Solaris Ipfilter Pools

I wasn”t aware before that ipfilter (ipf) has a concept of pools. In other words list of IP addresses etc..

I previously had this basic article on enabling ipf in Solaris and following here is a little on pools.

** Note this was a Solaris 10 LDOM so therefore NIC was vnet0. You have to check your NIC it”s most likely net0 in Solaris 11.

Setup the pools you need as follow.

1
# pwd
2
/etc/ipf
3
# cat ippool.conf
4
### Pool 13 some essential static addresses
5
table role = ipf type = tree number = 13
6
{ 10.1.11.34/32, 10.2.10.6/32 };
7
### Pool 14 some temporary IP's
8
table role = ipf type = tree number = 14
9
{ 192.168.8.0/24, 10.200.97.82/32 };

Use the pools in your ipf.conf.

1
# cat ipf.conf
2
[...]
3
pass in quick on lo0 all
4
pass out quick on lo0 all
5

6
### Block all inbound and outbound traffic by default
7
block in log on vnet0 all head 100
8
block out log on vnet0 all head 150
9

10
### Allow inbound SSH connections
11
pass in quick on vnet0 proto tcp from any to 10.1.11.87 port = 22 keep state group 100
12

13
### Use /etc/ipf/ippool.conf for pools
14
pass in on vnet0 from pool/13 group 100
15
pass in on vnet0 from pool/14 group 100
16

17
### Allow my box to utilize all UDP, TCP and ICMP services
18
pass out quick all

Of course flush and reload from file.

1
# ipf -Fa -f /etc/ipf/ipf.conf

Check the running set.

1
# ipfstat -io
2
pass out quick on lo0 all
3
block out log on vnet0 all head 150
4
pass out quick all
5
# Group 150
6
pass in quick on lo0 all
7
block in log on vnet0 all head 100
8
# Group 100
9
pass in quick on vnet0 proto tcp from any to 10.1.11.87/32 port = ssh keep state group 100
10
pass in on vnet0 from pool/13 to any group 100
11
pass in on vnet0 from pool/14 to any group 100

Note that updating the ippools you might need to reload also.

1
# ippool -F; ippool -f /etc/ipf/ippool.conf

For me that did not always work so I also did.

1
# svcadm disable ipfilter
2
# svcadm refresh ipfilter
3
# svcadm enable ipfilter

Listing the pools will save you a lot of time root causing rules that are actually correct.

1
# ippool -l
2
table role = ipf type = tree number = 14
3
        { 192.168.8.0/24; 10.200.97.82/32; };
4
table role = ipf type = tree number = 13
5
        { 10.1.11.34/32; 10.2.10.6/32 };

As always with firewalls test test test.