Firewall General

General Thread for firewall questions. >what i need/want I want help to setup my firewall rules properly, my firewall is IPFW and i just want allow TCP connections to the bridges i use to connect to Tor network, i need help to get the things working like allow necessary things like some other protocols at LAN. My main goal is to prevent DNS leak and any kind of connection in WAN except to the bridges. English is not my main language, calm down please.

iptables is what you want. You can find some basic firewalls online that function well and do exactly what you want. note it doesn't do anything for ipv6, you need ip6tables for that.

You might want to look into ufw -- wiki.ubuntu.com/UncomplicatedFirewall . It alone will probably cover 90-95% of your use cases and is a lot simpler than dealing with iptables. But if you need some functionality from iptables you can easily integrate it in.

>>3512 I forgot to say, i use some BSD as my main system and i have some options to use as my firewall like (IPFW, IPF and PF), but iptables is not an option for me, btw thanks for the information about ipv6 i used think iptables can manage both version of internet protocol. >>3513 Thanks lainon, this UFW can be used in other distros too? ALSO: I create some rules as solution to my problems and i will share now. #Just some shortcut to use along the rule script. IPF="ipfw -q add" #Flushing all rules ipfw -q -f flush #Adding IPs from bridges to some table named '1' ipfw table 1 add x.x.x.x ipfw table 1 add x.y.x.y #Allowing TCP from me to bridges $IPF 5 allow tcp from me to 'table(1)' #Allowing TCP from bridges to me $IPF 5 allow tcp from 'table(1)' to me #loopback $IPF 10 allow all from any to any via lo0 $IPF 20 deny all from any to 127.0.0.0/8 $IPF 30 deny all from 127.0.0.0/8 to any I hope some of you enjoy, i think it is a good pratice to allow tor-only traffic including DNS.

>>3514 I've used it on debian and ubuntu but forgot you were using BSD's IPFW. I have no experience with any BSD distro but heard good things about pf. Looks like you solved your problem though.

Allowing TCP traffic to Tor bridges means you'll have TCP traffic to certain IP addresses. Doesn't mean it will be legit Tor traffic though. Just sayin

>>3515 I solved my problem in a partial way, because when i connect to some public WIFI, the connections just don't work, probably some networks need to less restrict rules to work properly but i don't know why it happens. >>3518 I know this rules isn't any panacea, but i keep asking obfs4 bridges direct to tor project, can you give me some tips to improve my opsec?