1/ kardon avr 235] [http://stbillin.angelfire.com/web/canavaro.htm canavaro] [http://heartlessfriend.freehostia.com/library/cantico-della/ cantico della terra  la capanna dellamore] [http://krasniioktyabr.50webs.com/epilatori-philips/ epilatori philips] [http://vlano.50webs.com/styles/nissan-xtrail/ nissan xtrail auto] [http://midwestman.50webs.com/view/gen-cerde/ gen cerde] [http://danikrv.50webs.com/small/ho-inventato/ ho inventato una donna] [http://someoddgalaxy.freehostia.com/articles/mujeres-encueradas/ mujeres encueradas] [http://danikrv.50webs.com/small/tutti-i/ tutti i cartoni] [http://someoddgalaxy.freehostia.com/articles/smoke-on5/ smoke on the water] [http://offleeewild1.50webs.com/library/xeon-dual/ xeon dual processor] [http://stbillin.angelfire.com/web/adobe-creative3.htm adobe creative suite 2 premium] [http://offleeewild1.50webs.com/library/elixir-ddr/ elixir ddr pc3200] [http://eaes7.freehostia.com/library/reed-the.htm reed the weed] [http://commodore-guff.freehostia.com/styles/robben-ford1.htm robben ford] [http://vlano.50webs.com/styles/lourdes-tarbes/ lourdes tarbes] [http://njoka.freehostia.com/small/donne.htm donne 30] [http://eaes7.freehostia.com/library/stacey-s.htm stacey s mum] [http://midwestman.50webs.com/view/carmelo-viola/ carmelo viola] [http://ag666.50webs.com/view/the-crystal/ the crystal method] [http://superhank.freehostia.com/content/blue-eyes3/ blue eyes] [http://runnyn.freehostia.com/library/hand-bag/ hand bag] [http://nejoaus.angelfire.com/estensioni-firefox.htm estensioni firefox] [http://runnyn.freehostia.com/library/apple-20/ apple 20 gb] [http://njoka.freehostia.com/small/mercedes-sl24.htm mercedes sl 1989] [http://celare.freehostia.com/description/q-hyundai/ q770 hyundai] [http://commodore-guff.freehostia.com/styles/linea-srl.htm linea srl import china napoli] [http://njoka.freehostia.com/small/hamadan.htm hamadan] [http://pticaja-ptica.freehostia.com/directory/olivetti18.htm olivetti 9017] [http://pticaja-ptica.freehostia.com/directory/palmari-qtek10.htm palmari qtek 8100] [http://krasniioktyabr.50webs.com/nforce/ nforce] [http://offleeewild1.50webs.com/library/mala-mujer/ mala mujer] [http://blind9justice.50webs.com/lactancia/ lactancia] [http://smfarrowik.angelfire.com/small/esibizionisti-/ esibizionisti  gay] [http://pticaja-ptica.freehostia.com/directory/dallavere-com.htm dallavere com] [http://offleeewild1.50webs.com/library/la-donna/ la donna che voleva lamore] [http://queenbabypie.freehostia.com/html/calcio-kit/ calcio kit] [http://keokepa.50webs.com/library/mercedes-cabrio/ mercedes cabrio] [http://eaes7.freehostia.com/library/sony-124.htm sony 32 trinitron wega] [http://njoka.freehostia.com/small/i-dont33.htm i dont wanna love] [http://queenbabypie.freehostia.com/html/sociali/ sociali] [http://commodore-guff.freehostia.com/styles/beati-voi.htm beati voi] [http://queenbabypie.freehostia.com/html/calendario-51/ calendario 2005 capital] [http://midwestman.50webs.com/view/microfono-tavolo/ microfono tavolo] [http://njoka.freehostia.com/small/tavolino-cristallo.htm tavolino cristallo] [http://someoddgalaxy.freehostia.com/articles/tra-le7/ tra le undici e mezzanotte] [http://commodore-guff.freehostia.com/styles/l-ombra8.htm l ombra del dubbio] [http://njoka.freehostia.com/small/phone-ringtone.htm phone ringtone] [http://celare.freehostia.com/description/super-bustamove/ super bustamove] [http://queenbabypie.freehostia.com/html/oberammergau/ oberammergau] [http://vlano.50webs.com/styles/amulador/ amulador] [http://pothomse.angelfire.com/le-barzellette/ le barzellette baresi] [http://eaes7.freehostia.com/library/mario-de2.htm mario de benedetti mobili] [http://pticaja-ptica.freehostia.com/directory/hotel-imola.htm hotel imola] [http://ag666.50webs.com/view/orlando-vacation/ orlando vacation] [http://krasniioktyabr.50webs.com/mrs/ mrs] [http://keokepa.50webs.com/library/charles-dickens/ charles dickens the first day at school] [http://krasniioktyabr.50webs.com/navi-italiane/ navi italiane da guerra] [http://krasniioktyabr.50webs.com/jassica-alba/ jassica alba nuda] [http://krasniioktyabr.50webs.com/universita-magna/ universita magna grecia catanzaro] [http://rathchavady.freehostia.com/description/all-arembaggio/ all arembaggio] [http://eaes7.freehostia.com/lib/intuos-a2.htm intuos3 a4] [http://heartlessfriend.freehostia.com/library/obispo-st/ obispo st pier] [http://anubis8.50webs.com/library/luigi-tenco/ luigi tenco ciao] [http://keokepa.50webs.com/library/www-iraq/ www iraq it] [http://stbillin.angelfire.com/web/maxtor-5.htm maxtor 250 gb serial ata] [http://commodore-guff.freehostia.com/styles/illuminatore-ir.htm illuminatore ir] [http://pticaja-ptica.freehostia.com/directory/audi-a177.htm audi a6 anno 2001] [http://danikrv.50webs.com/small/pentola-esopo/ pentola esopo] [http://pticaja-ptica.freehostia.com/directory/video-chat14.htm video chat in america] [http://offleeewild1.50webs.com/library/pro-rack/ pro rack line6] [http://queenbabypie.freehostia.com/html/notebook-ibm/ notebook ibm memoria ram] [http://commodore-guff.freehostia.com/styles/operazione-corea.htm operazione corea] [http://queenbabypie.freehostia.com/html/nvidia10/ nvidia 128] [http://eaes7.freehostia.com/lib/kazaalite-in.htm kazaalite in italiano] [http://someoddgalaxy.freehostia.com/articles/rimsky-korsakov/ rimsky korsakov] [http://eaes7.freehostia.com/lib/james-galway.htm james galway] [http://heartlessfriend.freehostia.com/library/l-altra8/ l altra moda] [http://njoka.freehostia.com/small/registratori-dv.htm registratori dv] [http://blind9justice.50webs.com/candy-cm/ candy cm 2106] [http://anubis8.50webs.com/library/los-angel/ los angel] [http://heartlessfriend.freehostia.com/library/cartina-geografica47/ cartina geografica ibiza] [http://commodore-guff.freehostia.com/styles/memory-foam1.htm memory foam] [http://eaes7.freehostia.com/lib/trottola.htm trottola] [http://midwestman.50webs.com/view/clarisse/ clarisse] [http://ag666.50webs.com/view/www-ogrish/ www ogrish net] [http://leshji.50webs.com/data/stampante-per/ stampante per cd card] [http://blind9justice.50webs.com/nera-comm/ nera comm] [http://eaes7.freehostia.com/library/easy-cd11.htm easy cd extractor] [http://anubis8.50webs.com/library/casa-vacanza/ casa vacanza versilia] [http://midwestman.50webs.com/view/la-cuarta/ la cuarta cl] [http://pticaja-ptica.freehostia.com/directory/lo-strano52.htm lo strano percors] [http://midwestman.50webs.com/view/get-down/ get down to the music] [http://pothomse.angelfire.com/sintolettore-dvd/ sintolettore dvd philips] [http://someoddgalaxy.freehostia.com/articles/volkswagen-touran4/ volkswagen touran torino] [http://celare.freehostia.com/description/climatizzatore-dual1/ climatizzatore dual] [http://danikrv.50webs.com/small/xxx-older/ xxx older man] [http://vlano.50webs.com/styles/deborah-richter/ deborah richter] [http://eaes7.freehostia.com/library/ati-radeon321.htm ati radeon x800se] [http://eaes7.freehostia.com/lib/corbusier-divano.htm corbusier divano] [http://queenbabypie.freehostia.com/html/www-dior1/ www dior it] [http://deharte.angelfire.com/data/box-magnex/ box magnex usb] [http://blind9justice.50webs.com/viewsonic-gf/ viewsonic g220f] [http://pticaja-ptica.freehostia.com/directory/el-origina.htm el origina] [http://rathchavady.freehostia.com/description/chrysler-crossfire3/ chrysler crossfire] == Note ==
+
== Note ==
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''There is no need to hack up a way to disable the firewall.'''
 
'''There is no need to hack up a way to disable the firewall.'''
  
  
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which re
+
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pre>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
5A8
 
ads the file <pr
 
5A8
 
e>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
 
  
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
Line 16: Line 12:
 
65535 allow ip from any to any
 
65535 allow ip from any to any
 
</pre>
 
</pre>
 
 
  
 
== Enabling the Firewall ==
 
== Enabling the Firewall ==
Line 25: Line 19:
 
* Copy one you like from an Intel Mac
 
* Copy one you like from an Intel Mac
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
* [http://wiki.awkwardtv.org/wiki/Install_System_Preferences Install System Preferences] from an Intel Mac and configure as usual.
+
* [[Install System Preferences]] from an Intel Mac and configure as usual.
 +
 
 +
== Enabling the Firewall without an Intel Mac ==
 +
 
 +
It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac.  '''Be warned''' - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.
 +
 
 +
Create the following file as firewall_config.sh in /Users/frontrow.  It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw".  Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.
 +
#!/bin/sh
 +
sudo ipfw -f flush
 +
#sudo ipfw -f list
 +
 +
#exclude loopback traffic
 +
sudo ipfw add 00003 allow all from any to any via lo0
 +
 +
#Deny any spoofed loopback/multicast traffic
 +
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
 +
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
 +
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
 +
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in
 +
 +
#Allow outgoing/established
 +
sudo ipfw add 02050 allow tcp from any to any out
 +
sudo ipfw add 02060 allow tcp from any to any established
 +
 +
#Allow anything from LAN
 +
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any
 +
 +
#Block everything else
 +
sudo ipfw add 12190 deny log tcp from any to any
 +
sudo ipfw add 65535 allow ip from any to any
 +
 
 +
Make sure this script is executable
 +
chmod 755 firewall_config.sh
 +
 
 +
Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):
 +
/Users/frontrow/firewall_config.sh
  
 
[[Category:How-to]]
 
[[Category:How-to]]

Latest revision as of 03:22, 11 January 2009

Note

The AppleTV seems to ship with no firewall rules configured. There is no need to hack up a way to disable the firewall.


In MacOS X, at boot time,
/usr/libexec/FirewallTool
runs, which reads the file
/Library/Preferences/com.apple.sharing.firewall.plist

Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:

-bash-2.05b$ sudo ipfw list
65535 allow ip from any to any

Enabling the Firewall

It is likely that copying over FirewallTool from an Intel Mac will enable MacOS firewall configuration at boot time. In addition, it is neccesary to create /Library/Preferences/com.apple.sharing.firewall.plist. If the prefs plist file does not exist, FirewallTool will not configure ipfw. There are several ways to create this file:

Enabling the Firewall without an Intel Mac

It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac. Be warned - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.

Create the following file as firewall_config.sh in /Users/frontrow. It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw". Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.

#!/bin/sh
sudo ipfw -f flush
#sudo ipfw -f list

#exclude loopback traffic
sudo ipfw add 00003 allow all from any to any via lo0

#Deny any spoofed loopback/multicast traffic
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in

#Allow outgoing/established
sudo ipfw add 02050 allow tcp from any to any out
sudo ipfw add 02060 allow tcp from any to any established

#Allow anything from LAN
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any

#Block everything else
sudo ipfw add 12190 deny log tcp from any to any
sudo ipfw add 65535 allow ip from any to any

Make sure this script is executable

chmod 755 firewall_config.sh

Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):

/Users/frontrow/firewall_config.sh