0

I am trying to set a firewall rule in solaris that should block a port from external access. I could acheive this using iptables in linux and would like to do the same in solaris as well.

After some googling on ip filters in solaris, I found that we have to update the ipf.conf file in /etc/ipf/ with rules something like this.

allow in quick proto tcp from port = block in proto tcpfrom any port =

But, some thing went wrong and the port can still be accessed from an external ip.

Can anyone tell me how to acheive my goal? What went wrong and any docs for reference.

Your help is very much appreciated. Thanks in advance,

Thanks & Regards, Srikanth

  • 1
    What do you mean by "block a port from external access"? Are you trying to prevent an external host from connect to the port, or a process on the host using that port to send traffic out? – Andrew Henle Jun 20 '17 at 9:49
1

A simple rule like:

block in proto tcp from any to 192.168.0.62 port = 1234

would block port 1234 to interface with IP 192.168.0.62 Then:

# svcs ipfilter

STATE STIME FMRI

disabled May_15 svc:/network/ipfilter:default

# svcadm enable ipfilter

# svcs ipfilter

STATE STIME FMRI

online 11:30:08 svc:/network/ipfilter:default

  • What file do you put that into? – Timothy Pulliam May 3 '18 at 17:28
  • /etc/ipf/ipf.conf – Noj Jun 14 '18 at 12:24
0

You don't note which version of Solaris you're using.

Have you considered using TCP wrappers to disable/block the service from that system?

Probably overkill, but if you're using v11, you can also install the pkg network/firewall (Solaris Firewall is derived from OpenBSD PF) in case that would meet your needs.

Not sure your rule is a valid rule. You may want to show the output of: ipfstat -io which would display your rules that are currently loaded.

This might give you what you want in your ipf.conf:

allow in quick proto tcp/udp from 127.0.0.1 to any port = <port_to_block> block in log proto tcp/udp from any to any port = <port_to_block> svcadm restart ipfilter

Wasn't sure what you meant by "external access." The above will allow the localhost to connect to the port, but block any other IPs. You could also add rules to allow other local systems/subnets.

You'll find docs on Oracle's site noting how to use ipfilters, but since it's based on BSD's ipfilter, you can also look at that documentation, as well as other examples that can be found for Solaris and BSD.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy