MFH: r284691

MFH: r284920

  Remove 16 rules and replace by 2 by using a table.
  I've been doing this ever since there were tables.
  I could make more efficient by using "in recv"  and "out xmit" instead of via
  but I'll leave that.

1 files changed, 15 insertions, 23 deletions

diff --git a/etc/rc.firewall b/etc/rc.firewall
index ee578ef..c936da6 100644
--- a/etc/rc.firewall
+++ b/etc/rc.firewall
@@ -266,6 +266,7 @@ case ${firewall_type} in
 	#  firewall_simple_oif_ipv6:	Outside IPv6 network interface.
 	#  firewall_simple_onet_ipv6:	Outside IPv6 network prefix.
 	############
+	BAD_ADDR_TBL=13
 
 	# set these to your outside interface network
 	oif="$firewall_simple_oif"
@@ -290,19 +291,23 @@ case ${firewall_type} in
 		fi
 	fi
 
+	# Define stuff we should never send out or receive in.
 	# Stop RFC1918 nets on the outside interface
-	${fwcmd} add deny all from any to 10.0.0.0/8 via ${oif}
-	${fwcmd} add deny all from any to 172.16.0.0/12 via ${oif}
-	${fwcmd} add deny all from any to 192.168.0.0/16 via ${oif}
+	${fwcmd} table ${BAD_ADDR_TBL} flush
+	${fwcmd} table ${BAD_ADDR_TBL} add 10.0.0.0/8
+	${fwcmd} table ${BAD_ADDR_TBL} add 172.16.0.0/12
+	${fwcmd} table ${BAD_ADDR_TBL} add 192.168.0.0/16
 
-	# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
+	# And stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
 	# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
 	# on the outside interface
-	${fwcmd} add deny all from any to 0.0.0.0/8 via ${oif}
-	${fwcmd} add deny all from any to 169.254.0.0/16 via ${oif}
-	${fwcmd} add deny all from any to 192.0.2.0/24 via ${oif}
-	${fwcmd} add deny all from any to 224.0.0.0/4 via ${oif}
-	${fwcmd} add deny all from any to 240.0.0.0/4 via ${oif}
+	${fwcmd} table ${BAD_ADDR_TBL} add 0.0.0.0/8
+	${fwcmd} table ${BAD_ADDR_TBL} add 169.254.0.0/16
+	${fwcmd} table ${BAD_ADDR_TBL} add 192.0.2.0/24
+	${fwcmd} table ${BAD_ADDR_TBL} add 224.0.0.0/4
+	${fwcmd} table ${BAD_ADDR_TBL} add 240.0.0.0/4
+
+	${fwcmd} add deny all from any to "table($BAD_ADDR_TBL)" via ${oif}
 
 	# Network Address Translation.  This rule is placed here deliberately
 	# so that it does not interfere with the surrounding address-checking
@@ -319,20 +324,7 @@ case ${firewall_type} in
 		;;
 	esac
 
-	# Stop RFC1918 nets on the outside interface
-	${fwcmd} add deny all from 10.0.0.0/8 to any via ${oif}
-	${fwcmd} add deny all from 172.16.0.0/12 to any via ${oif}
-	${fwcmd} add deny all from 192.168.0.0/16 to any via ${oif}
-
-	# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
-	# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
-	# on the outside interface
-	${fwcmd} add deny all from 0.0.0.0/8 to any via ${oif}
-	${fwcmd} add deny all from 169.254.0.0/16 to any via ${oif}
-	${fwcmd} add deny all from 192.0.2.0/24 to any via ${oif}
-	${fwcmd} add deny all from 224.0.0.0/4 to any via ${oif}
-	${fwcmd} add deny all from 240.0.0.0/4 to any via ${oif}
-
+	${fwcmd} add deny all from "table($BAD_ADDR_TBL)" to any via ${oif}
 	if [ -n "$inet6" ]; then
 		# Stop unique local unicast address on the outside interface
 		${fwcmd} add deny all from fc00::/7 to any via ${oif6}