Recently I began using strongvpn to allow connections to my computer from the outside via vpn.
On my mac I have Screen Sharing, Apache2, and ssh running. Thinking about security, before I started using the VPN service my computer could only be seen by people on campus, but now however my machine is open to the whole world on those ports.
I wanted to block Screen Sharing and Apache from outside connections but still allow myself to visit my mac on campus. To do this I did some quick research on ipfw, below are the commands I used to setup blocking connections besides those on campus.
sudo ipfw -f flush
sudo ipfw add 02055 deny tcp from any to any 5900 in
sudo ipfw add 02054 allow tcp from 128.153.0.0/16 to any 5900 in
sudo ipfw add 02070 deny tcp from any to any 80 in
sudo ipfw add 02069 allow tcp from 128.153.0.0/16 to any 80 in
sudo ipfw list
Below is an explanation of the rules above:
sudo ipfw -f flush // removes all the current rules
sudo ipfw add 02055 deny tcp from any to any 5900 in // blocks all incoming connections on port 5900 which is what vnc uses (Screen Sharing)
sudo ipfw add 02054 allow tcp from 128.153.0.0/16 to any 5900 in
This makes it so only people with an ip address of 128.153.xxx.xxx can connect on port 5900. If I had done 128.153.0.0/32 only people from 128.153.0.xxx could connect
Next we need to create a script that will set these rules on reboot / start.
To do so we will create a file called loadipfwrules.sh in /usr/local/bin and paste the rules from above in it. Next we want to set the correct permissions on the file so run
sudo chmod 0755 loadipfwrules.sh
Next we will want to make the .plist file that will call our script at startup. We will make a file in /Library/LaunchDaemons under any name. In this example we will call it ipfwrules.plist. The plist file should contain the following:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST
1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>ipfwloadrules</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/loadipfwrules.sh</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>UserName</key>
<string>root</string>
<key>GroupName</key>
<string>wheel</string>
</dict>
</plist>
