Difference between revisions of "Configure Firewall"

From AwkwardTV
Jump to: navigation, search
m
m (Enabling the Firewall without an Intel Mac)
 
(9 intermediate revisions by 4 users not shown)
Line 1: Line 1:
[http://mejordan.ifrance.com/webcam-labtec.htm webcam labtec] [http://nipierre.ifrance.com/articles/traccia-prova.htm traccia prova di italiano] [http://lokelseyn.ifrance.com/index1_500.html index] [http://veredda.ifrance.com/resources/bmw-z11.htm bmw z3 veneto] [http://trermer.ifrance.com/small/canta-tu2/ canta tu music station] [http://lokelseyn.ifrance.com/torop/ torop] [http://veredda.ifrance.com/resources/aspirapolvere-lavor.htm aspirapolvere lavor genio verde] [http://bekleem.ifrance.com/content/nessun-rimpianto/ nessun rimpianto] [http://nipierre.ifrance.com/articles/il-seme2.htm il seme della gramigna] [http://maramsde.ifrance.com/directory/visano/ visano] [http://veredda.ifrance.com/resources/guardami-negli4.htm guardami negli occhi] [http://nipierre.ifrance.com/index4_500.html homepage] [http://maramsde.ifrance.com/directory/troie-e/ troie e inculate] [http://bekleem.ifrance.com/index3_250.html home] [http://maramsde.ifrance.com/directory/creedence-clearwater/ creedence clearwater revival] [http://lokelseyn.ifrance.com/scalda-biberon1/ scalda biberon] [http://bekleem.ifrance.com/content/comune-di41/ comune di ferrara] [http://trermer.ifrance.com/small/nokia-cellulare1/ nokia cellulare 7280] [http://lokelseyn.ifrance.com/index0_500.html link] [http://lokelseyn.ifrance.com/nino-d8/ nino d angeli] [http://lokelseyn.ifrance.com/u3/ u8110] [http://sthuckst.ifrance.com/galeria-de2/ galeria de fotos paris hilton desnuda] [http://veredda.ifrance.com/resources/finanziamento-grosseto.htm finanziamento grosseto] [http://mejordan.ifrance.com/nvidia-en.htm nvidia en6800] [http://veredda.ifrance.com/resources/zafira-1.htm zafira 2 2 dti] [http://lokelseyn.ifrance.com/xvision-mares/ xvision mares] [http://sthuckst.ifrance.com/hp-fax/ hp fax laser] [http://nipierre.ifrance.com/articles/breil-runner.htm breil runner chrono] [http://sthuckst.ifrance.com/cocciante-bicicletta/ cocciante bicicletta] [http://bekleem.ifrance.com/content/huevocartoon/ huevocartoon] [http://nipierre.ifrance.com/articles/cappe-miele.htm cappe miele] [http://trermer.ifrance.com/small/galerias-de/ galerias de despedidas de soltera] [http://mejordan.ifrance.com/grove-coverage.htm grove coverage] [http://trermer.ifrance.com/small/i-cavalieri4/ i cavalieri dello zodiaco ps2] [http://bekleem.ifrance.com/content/like-glue1/ like glue song] [http://veredda.ifrance.com/resources/iety-sport2.htm iety sport 1] [http://mejordan.ifrance.com/windows-server3.htm windows server 2003 5 client] [http://mejordan.ifrance.com/telecomando-mce.htm telecomando mce] [http://maramsde.ifrance.com/index2_500.html site] [http://maramsde.ifrance.com/directory/luna-donomar/ luna donomar] [http://veredda.ifrance.com/resources/fuoco-alle.htm fuoco alle spalle] [http://trermer.ifrance.com/small/giuda/ giuda] [http://veredda.ifrance.com/resources/testi-canzoni47.htm testi canzoni di pausini] [http://maramsde.ifrance.com/directory/pelletteria-monza/ pelletteria monza] [http://maramsde.ifrance.com/directory/spogliarelliste-immagini/ spogliarelliste immagini] [http://lokelseyn.ifrance.com/emilia-romagna2/ emilia romagna mare] [http://bekleem.ifrance.com/content/sesso-a4/ sesso a gogo] [http://trermer.ifrance.com/small/accessori-hpcompaq/ accessori hpcompaq palmari] [http://sthuckst.ifrance.com/obsession-download/ obsession download] [http://maramsde.ifrance.com/directory/terme-nudisti/ terme nudisti] [http://maramsde.ifrance.com/directory/traduzione-testo9/ traduzione testo every you every me] [http://trermer.ifrance.com/small/urba/ urba] [http://veredda.ifrance.com/resources/learnnc.htm learnnc] [http://lokelseyn.ifrance.com/logitech-mouse5/ logitech mouse e tastiera] [http://bekleem.ifrance.com/index1_500.html page] [http://trermer.ifrance.com/small/www-motore/ www motore di ricerca google] [http://veredda.ifrance.com/resources/ionite.htm ionite] [http://maramsde.ifrance.com/directory/madre-calore/ madre calore] [http://mejordan.ifrance.com/index4_1000.html index] [http://veredda.ifrance.com/resources/epson-carta3.htm epson carta] [http://nipierre.ifrance.com/articles/orari-treni7.htm orari treni termini fiumicino] [http://trermer.ifrance.com/index0_500.html home] [http://bekleem.ifrance.com/index2_1000.html site] [http://lokelseyn.ifrance.com/forzearmate/ forzearmate] [http://mejordan.ifrance.com/test-grafologia.htm test grafologia] [http://sthuckst.ifrance.com/comete/ comete] [http://mejordan.ifrance.com/the-postman.htm the postman midi] [http://trermer.ifrance.com/small/napoli-sportiva/ napoli sportiva] [http://nipierre.ifrance.com/articles/tv-lettori1.htm tv lettori] [http://nipierre.ifrance.com/articles/givani.htm givani] [http://nipierre.ifrance.com/articles/wrestling-games.htm wrestling games] [http://maramsde.ifrance.com/directory/quintrix/ quintrix 29] [http://lokelseyn.ifrance.com/dragostea-dintei1/ dragostea dintei karaoke] [http://veredda.ifrance.com/resources/quick-time5.htm quick time 4] [http://mejordan.ifrance.com/plano-.htm plano 29 samsung televisori] [http://bekleem.ifrance.com/content/blue-eyes/ blue eyes elton john] [http://veredda.ifrance.com/index1_250.html link] [http://maramsde.ifrance.com/directory/ferelli/ ferelli] [http://trermer.ifrance.com/small/liceo-scientifico/ liceo scientifico seconda prova scritta] [http://lokelseyn.ifrance.com/g-matrox/ g200 matrox] [http://veredda.ifrance.com/resources/singoli-trapani.htm singoli trapani] [http://bekleem.ifrance.com/content/megaworks-/ megaworks 2 1 creative labs speaker] [http://lokelseyn.ifrance.com/blaupunkt-gps/ blaupunkt gps e] [http://lokelseyn.ifrance.com/www-collezione/ www collezione com] [http://sthuckst.ifrance.com/index4_1000.html index] [http://veredda.ifrance.com/resources/brother-laser.htm brother laser multifunzione] [http://sthuckst.ifrance.com/sata1/ sata 200] [http://veredda.ifrance.com/resources/panasonic-leica.htm panasonic leica] [http://lokelseyn.ifrance.com/volkswagen-passat6/ volkswagen passat tdi] [http://veredda.ifrance.com/resources/smart-forfour3.htm smart forfour 11] [http://nipierre.ifrance.com/index4_500.html homepage] [http://bekleem.ifrance.com/content/pentium12/ pentium 775 3 4] [http://mejordan.ifrance.com/tu-umberto.htm tu umberto tozzi] [http://maramsde.ifrance.com/directory/bailando-de/ bailando de jalon] [http://bekleem.ifrance.com/content/il-gioco10/ il gioco dell amore] [http://bekleem.ifrance.com/content/mp-line1/ mp3 line 1gb] [http://trermer.ifrance.com/small/visconti-giorgio/ visconti giorgio spa] [http://sthuckst.ifrance.com/agriturismo-sabaudia/ agriturismo sabaudia] [http://trermer.ifrance.com/small/citta-di7/ citta di sarno] [http://trermer.ifrance.com/small/autobiografismo/ autobiografismo] [http://www.startonlineweb.com/help/new/tpvdaj.html Bolaffi] [http://www.startonlineweb.com/help/new/xwrtjk.html Video selen] [http://cale.cc/xde/it/rmbjrb.html Foto francesco arca] [http://www.notreligion.com/help/files/qtnavi.html Vacanza crociera] [http://www.hiidenkivenpaivakoti.fi/help/new/lijgih.html Musica rap com] [http://cale.cc/xde/it/bjlbub.html Tuta folgore] [http://www.actionscript.ru/help/files/thiftw.html Listino prezzo rolex] [http://www.hiidenkivenpaivakoti.fi/help/new/qpocav.html Escort gay] [http://www.worthwhilehosting.com/banners/auto/crjple.html Ragazze che scopano] [http://cale.cc/xde/it/vbhvcj.html Magritte] [http://www.hiidenkivenpaivakoti.fi/help/new/wgtndv.html Banca fineco] [http://www.startonlineweb.com/help/new/mkjhhs.html Annuncio gigolo] [http://rootos.idonea.cl/help/files/vmhqft.html Troiette in calore] [http://www.worthwhilehosting.com/banners/auto/xgahfb.html Albergo marche] [http://www.worthwhilehosting.com/banners/auto/lobkoh.html Fotoromanzi selen] [http://www.actionscript.ru/help/files/snqnjw.html Corsi di spagnolo gratis] [http://www.backtothebible.org/help/files/drpffh.html Contratto commercio] [http://www.nvwp.org/help/files/fvvjgi.html Ocse] [http://www.worthwhilehosting.com/banners/auto/isvbto.html Sophie moone] [http://www.worthwhilehosting.com/banners/auto/thgqig.html Monaco baviera albergo] [http://www.worthwhilehosting.com/banners/auto/meabjc.html Prestito sicuro] [http://www.hiidenkivenpaivakoti.fi/help/new/jcphfr.html Fighe lesbiche] [http://cale.cc/xde/it/cdbkbq.html Honeymoon travel] [http://cale.cc/xde/it/lpptnd.html Invito x festa natale] [http://www.actionscript.ru/help/files/rscsqt.html Atlantide] [http://www.startonlineweb.com/help/new/rkekxu.html Corrieredellosport it] [http://www.startonlineweb.com/help/new/arasbp.html Immaggini casalinghe in calore] [http://www.startonlineweb.com/help/new/disvak.html Slip uomo] [http://www.priceisking.co.uk/skins/default/mokwle.html Pissing gratis] [http://www.nvwp.org/help/files/rjhixs.html Nere tettone] [http://www.notreligion.com/help/files/emtpfo.html Moneta numismatica] [http://cale.cc/xde/it/jnxqgp.html Mardi gras hot] [http://www.backtothebible.org/help/files/foxtfn.html Albergo due stella amsterdam] [http://www.ccrs.uzh.ch/user/root/jvfbot.html Alimentatore piastra] [http://www.actionscript.ru/help/files/nlwbon.html Gay xxx] [http://www.backtothebible.org/help/files/hjkkkd.html Hotel nizza] [http://www.ccrs.uzh.ch/user/root/crsppo.html Badescu ramona] [http://www.nvwp.org/help/files/tpgaxo.html Xxx proposal reena] [http://www.backtothebible.org/help/files/otathm.html Terme di fordongianus] [http://www.hiidenkivenpaivakoti.fi/help/new/ixksee.html Cazzeggiare] [http://www.ccrs.uzh.ch/user/root/vpepcr.html Eva enger] [http://www.backtothebible.org/help/files/gpolje.html Www oroscopo com] [http://www.startonlineweb.com/help/new/ttlolg.html Sviluppo e stampa foto] [http://www.actionscript.ru/help/files/fxqios.html Tickling torture] [http://www.ccrs.uzh.ch/user/root/dquabg.html Patrizia rossetto hard] [http://www.startonlineweb.com/help/new/vhncjg.html Pipa tabacco] [http://www.nvwp.org/help/files/utcnif.html Classifica libri piu belli] [http://www.ccrs.uzh.ch/user/root/eqvlkd.html Hotel verbania] [http://www.worthwhilehosting.com/banners/auto/vpjrgs.html Prestito bergamo] [http://www.backtothebible.org/help/files/vhnobm.html Pianeta lotto] [http://www.hiidenkivenpaivakoti.fi/help/new/mdisfr.html Grassone nude] [http://www.notreligion.com/help/files/kttfsk.html Video porno fighe gratis] [http://www.backtothebible.org/help/files/kwmpxv.html Contratto lavoro apprendistato] [http://www.startonlineweb.com/help/new/grapia.html Cd duplicator] [http://www.backtothebible.org/help/files/smlnle.html Allevamento pesce rosso fvg] [http://www.startonlineweb.com/help/new/difain.html Albergo lille] [http://www.priceisking.co.uk/skins/default/kfrbnb.html L espresso] [http://www.ccrs.uzh.ch/user/root/ttlvsb.html Bungalow toscana mare] [http://www.startonlineweb.com/help/new/nlfuwd.html Alpi eagles basilicata] [http://www.actionscript.ru/help/files/saxped.html Melita topless] [http://www.priceisking.co.uk/skins/default/maimsp.html Ombrello] [http://www.actionscript.ru/help/files/apxlmw.html Singapore airline a380] [http://www.priceisking.co.uk/skins/default/jgumiq.html Zaino invicta] [http://www.hiidenkivenpaivakoti.fi/help/new/bdauae.html Arval] [http://www.notreligion.com/help/files/lnxsbm.html Porta scorrevole] [http://www.nvwp.org/help/files/xiscda.html Milano tonight] [http://www.backtothebible.org/help/files/xrefdo.html Spiderman 3] [http://www.hiidenkivenpaivakoti.fi/help/new/txcecd.html Mappa percorsi] [http://www.backtothebible.org/help/files/rtwggl.html Nuova 500] [http://www.ccrs.uzh.ch/user/root/hinnws.html Trombata pelosa] [http://www.worthwhilehosting.com/banners/auto/gspfsp.html Cicciolina pompini] [http://www.priceisking.co.uk/skins/default/xvliiq.html Digiland it] [http://cale.cc/xde/it/sofges.html Ristorante italiani a pechino] [http://www.priceisking.co.uk/skins/default/ktkvcr.html Guadalupa 23 dec] [http://www.backtothebible.org/help/files/mtpvka.html Matilde brandi] [http://www.actionscript.ru/help/files/mqnrbq.html Investimento online online sardegna] [http://www.ccrs.uzh.ch/user/root/ctfjuh.html Foto hard vip] [http://www.ccrs.uzh.ch/user/root/oquxpd.html Assicurazione auto moto] [http://cale.cc/xde/it/nfuxkg.html Rosita celentano] [http://www.nvwp.org/help/files/ftbhln.html Melita lucignolo foto] [http://www.worthwhilehosting.com/banners/auto/mhlbhs.html Figa tetta ilary blasi] [http://cale.cc/xde/it/ttubgw.html Immagini simpatica per matrimonio] [http://www.ccrs.uzh.ch/user/root/irsvhr.html Prezzo modem adsl] [http://www.worthwhilehosting.com/banners/auto/ogcwjk.html Accompagnatrice bologna] [http://www.priceisking.co.uk/skins/default/dwkdgt.html Mature nude] [http://www.priceisking.co.uk/skins/default/xgcpif.html Appartamento vacanza ferrara] [http://www.notreligion.com/help/files/lijedh.html Culi spiaggia] [http://cale.cc/xde/it/ktoegj.html Idr istituto angelo custode it] [http://www.ccrs.uzh.ch/user/root/qexqsk.html Buy nero software] [http://www.startonlineweb.com/help/new/uecpvk.html Traduzione italiano inglese gratis] [http://www.nvwp.org/help/files/wwqawq.html Vacanza caraibi] [http://www.worthwhilehosting.com/banners/auto/tjkceb.html Escort kalamazoo shemale] [http://www.startonlineweb.com/help/new/xlpomg.html Holly marie combs] [http://www.startonlineweb.com/help/new/spfhig.html Hp laserjet 1320 printer] [http://www.hiidenkivenpaivakoti.fi/help/new/pegcko.html Pianeti] [http://www.startonlineweb.com/help/new/esrdjr.html Oops celebrity] [http://www.ccrs.uzh.ch/user/root/kuujwm.html Stradario saronno] [http://www.actionscript.ru/help/files/rxperu.html Bbw sex] [http://cale.cc/xde/it/erdeku.html Gillian anderson fake] [http://cale.cc/xde/it/woloul.html Foto uomini belli] == Note ==
+
== Note ==
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''The AppleTV seems to ship with no firewall rules configured.'''
 
'''There is no need to hack up a way to disable the firewall.'''
 
'''There is no need to hack up a way to disable the firewall.'''
  
  
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which re
+
In MacOS X, at boot time, <pre>/usr/libexec/FirewallTool</pre> runs, which reads the file <pre>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
5A8
 
ads the file <pr
 
5A8
 
e>/Library/Preferences/com.apple.sharing.firewall.plist</pre>
 
  
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
 
Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:
Line 16: Line 12:
 
65535 allow ip from any to any
 
65535 allow ip from any to any
 
</pre>
 
</pre>
 
 
  
 
== Enabling the Firewall ==
 
== Enabling the Firewall ==
Line 25: Line 19:
 
* Copy one you like from an Intel Mac
 
* Copy one you like from an Intel Mac
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
 
* Copy one, then edit as you like with the Property List Editor that comes with Xcode. (see: [http://www.macosxhints.com/article.php?story=20060427124349687 MacOS Hints article])
* [http://wiki.awkwardtv.org/wiki/Install_System_Preferences Install System Preferences] from an Intel Mac and configure as usual.
+
* [[Install System Preferences]] from an Intel Mac and configure as usual.
 +
 
 +
== Enabling the Firewall without an Intel Mac ==
 +
 
 +
It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac.  '''Be warned''' - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.
 +
 
 +
Create the following file as firewall_config.sh in /Users/frontrow.  It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw".  Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.
 +
#!/bin/sh
 +
sudo ipfw -f flush
 +
#sudo ipfw -f list
 +
 +
#exclude loopback traffic
 +
sudo ipfw add 00003 allow all from any to any via lo0
 +
 +
#Deny any spoofed loopback/multicast traffic
 +
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
 +
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
 +
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
 +
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in
 +
 +
#Allow outgoing/established
 +
sudo ipfw add 02050 allow tcp from any to any out
 +
sudo ipfw add 02060 allow tcp from any to any established
 +
 +
#Allow anything from LAN
 +
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any
 +
 +
#Block everything else
 +
sudo ipfw add 12190 deny log tcp from any to any
 +
sudo ipfw add 65535 allow ip from any to any
 +
 
 +
Make sure this script is executable
 +
chmod 755 firewall_config.sh
 +
 
 +
Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):
 +
/Users/frontrow/firewall_config.sh
  
 
[[Category:How-to]]
 
[[Category:How-to]]

Latest revision as of 03:22, 11 January 2009

Note

The AppleTV seems to ship with no firewall rules configured. There is no need to hack up a way to disable the firewall.


In MacOS X, at boot time,
/usr/libexec/FirewallTool
runs, which reads the file
/Library/Preferences/com.apple.sharing.firewall.plist

Neither the binary nor the plist are distributed with the AppleTV OS, and it is therefore not surprising that in a default OS install, the ipfw kext has a single 'allow any' default rule:

-bash-2.05b$ sudo ipfw list
65535 allow ip from any to any

Enabling the Firewall

It is likely that copying over FirewallTool from an Intel Mac will enable MacOS firewall configuration at boot time. In addition, it is neccesary to create /Library/Preferences/com.apple.sharing.firewall.plist. If the prefs plist file does not exist, FirewallTool will not configure ipfw. There are several ways to create this file:

Enabling the Firewall without an Intel Mac

It's possible to set up the firewall without using any GUI, and this appears to work (tested on a v2.1 AppleTV) without copying the plist or any other files from an Intel Mac. Be warned - using this method it's quite likely that your machine will be un-firewalled for a short time during boot-up, before the firewall rules script takes effect.

Create the following file as firewall_config.sh in /Users/frontrow. It can serve as a base set of firewall rules to get you started - if you want more google for "ipfw". Don't forget you must change the IP address under the comment 'Allow anything from LAN' depending on your own LAN's ip address range.

#!/bin/sh
sudo ipfw -f flush
#sudo ipfw -f list

#exclude loopback traffic
sudo ipfw add 00003 allow all from any to any via lo0

#Deny any spoofed loopback/multicast traffic
sudo ipfw add 02010 deny log ip from 127.0.0.0/8 to any in
sudo ipfw add 02020 deny log ip from any to 127.0.0.0/8 in
sudo ipfw add 2030 deny log ip from 224.0.0.0/3 to any in
sudo ipfw add 2040 deny log tcp from any to 224.0.0.0/3 in

#Allow outgoing/established
sudo ipfw add 02050 allow tcp from any to any out
sudo ipfw add 02060 allow tcp from any to any established

#Allow anything from LAN
sudo ipfw add 02070 allow ip from 192.168.0.0/24 to any

#Block everything else
sudo ipfw add 12190 deny log tcp from any to any
sudo ipfw add 65535 allow ip from any to any

Make sure this script is executable

chmod 755 firewall_config.sh

Add the following to the top line of /etc/rc.local (it should be at the top so the firewall rules kick in as soon as possible - your AppleTV is effectively unfirewalled until this script has executed!):

/Users/frontrow/firewall_config.sh