IPFW and Airport + Rules

Question

Level 1

0 points

IPFW and Airport + Rules

Hi All,

I am creating a firewall rule using IPFW on my mac machine having an Airport card installed.

The rule is as below

ipfw add deny 802.11 from me to any 22

ipfw add deny 802.11 from me to any 80

ipfw add deny 802.11 from me to any 22 out

ipfw add deny 802.11 from me to any 80 out

But when i try to perform an SSH from another machine to this and vice-versa it works! Ideally it should not work....

However, if i replace the protocol "802.11" with "tcp". It blocks all the SSH option from and to my machine.....

My doubt is isn't Airport card belonging to 802.11n/g technology?

Please explain!!

Network diagram

macbook1 ))))) ((((( macbook2

macbook 1 ---> created a test network (wireless)
macbook2 ---> joined the test network created in macbook1 wirelessly.

Many Thanks for your help!!

reg,
Hari S

iMac Intel, Mac OS X (10.4.11), Mac Book Air

Posted on Nov 4, 2008 7:52 PM

Reply

Answer 1

Duane

Level 10

124,293 points

Nov 5, 2008 7:51 AM in response to hariharas

hariharas, Welcome to the discussion area!

It looks like you are using OS 10.4, therefore I would suggest that you post in the Mac OS X v10.4 Tiger discussion area.

Reply

Answer 2

hariharas Author

Level 1

0 points

Nov 5, 2008 6:43 PM in response to Duane

This is related to "IPFW" Firewall rules on both Mac oS X 10.4.11(iMac) and Mac OS X 10.5.5 (Macbook Air)

Reply

Answer 3

Duane

Level 10

124,293 points

Nov 5, 2008 7:20 PM in response to hariharas

So then perhaps you also should post in the OS 10.5 discussion area.

Reply

Answer 4

Nov 7, 2008 8:39 AM in response to hariharas

hariharas wrote:
Hi All,

I am creating a firewall rule using IPFW on my mac machine having an Airport card installed.

The rule is as below

ipfw add deny 802.11 from me to any 22

This isn't a correct syntax for ipfw on MacOS X.
I advise you to look to the <pre>
man ipfw</pre>.

Always check the effective rules applied with: <pre>
ipfw list</pre>

AirPort is 802.11n. It is a layer 2 protocol.
Exactly as Ethernet (802.3) is a layer 2 protocol.
From the ipfw standpoint, and from the kernel standpoint
there's no difference between an Ethernet and an AirPort frame.

TCP is a layer 3 & 4 protocol, and ssh is using the port
22 of protocol TCP.

You can define a filtering rule about ssh at the TCP level
and not the layer 2 level.
On the other hand, you may define MAC address filtering
with layer 2 level rules.

However, if i replace the protocol "802.11" with "tcp". It blocks all the SSH option from and to my machine.....

And that's quite normal.

My doubt is isn't Airport card belonging to 802.11n/g technology?

AirPort was 802.11g and is now 802.11n.
<pre>--------
don't look for my Macs models in my signature, this would be uggly... and irrelevant 🙂
--
dan</pre>

Reply

Answer 5

hariharas Author

Level 1

0 points

Nov 9, 2008 3:01 AM in response to hariharas

Thanks a ton guys 🙂

Reply

Answer 6

Adam 552

Level 1

5 points

Feb 7, 2009 2:22 AM in response to hariharas

So what would you put in to forward ports?

Reply

Answer 7

Duane

Level 10

124,293 points

Feb 7, 2009 1:11 PM in response to Adam 552

Forwarding ports has nothing to do with the firewall (ipfw) on the Mac.

Similarly the firewall (ipfw) on the Mac has nothing to do with the AirPort Extreme base station (AEBS) nor port forwarding.

Reply

Answer 8

Adam 552

Level 1

5 points

Feb 8, 2009 5:15 AM in response to Duane

Can you use ipfw to allow you to use port 3050.

For example on Macbook 2 which is receiving connection via en1.
And Macbook 1 which is receiving connection via en0. And sharing to Macbook 2 via en1.
What if I wanted to go on a game or something on Macbook 2 that required port 3050.

Reply

Answer 9

Duane

Level 10

124,293 points

Feb 8, 2009 7:16 AM in response to Adam 552

If the firewall is enabled on MacBook 1, yes you would need to configure the firewall to open port 3050 on en1. If the firewall is disabled all ports are open.

I don't have the experience with ipfw to tell you exactly how to do that. I suggest that you post your question in the appropriate OS X discussion area.

Reply