The PPP program has the ability to apply selected filtering rules to the traffic it routes. While this is not nearly as secure as a formal firewall it does provide some access control as to how the link is used.
('man ipfw' for information on setting up a more secure FreeBSD system.)
The complete documentation for the various filters and rules under PPP are availabe in the PPP manpage.
There are four distinct classes of rules which may be applied to the PPP program:
afilter - Access Counter (or "Keep Alive") filters
These control which events are ignored by the set timeout= statement in the configuration file.
dfilter - Dialing filters
These filtering rules control which events are ignored by the demand-dial mode of PPP.
ifilter - Input filters
Control whether incoming packets should be discarded or passed into the system.
ofilter - Output filters
Control whether outgoing packets should be discarded or passed into the system.
What follows is a snippet from an operating system which provides a good foundation for "normal" Internet operations while preventing PPP from pumping all data over the dial-up connection. Comments briefly describe the logic of each rule set: <hr>
# # KeepAlive filters # Don't keep Alive with ICMP,DNS and RIP packet # set afilter 0 deny icmp set afilter 1 deny udp src eq 53 set afilter 2 deny udp dst eq 53 set afilter 3 deny udp src eq 520 set afilter 4 deny udp dst eq 520 set afilter 5 permit 0/0 0/0 # # Dial Filters: # Note: ICMP will trigger a dial-out in this configuration! # set dfilter 0 permit 0/0 0/0 # # Allow ident packet pass through # set ifilter 0 permit tcp dst eq 113 set ofilter 0 permit tcp src eq 113 # # Allow telnet connection to the Internet # set ifilter 1 permit tcp src eq 23 estab set ofilter 1 permit tcp dst eq 23 # # Allow ftp access to the Internet # set ifilter 2 permit tcp src eq 21 estab set ofilter 2 permit tcp dst eq 21 set ifilter 3 permit tcp src eq 20 dst gt 1023 set ofilter 3 permit tcp dst eq 20 # # Allow access to DNS lookups # set ifilter 4 permit udp src eq 53 set ofilter 4 permit udp dst eq 53 # # Allow DNS Zone Transfers # set ifilter 5 permit tcp src eq 53 set ofilter 5 permit tcp dst eq 53 # # Allow access from/to local network # set ifilter 6 permit 0/0 192.168.1.0/24 set ofilter 6 permit 192.168.1.0/24 0/0 # # Allow ping and traceroute response # set ifilter 7 permit icmp set ofilter 7 permit icmp set ifilter 8 permit udp dst gt 33433 set ofilter 9 permit udp dst gt 33433 # # Allow cvsup # set ifilter 9 permit tcp src eq 5998 set ofilter 9 permit tcp dst eq 5998 set ifilter 10 permit tcp src eq 5999 set ofilter 10 permit tcp dst eq 5999 # # Allow NTP for Time Synchronization # set ifilter 11 permit tcp src eq 123 dst eq 123 set ofilter 11 permit tcp src eq 123 dst eq 123 set ifilter 12 permit udp src eq 123 dst eq 123 set ofilter 12 permit udp src eq 123 dst eq 123 # # SMTP'd be a good idea! # set ifilter 13 permit tcp src eq 25 set ofilter 13 permit tcp dst eq 25 # # # We use a lot of `whois`, let's pass that # set ifilter 14 permit tcp src eq 43 set ofilter 14 permit tcp dst eq 43 set ifilter 15 permit udp src eq 43 set ofilter 15 permit udp dst eq 43 # # If none of above rules matches, then packet is blocked. #-------<hr>
Up to 20 distinct filtering rules can be applied to each class of filter. Rules in each class are number sequentially from 0 to 20 but none of the rules for a particular filter class take affect until ruleset '0' is defined!
If you choose not to use Filtering Rules in the PPP configuration then ALL traffic will be permitted both into and out of your system while it's connected to your ISP.
If you decide that you want to implement filtering rules, add the above lines to your
/etc/ppp/ppp.conf file in either the "default:", "demand:", or "interactive:" section (or all of them - the choice is yours).