[ Top ] [ Policy ]
POLICY
Accept UDP dns replies
APPLIES TO
Any host using DROPDNSRETURN
SYNOPSIS
For host that drop a lot of dns reply packets. The packets come from the DNS server IP's and are sourced from port 53. cause of the drop is unknown. May be:
* udp reply takes > than 30 second lifetime of the udp "established" connection * bug in the "established" code for udp packets for these firewalls
In any case rather than trying to figure it out, tag these hosts with DROPSDNSRETURN in the uses clause to enable accepting packets sourced from 192.168.x.x at port 53.
[ Top ] [ Policy ]
POLICY
Allow any host access to external DNS server
APPLIES TO
hosts in DNSEXT class
SYNOPSIS
Allow port 53 udp for all hosts not in the 192.168.0.0/16 net.
[ Top ] [ Policy ]
APPLIES TO
any VPNIPSEC hosts
SYNOPSIS
drop spoofed traffic
DESCRIPTION
drop spoofed traffic
[ Top ] [ Policy ]
POLICY
Access lists for email
APPLIES TO
hosts in MAIL1 or MAIL2 class, hosts in MAILINT class
SYNOPSIS
Hosts support smtp and smtps. for machines on 192.168.0.0/16 net. If not in MAILINT group, supports smtp and smtps for any host.
DESCRIPTION
Allow access to ports 25 and 465 from all 192.168.0.0/16 hosts UNLESS machine is part of MAILINT group. If part of MAILINT only allows access to ports 25 and 465 from hosts on 192.168.0.0/16.
[ Top ] [ Policy ]
POLICY
Access lists nfs in site_lax1
APPLIES TO
hosts in NFSSERV
SYNOPSIS
Hosts allow nfs clients to connect
DESCRIPTION
Allow access to ports 111,632,633,634,635,2049 from appropriate hosts
[ Top ] [ Policy ]
POLICY
Access list for top level ntp servers
APPLIES TO
All top level ntp servers
SYNOPSIS
Allow access to ntp servers from internal and selected external hosts
DESCRIPTION
Allow access to port 123/udp
[ Top ] [ Policy ]
POLICY
Services accessible from openvpn connected hosts.
APPLIES TO
hosts accessing network via openvpn
SYNOPSIS
Allow tcp traffic, udp DNS and icmp traffic to/from systems
DESCRIPTION
Allows all tcp traffic subject to vpn host's access restrictions. Allows port 53 udp traffic (to selected dns servers) Allows icmp traffic again subject to firewalls for openvpn host.
[ Top ] [ Policy ]
POLICY
Access list for snmp servers
APPLIES TO
all hosts
SYNOPSIS
Allow access to snmp servers from cacti and nagios servers.
DESCRIPTION
Allow access to port 161 from cacti and nagios servers.
[ Top ] [ Policy ]
POLICY
Rules for openvpn natting of addresses
APPLIES TO
hosts in VPNOPEN
SYNOPSIS
set the source address of packets received from openvpn clients
DESCRIPTION
Rewrite the source address (which for the clients is on the 172.16.1.0 net) to the internal address of the openvpn server if the packet is to be routed out the eth0 interface, and to the external address of the openvpn server if it is to be routed out any other interface.
Note that these rules are automatically installed by the ovpn.up script pushed to the openvpn servers. So changes to these rules require corresponding changes to the ovpn.up script to prevent duplicate or conflicitng rules.