#
# $Id: office.conf,v 1.4 2002/12/31 15:44:34 ktsaou Exp $
#
# CASE:
# Firewall for a host with only one Ethernet interface connected to
# a LAN where the traffic coming in is:
#
#	source 10.0.0.0/16	intranet traffic
#	any other source	internet traffic
#
# The host can reach the internet via a gateway that SNATs the fake
# address this host has to its Ethernet interface to a real one.
# We assume that this NAT is bi-directional, meaning that the
# gateway will DNAT requests sent from the internet to the real IP
# of our host in order to enter the intranet and reach our server.
#
# If this NAT is not bi-directional (only SNAT but no DNAT), then
# the 'internet' and 'trusted' services bellow will simply not
# work (FireHOL will not complain).
#
# SOLUTION:
# The following FireHOL configuration script assumes there are a few
# network zones with different roles:
#
#	intranet	our company's intranet
#	department	our department within the intranet
#	personal	our PCs within the company
#	internet	the whole internet
#	trusted		computers on the internet we need to provide
#			services to
#
# For each of the above, there are two definitions:
#	1. The IP addresses or address space
#	2. The services they can access on this host.
#
# If you want to disable something, simply comment out or empty the
# variables defined for this.
#
# Other notes:
# 	- idents are rejected
#	- our host is also a workstation that can run any client
#	- our host does not route any traffic

version 5

# ----------------------------------------------------------------------
# Definitions
# ----------------------------------------------------------------------

# The network the company's intranet is using
intranet="10.0.0.0/16"
intranet_servers="icmp http smtp dns"

# The department must be a subnet of intranet
# The department will also have access to the intranet servers, so just
# add any additional servers for the department only.
department="10.0.70.0/24"
department_servers="samba imap pop3 lpd portmap"

# Personal must be PCs within the intranet (not the department)
# Personal PCs will have access to all services the intranet and the
# department have access to, so just define the additional ones.
personal="10.0.70.33 10.0.70.44"
personal_servers="ssh mysql nfs"

# Trusted must be real IPs
# These clients will have access to all the servers the internet has
# access, plus the ones defined bellow.
trusted="1.1.1.1/28 2.2.2.2"
trusted_servers="ssh http imap icmp telnet"

# The rest of the traffic is internet.
# Define here the servers for the internet traffic, if any
internet_servers="smtp"

# How many requests per second should we allow?
intranet_requests="50/sec"
internet_requests="10/sec"


# ----------------------------------------------------------------------
# Normally, you don't have to do anything bellow this point.
# ----------------------------------------------------------------------

# The intranet
interface eth0 intranet src "${intranet}"
	policy reject # be friendly to the intranet to prevent timeouts
	
	protection strong ${intranet_requests}
	
	# Servers for the company's intranet
	if [ ! -z "${intranet_servers}" ]
	then
		server "${intranet_servers}" accept
	fi
	
	# Servers for our department
	if [ ! -z "${department}" -a ! -z "${department_servers}" ]
	then
		server "${department_servers}" accept src "${department}"
	fi
	
	# Servers for our PCs within the company
	if [ ! -z "${personal}" -a ! -z "${personal_servers}" ]
	then
		server "${personal_servers} ${department_servers}" accept src "${personal}"
	fi
	
	# Prevent ident from timing out
	server ident	reject with tcp-reset
	
	# This is an Intranet workstation
	client all	accept	# To have good accounting, this should be last.
	

# The internet
interface eth0 internet src not "${intranet} ${UNROUTABLE_IPS}"
	policy drop # this is also the default
	
	protection strong ${internet_requests}
	
	# Public internet servers
	if [ ! -z "${internet_servers}" ]
	then
		server "${internet_servers}" accept
	fi
	
	# Servers for our trusted PCs
	if [ ! -z "${trusted}" -a ! -z "${trusted_servers}" ]
	then
		server "${trusted_servers}" accept src "${trusted}"
	fi
	
	# Prevent ident from timing out
	server ident	reject with tcp-reset
	
	# This is an Internet workstation too
	client all	accept	# To have good accounting, this should be last.
