Electrice.MD's Blog

As fi putut intitula acest mic articol “O comparatie intre pietile de imobil a Republicii Moldova si Florida anilor 1920″. Cunoastem cu totii, mai mult sau mai putin evenimentele care au avut loc in anii 1920 si recesiunea economica care a inceput in toamna anului 1929 si a durat pana la sfarsitul mandatului Presedintelui Hoover. O ameliorare a situatiei a inceput sa fie vizibila odata cu alegerea lui Roosevelt la functia de Presedinte a SUA.

Toate natiunile au cunoscut si inca continua sa cunoasca perioade mai “celebre” care ies din comun, ne putand fi clasate printre celelalte evenimente. Marea depresie economica din 1929 inca mai reprezinta in memoria economistilor una din cele mai violente crize economico-sociale care a condus la pierderea locurilor de munca pentru milioane de persoane.

Nu intentionez sa fac aici o analiza a cauzelor si efectelor crizei din 1929. As vrea doar sa scot in evidenta fenomenul de speculatie si excesul de optimism, doua caracteristici prezente in cadrul marilor recesiuni economice.

Care-i legatura cu piata imobiliara din Republica Moldova?

Voi incerca sa explic legatura intre piata imobiliara din Republica Moldova si excesul de optimism omniprezent pe pietile din SUA in anii 1920 printr-un exemplu simplu de tot care tine de piata de imobil din Florida cu putin timp inaintea marii recesiuni din ‘29. In aceasta perioada  un boom pe piata de imobil din Florida se crea pe baza unor motive reale, ca climatul favorabil pentru activitatea de turism si un venit anual per cap de locuitor mai important decat media natinonala. Aceasta situatie a dus la o crestere importanta a pietii si dezvoltarea activitatilor de speculatie bazate pe sperante.

J. K. Galbraith scria in una din lucrarile sale economice ca traim intro lume nu cu oameni pe care ar trebui sa-i convingem, dar cu oameni care cauta un pretext pentru a fi convinsi. Aceasta fraza ne spune multe atat despre evenimentele care au stat la baza declansarii crizei din 1929 cat si despre evenimentele care au avut loc recent pe pietele financiare internationale.

Sa revenim la cazul Floridei, unde speculatorii credeau, sau sperau ca acest orasel va deveni in curand centrul turistic mondial si valoarea imobilului va creste de o maniera spectaculoasa. Valoarea loturilor de pamant, care se gaseau la distante considerabile de oras si erau regiuni ne populate, crestea in fiecare zi. Si atat timp cat unii cumparau pentru a realiza un profit, anticipand o crestere semnificativa a pietii, nu exista nici un motiv de ingrijorare deoarece preturile cresteau automat odata cu cererea! Ceea ce inseamna ca speculatorii, prin actiunile lor de cumparare, alimentau tendinta de crestere a preturilor pe piata imobiliara din Florida. Acest mecanism sta la baza crearii celor mai mari bule imobiliare si poate explica cresterea spectaculoasa a valorii pietii imobiliare din Republica Moldova deoarcece actorii pietii se implica masiv in proiecte imobiliare oferind posibilitatea pentru cumparatori de a avansa doar un mic procent din pretul total, astfel incuranjand actul de cumparare. Insa ce se va intampla cand cumparatorii nu vor mai fi capabili sa achite soldul din motive bine cunoascute (recesiunea in economiile occidentale va afecta serios sectorul de servicii la persoana si constructie in care lucreaza majoritatea cumparatorilor de imobil din Moldova)???

Aceasta situatie nu putea dura mult timp. Daca va amintiti de Karl Marx, el spunea ca sistemul capitalist poate functiona doar in cazul in care pentru fiecare bun economic exista un cumparator. Odata cu largirea gamei si cresterea nivelului de productie, procesul de vanzare devine tot mai complicat de realizat, de unde crizele de sur-productie.

Teoria lui Marx poate fi aplicata si in cazul pietii imobiliare. La inceputul anului 1928 toti cei care au investit masiv in imobilul din Florida au vrut sa-si transforme bunurile posedate in bani, lucru care s-a adeverit a fi extrem de dificil. In curand valoarea pietii s-a prabusit si “marii” speculatori si-au orientat investitiile spre piata financiara. Rezultatul il cunoastem cu totii…

As vrea aici sa-mi reafirm pozitia referitor la evolutia valorii pietii imobiliare din Republica Moldova. Exista un intreg panel de motive care ma face sa afirm ca stagnarea pietii si chiar o descrestere a preturilor este de asteptat. Sa nu uitam ca o mare parte a populiei care a cumparat un bun imobil sau intentioneaza sa cumpere a facut apel la organismele financiare din Occident, pentru finantarea actului de cumparare. In urma crizei financiare bancile din Europa au majorat de o maniera semnificativa rata de dobanda, trecand de la 4% – 5% la 8% in mediu. Conditiile de acordare a creditelor devin tot mai stricte. Calmarea tensiunilor pe piata materiilor prime si anticiparile extrem de pesimiste referitor la cresterea economica mondiala (lucru care va afecta atat nivelul salariilor pentru moldovenii care au o activitate in strainatate cat si preturile pentru materiile prime) confirma previziunile care le-am facut mai sus.

Ne apropiem probabil de cea mai importanta criza economica din ultimii 70 de ani. Aceasta criza este 100/100 “Made in America”. SUA si-a exportat produsele financiare toxice in toata lumea, filozofia sa de dereglementare a pietilor si cultura sa de iresponsabilitate a marilor directori financiari si industriali.

In prezent US are nevoie de masuri radicale pentru relansarea economiei nationale si ca si pe timpurile Marii Depresii actorii financiari vor propune masuri care prevad o reducere drastica a cheltuielilor budgetare.

Insa efectele crizei nu s-au oprit la frontierele tarilor din Occident, statele mai putin dezvoltate sau cele facand parte din BRIC (Brazilia, Rusia, India, China) fiind deasemenea molipsite de aceasta boala americana. In timp ce America absorba toate saving-urile monetarea agentilor economici din lumea intreaga pentru a-si regla problemele, tarile mai putin dezvoltate sint nevoite sa-si stringa centura si sa se pregateasca pentru vremuri dificile… Statele cu un deficit comercial important, cu datorii mari cat si cele care intretin relatii comerciale dezvoltate cu US vor avea de suferit cel mai mult.

Numarul tarilor care cer ajutor financiar de la FMI este in continua crestere. Insa ar trebui sa fim mai prudenti deoarece Fondul Monetar International isi scoate vechile trucuri monetariste, cum ar fi diminuarea masei monetare sau reducerea cheltuielilor publice, efectul acestor masuri fiind agravarea inegalitatilor la nivel mondial. In timp ce statele dezvoltate vor aplica politici anticiclice cu scopul stabilizarii situatiei economice, tarile in curs de dezvoltare vor adopta masurile de destabilizare prescrise de catre FMI care vor avea ca efect o evaporare a capitalului vital pentru economiile acestora.

Cu zece ani in urma, dupa criza din tarile asiatice autoritatile monetare si politice vorbeau mult despre reformarea arhitecturii financiare mondiale. Putine lucruri au fost facute…

Astazi, ca si in 1944 la Bretton Woods, institutiile financiare internationale sint constiente de necesitatea reformarii sistemului actual si totusi avanseaza cu viteza melcului.

15 ani si un razboi mondial au fost necesari pentru reglementarea sistemului financiar mondial care a constituit motivul principal declansarii Marii Depresii economice din ‘29. Sa speram ca nu vom fi nevoiti sa asteptam atat de mult, luand in consideratie nivelul de interdependenta a economiile mondiale pretul care-l vom plati va fi cu mult mai MARE!

Propuneri:

- Crearea unui Fond cu scopul sustinerii si incurajarii activitatilor de productie si investitie a IMM-urilor facilitindule accesul la credite

- Finantarea Fondului din banii acumulati in urma procesului activ de privatizare

- Limitarea costurile de functionare atat publice cat si private prin crearea unui organism “Cost Killer” independent care ar evalua eficienta structurilor publice

- Cresterea investitiilor publice in sectoarele strategice prin crearea unui fond in parteneriat cu investitori straini

- Identificarea unei clientele/parteneri comerciali solvabili si anticiparea nevoilor durabile a acestora

- Exemplul german si nu american referitor la politica comerciala si industriala
- Investitii publice in:

1. Crearea unui program de instruire profesionala pentru persoanele deja in activitate sau care se intorc din strainatate pentru o egalitate mai apropiata intre Cererea si Oferta de munca

2. Cooperarea cu organismele si fondurile straine deja existente care ofera credite si servicii de consulting gratuite pentru moldovenii, aflati in strainatate avant intentii antreprenoriale in RM. Optimizarea resurselor ar fi posibila prin crearea unui singur Fond detinut in parti egale de catre statul RM si organismele straine prezente pe teritoriul Moldovei.

- Atragerea capitalului strain prin cooperarea organismelor publice din RM cu asociatiile de afaceri prezente in tarile UE

- Scutirea de impozite pt profitul reinvestit nu doar pt companiile cu sediul in strainatate

- Dezvoltarea spiritului antreprenorial in randul populatiei

The Software

Like all of the BSDs, FreeBSD has always been security conscious. It offers several built-in firewalls to choose from: ipfw, ipf, and pf. I use pf because it is built into all of the BSDs, including OpenBSD, NetBSD, and DragonFly BSD.

I also recommend using a GUI firewall editor called fwbuilder. While my examples will demonstrate this utility from a FreeBSD system, it is available for Linux, Mac OS X, and Windows XP and supports iptables, ipfilter, pf and ipfw.

pf comes with FreeBSD, but double-check that it is loaded on your system by typing the following as the superuser:

# kldload pf.ko

If you get your prompt back, you just loaded it manually. If you’re in the habit of turning off your computer, add a line to /etc/rc.conf to reload pf when your system boots:

pf_enable="YES"

If you instead get an error like:

kldload: can't load pf.ko: File exists

it means that your system is already configured to load pf for you.

Installation

Become the superuser and install fwbuilder:

# pkg_add -r fwbuilder # rehash # fwbuilder

The fwbuilder command will open up the Welcome to Firewall Builder screen. A prompt will ask if you want to open an existing project file or create a new one. Click on the Create new project file button and give it a filename; the program will add the .fwb extension. Click on the Next button to proceed.

The next screen offers two possibilities:

• Activate Revision Control system for this file (if you don’t do this now, you can always activate it later)
• Let the program automatically open this file when you start it next time (you can activate this option later using Preferences dialog)

Revision control is a very good thing. Every time you start fwbuilder, it maintains a copy of your existing project file (i.e., your last session). This gives you a history of all of your sessions. More importantly, if you mess things up, you can go back to a previous working session. I recommend selecting both options, then pressing Finish.

Configuring the Firewall Object

This will take you to the fwbuilder GUI, which is divided into two main sections. The left frame contains an Object tree and the right frame contains your firewall rules (after you have defined some objects). Using objects is a very powerful visual aid, allowing you to quickly see your networks, computers, and services, and to cut and paste these objects into firewall rules.

The first object you create should represent your firewall. Click on the New Object icon (it looks like a sheet of paper) and select New Firewall from the drop-down menu. Give your firewall a name (I called mine my_firewall), select PF from the drop-down menu of firewall software, and click Next. Keep the default to Configure interfaces manually, and press Next.

You should see a screen like Figure 1.

Figure 1. Your new firewall

Note: if your screen doesn’t include the Netmask and MAC options, you didn’t start fwbuilder as the superuser. Only the superuser can create firewall objects and firewall rules.

Be sure to Add the interface information for each NIC in your computer as well as the loopback. If your firewall will protect only your personal computer, you need only one physical NIC installed in your computer. If you wish your computer to provide NAT to other computer(s) on your home network, you need to have two NICs installed.

If your ISP assigns you a DHCP address, check the Dynamic address option. Otherwise, enter your static IP address and subnet mask.

To determine the FreeBSD names of your interfaces as well as the associated IP addressing information, type:

# ifconfig xl0: flags=8843 mtu 1500     options=9     inet 192.168.2.49 netmask 0xffffff00 broadcast 192.168.2.255     ether 00:04:75:ee:e0:21     media: Ethernet autoselect (100baseTX )     status: active lo0: flags=8049 mtu 16384     inet 127.0.0.1 netmask 0xff000000

With my information, I entered into the New Firewall screen:

Name:        xl0 Address:    (greyed out because I checked Dynamic address) Netmask:    (greyed out because I checked Dynamic address) MAC:        00:04:75:ee:e0:21 Label:        external  Name:        lo0 Address:    127.0.0.1 Netmask:    255.0.0.0 MAC:        (leave empty) Label:        loopback

When choosing a label, “external” is good for the NIC you use to access the internet, and “internal” is good for the NIC attached to your home network. If you need to add a static subnet mask, you must first convert that hex number (0xffffff00, for example) to decimal. Ignore the 0x, as that simply indicates a hex number. What remains is four pairs of numbers: ff ff ff 00. ff is easy; it represents 255, and 00 represents 0, so this mask is: 255.255.255.0. If you have a pair that isn’t an ff or a 00, use a conversion table:

Note to users of modems: your interface name will be either ppp0 or tun0. Running ifconfig while connected to the internet will make it easier to spot your IP address.

Once you’ve entered the information for a NIC, click Add and repeat for each of your NIC(s). When finished, click on the Finish button. The Firewall properties menu will stay open for you, but you can close it to keep the defaults. If you take a look at your Object tree, it now contains some new objects: one for your firewall and one for each interface you defined.

You have one last change to finish the firewall object–marking one of the interfaces as a Management interface. For a personal firewall, it should be the loopback. Double-click your loopback object and check the Management interface box, then close that screen.

Creating a Simple Firewall Ruleset

You now have everything you need to create a simple firewall ruleset that allows your personal computer to access the internet and prevents anyone on the internet from accessing your computer.

Click on the Rules menu and select Insert Rule (Figure 2). Notice that the default rule denies any source from reaching any destination using any TCP/UDP service. To allow the system running the firewall, right-click your firewall object and select Copy. Right-click inside the Source box of the rule and Paste. Your firewall should now show as the source of packets. Next, right-click the Deny word under Action and change it to Accept. In the Options box, right-click and select Logging Off–you don’t want to log every one of your successful packets.

Figure 2. Inserting a rule (Click for full-size image)

You should always add a comment to remind yourself why you made a rule. If you double-click on the box, you can type in your comment. I wrote:

allow my computer to access the internet

That one rule is enough to give you a working firewall. If you want, you can add a second rule. Click on the Rules menu and select Add Rule Below. Add a comment:

deny all other traffic

If you don’t plan on looking at your firewall logs, turn off logging in the Options box.

Note that this second rule isn’t necessary for this setup, because the pf firewall assumes you want to deny any traffic you didn’t explicitly accept. This is an implicit deny. You may find it useful to add the rule with a comment to remind you of this behavior.

Tip: A quick administrator’s trick is to add this rule only when you are troubleshooting a problem and to leave the Logging option on.

Installing your Firewall Rules

You’ve just created a firewall ruleset, but it won’t start working until you install it.

First, you need to configure sshd to allow the superuser to connect and install the firewall rules. By default, FreeBSD doesn’t allow superuser ssh sessions. Change this default by typing the next line very carefully and double-checking your upper- and lowercase and your >> before pressing enter:

# echo "PermitRootLogin yes"  >> /etc/ssh/sshd_config

Don’t worry; no one on the internet will be able to ssh to your computer once you install your firewall rules. Next, tell sshd about that change:

# /etc/rc.d/sshd reload Reloading sshd config files.

If you see an error:

sshd not running? (check /var/run/sshd.pid).

use this command instead:

# /etc/rc.d/sshd start Starting sshd.

Double-check that sshd is running with:

# /etc/rc.d/sshd status sshd is running as pid 5467.

Next, select Install from the Rules menu. You’ll receive this message:

    Some objects have been modified since     you compiled the policy last time.     Do you want to recompile it before you install?

You do, so click the Compile button. A text box should open and the last message should read “Policy compiled successfully.” Click the Install button. Under authentication information, enter root for the username and type in the password for your superuser account, then press Next. You should receive a New RSA key message:

    You are connecting to the firewall 'my_firewall'     for the first time. It has provided you its     identification in a form of its host public key. The     fingerprint of the host public key is: "     b6:76:30:aa:01:27:64:48:3b:18:28:18:5b:c9:ae:e4"     You can save the host key to the local database     by pressing YES, or you can cancel connection     by pressing NO. You should press YES only if     you are sure you are really connected to the      firewall 'my_firewall'.

It is safe to press Yes because you know you are connecting to your own firewall. However, it is good to know how to check a host’s fingerprint in case you ever connect to a remote FreeBSD system:

# ssh-keygen -l -f /etc/ssh/ssh_host_dsa_key.pub 1024     b6:76:30:aa:01:27:64:48:3b:18:28:18:5b:c9:ae:e4

Note: you will only need to verify the fingerprint the very first time you install your firewall.

Once you click Yes, a text box will open (mine was minimized). You will get a message about No ALTQ support in the kernel, but that’s OK, as you aren’t using it. Simply close the message box. Your firewall is now running.

Controlling the Firewall

Use the pfctl (pf control) command to see what’s happening with your firewall and to stop and start the firewall. Use the show switch (-s) to view the rules currently running on the firewall:

# pfctl -s rules No ALTQ support in kernel ALTQ related functions disabled pass out quick inet from (xl0) to any keep state label "RULE 0 -- ACCEPT " block drop in quick inet all label "RULE 1 -- DROP " block drop out quick inet all label "RULE 1 -- DROP " block drop in quick inet all label "RULE 10000 -- DROP " block drop out quick inet all label "RULE 10000 -- DROP "

If you compare that text to the rules you made in fwbuilder, you’ll recognize rules 0 and 1. Rule 10000 is that implicit deny rule.

If you ever wish to stop your firewall, use the disable switch:

# pfctl -d

To restart the firewall, specify the name of your ruleset. It will be in /etc and have the same name as your firewall. In my case, it is in /etc/my_firewall.conf. To start this firewall, I use pfctl at the command line with the enable switch:

# pfctl -e /etc/my_firewall.conf

Alternatively, I can right-click the firewall in the Objects tree and choose Install from the drop-down menu. (Note that this will fail for the current set of rules. It’s easy to fix though.)

Note: if you added the line to /etc/rc.conf mentioned at the beginning of this article, add another line to load your ruleset if you reboot your computer:

pf_rules="/etc/my_firewall.conf"

where my_firewall.conf is the name of your ruleset. It is always a good idea to run pfctl -s rules after a reboot to double-check that your firewall is running.

Fine-Tuning the Rules

If you take a look at your first rule, it allows the firewall to go anywhere as a Source. However, nothing can connect to the firewall as a Destination. This includes the firewall making a connection to itself in order to install a policy, so if you were to add a rule you would get an error when you tried to install it. This is fine if you are happy with your firewall as is. Try it out–you should be able to surf, send/receive email, and do most of the things you normally do on the internet.

However, if you find you need to add more rules, you must start with a rule that allows the firewall to install a policy. Click on the number 0 in the first rule, go to the Rules menu, and select Insert Rule. Because the firewall needs to access the loopback management interface over ssh, it makes sense to have the rule look like this:

Source:        my_firewall Destination:    my_firewall:lo0:ip    (you'll find this if you click the +                       by your loopback object)  Service:    ssh Action:        Accept Options:    Logging On Comment:    allow firewall to install policy

You haven’t made a ssh object yet, so do so now. Click + next to Services to expand its tree. Right-click TCP and select New TCP Service. Under Name:, enter ssh. Under Destination Port Range Start, enter 22 and click the Apply Changes button. When finished, your firewall rules should resemble Figure 3.

Figure 3. Firewall rules that allow ssh (Click for full-size image)

Before you can install the new rule, you will have to temporarily stop the firewall–remember, it currently doesn’t allow any connections to itself.

# pfctl -d

Install the rulebase as usual; it will restart the firewall for you. You should be able to see your new rule if you type:

# pfctl -s rules

My new rule looks like:

pass out log quick inet proto tcp from (xl0) to 127.0.0.1 port = ssh keep  state label "RULE 0 -- ACCEPT "

Conclusion

Today, I’ve demonstrated how to make a personal firewall that protects your system while allowing you to access the internet. My next article will show you how to install a NAT policy with fwbuilder and explore some of its other features.

Dru Lavigne is a network and systems administrator, IT instructor, author and international speaker. She has over a decade of experience administering and teaching Netware, Microsoft, Cisco, Checkpoint, SCO, Solaris, Linux, and BSD systems. A prolific author, she pens the popular FreeBSD Basics column for O’Reilly and is author of BSD Hacks and The Best of FreeBSD Basics.

The Software

Like all of the BSDs, FreeBSD has always been security conscious. It offers several built-in firewalls to choose from: ipfw, ipf, and pf. I use pf because it is built into all of the BSDs, including OpenBSD, NetBSD, and DragonFly BSD.

I also recommend using a GUI firewall editor called fwbuilder. While my examples will demonstrate this utility from a FreeBSD system, it is available for Linux, Mac OS X, and Windows XP and supports iptables, ipfilter, pf and ipfw.

pf comes with FreeBSD, but double-check that it is loaded on your system by typing the following as the superuser:

# kldload pf.ko

If you get your prompt back, you just loaded it manually. If you’re in the habit of turning off your computer, add a line to /etc/rc.conf to reload pf when your system boots:

pf_enable="YES"

If you instead get an error like:

kldload: can't load pf.ko: File exists

it means that your system is already configured to load pf for you.

Installation

Become the superuser and install fwbuilder:

# pkg_add -r fwbuilder # rehash # fwbuilder

The fwbuilder command will open up the Welcome to Firewall Builder screen. A prompt will ask if you want to open an existing project file or create a new one. Click on the Create new project file button and give it a filename; the program will add the .fwb extension. Click on the Next button to proceed.

The next screen offers two possibilities:

• Activate Revision Control system for this file (if you don’t do this now, you can always activate it later)
• Let the program automatically open this file when you start it next time (you can activate this option later using Preferences dialog)

Revision control is a very good thing. Every time you start fwbuilder, it maintains a copy of your existing project file (i.e., your last session). This gives you a history of all of your sessions. More importantly, if you mess things up, you can go back to a previous working session. I recommend selecting both options, then pressing Finish.

Configuring the Firewall Object

This will take you to the fwbuilder GUI, which is divided into two main sections. The left frame contains an Object tree and the right frame contains your firewall rules (after you have defined some objects). Using objects is a very powerful visual aid, allowing you to quickly see your networks, computers, and services, and to cut and paste these objects into firewall rules.

The first object you create should represent your firewall. Click on the New Object icon (it looks like a sheet of paper) and select New Firewall from the drop-down menu. Give your firewall a name (I called mine my_firewall), select PF from the drop-down menu of firewall software, and click Next. Keep the default to Configure interfaces manually, and press Next.

You should see a screen like Figure 1.

Figure 1. Your new firewall

Note: if your screen doesn’t include the Netmask and MAC options, you didn’t start fwbuilder as the superuser. Only the superuser can create firewall objects and firewall rules.

Be sure to Add the interface information for each NIC in your computer as well as the loopback. If your firewall will protect only your personal computer, you need only one physical NIC installed in your computer. If you wish your computer to provide NAT to other computer(s) on your home network, you need to have two NICs installed.

If your ISP assigns you a DHCP address, check the Dynamic address option. Otherwise, enter your static IP address and subnet mask.

To determine the FreeBSD names of your interfaces as well as the associated IP addressing information, type:

# ifconfig xl0: flags=8843 mtu 1500     options=9     inet 192.168.2.49 netmask 0xffffff00 broadcast 192.168.2.255     ether 00:04:75:ee:e0:21     media: Ethernet autoselect (100baseTX )     status: active lo0: flags=8049 mtu 16384     inet 127.0.0.1 netmask 0xff000000

With my information, I entered into the New Firewall screen:

Name:        xl0 Address:    (greyed out because I checked Dynamic address) Netmask:    (greyed out because I checked Dynamic address) MAC:        00:04:75:ee:e0:21 Label:        external  Name:        lo0 Address:    127.0.0.1 Netmask:    255.0.0.0 MAC:        (leave empty) Label:        loopback

When choosing a label, “external” is good for the NIC you use to access the internet, and “internal” is good for the NIC attached to your home network. If you need to add a static subnet mask, you must first convert that hex number (0xffffff00, for example) to decimal. Ignore the 0x, as that simply indicates a hex number. What remains is four pairs of numbers: ff ff ff 00. ff is easy; it represents 255, and 00 represents 0, so this mask is: 255.255.255.0. If you have a pair that isn’t an ff or a 00, use a conversion table:

Note to users of modems: your interface name will be either ppp0 or tun0. Running ifconfig while connected to the internet will make it easier to spot your IP address.

Once you’ve entered the information for a NIC, click Add and repeat for each of your NIC(s). When finished, click on the Finish button. The Firewall properties menu will stay open for you, but you can close it to keep the defaults. If you take a look at your Object tree, it now contains some new objects: one for your firewall and one for each interface you defined.

You have one last change to finish the firewall object–marking one of the interfaces as a Management interface. For a personal firewall, it should be the loopback. Double-click your loopback object and check the Management interface box, then close that screen.

Creating a Simple Firewall Ruleset

You now have everything you need to create a simple firewall ruleset that allows your personal computer to access the internet and prevents anyone on the internet from accessing your computer.

Click on the Rules menu and select Insert Rule (Figure 2). Notice that the default rule denies any source from reaching any destination using any TCP/UDP service. To allow the system running the firewall, right-click your firewall object and select Copy. Right-click inside the Source box of the rule and Paste. Your firewall should now show as the source of packets. Next, right-click the Deny word under Action and change it to Accept. In the Options box, right-click and select Logging Off–you don’t want to log every one of your successful packets.

Figure 2. Inserting a rule (Click for full-size image)

You should always add a comment to remind yourself why you made a rule. If you double-click on the box, you can type in your comment. I wrote:

allow my computer to access the internet

That one rule is enough to give you a working firewall. If you want, you can add a second rule. Click on the Rules menu and select Add Rule Below. Add a comment:

deny all other traffic

If you don’t plan on looking at your firewall logs, turn off logging in the Options box.

Note that this second rule isn’t necessary for this setup, because the pf firewall assumes you want to deny any traffic you didn’t explicitly accept. This is an implicit deny. You may find it useful to add the rule with a comment to remind you of this behavior.

Tip: A quick administrator’s trick is to add this rule only when you are troubleshooting a problem and to leave the Logging option on.

Installing your Firewall Rules

You’ve just created a firewall ruleset, but it won’t start working until you install it.

First, you need to configure sshd to allow the superuser to connect and install the firewall rules. By default, FreeBSD doesn’t allow superuser ssh sessions. Change this default by typing the next line very carefully and double-checking your upper- and lowercase and your >> before pressing enter:

# echo "PermitRootLogin yes"  >> /etc/ssh/sshd_config

Don’t worry; no one on the internet will be able to ssh to your computer once you install your firewall rules. Next, tell sshd about that change:

# /etc/rc.d/sshd reload Reloading sshd config files.

If you see an error:

sshd not running? (check /var/run/sshd.pid).

use this command instead:

# /etc/rc.d/sshd start Starting sshd.

Double-check that sshd is running with:

# /etc/rc.d/sshd status sshd is running as pid 5467.

Next, select Install from the Rules menu. You’ll receive this message:

    Some objects have been modified since     you compiled the policy last time.     Do you want to recompile it before you install?

You do, so click the Compile button. A text box should open and the last message should read “Policy compiled successfully.” Click the Install button. Under authentication information, enter root for the username and type in the password for your superuser account, then press Next. You should receive a New RSA key message:

    You are connecting to the firewall 'my_firewall'     for the first time. It has provided you its     identification in a form of its host public key. The     fingerprint of the host public key is: "     b6:76:30:aa:01:27:64:48:3b:18:28:18:5b:c9:ae:e4"     You can save the host key to the local database     by pressing YES, or you can cancel connection     by pressing NO. You should press YES only if     you are sure you are really connected to the      firewall 'my_firewall'.

It is safe to press Yes because you know you are connecting to your own firewall. However, it is good to know how to check a host’s fingerprint in case you ever connect to a remote FreeBSD system:

# ssh-keygen -l -f /etc/ssh/ssh_host_dsa_key.pub 1024     b6:76:30:aa:01:27:64:48:3b:18:28:18:5b:c9:ae:e4

Note: you will only need to verify the fingerprint the very first time you install your firewall.

Once you click Yes, a text box will open (mine was minimized). You will get a message about No ALTQ support in the kernel, but that’s OK, as you aren’t using it. Simply close the message box. Your firewall is now running.

Controlling the Firewall

Use the pfctl (pf control) command to see what’s happening with your firewall and to stop and start the firewall. Use the show switch (-s) to view the rules currently running on the firewall:

# pfctl -s rules No ALTQ support in kernel ALTQ related functions disabled pass out quick inet from (xl0) to any keep state label "RULE 0 -- ACCEPT " block drop in quick inet all label "RULE 1 -- DROP " block drop out quick inet all label "RULE 1 -- DROP " block drop in quick inet all label "RULE 10000 -- DROP " block drop out quick inet all label "RULE 10000 -- DROP "

If you compare that text to the rules you made in fwbuilder, you’ll recognize rules 0 and 1. Rule 10000 is that implicit deny rule.

If you ever wish to stop your firewall, use the disable switch:

# pfctl -d

To restart the firewall, specify the name of your ruleset. It will be in /etc and have the same name as your firewall. In my case, it is in /etc/my_firewall.conf. To start this firewall, I use pfctl at the command line with the enable switch:

# pfctl -e /etc/my_firewall.conf

Alternatively, I can right-click the firewall in the Objects tree and choose Install from the drop-down menu. (Note that this will fail for the current set of rules. It’s easy to fix though.)

Note: if you added the line to /etc/rc.conf mentioned at the beginning of this article, add another line to load your ruleset if you reboot your computer:

pf_rules="/etc/my_firewall.conf"

where my_firewall.conf is the name of your ruleset. It is always a good idea to run pfctl -s rules after a reboot to double-check that your firewall is running.

Fine-Tuning the Rules

If you take a look at your first rule, it allows the firewall to go anywhere as a Source. However, nothing can connect to the firewall as a Destination. This includes the firewall making a connection to itself in order to install a policy, so if you were to add a rule you would get an error when you tried to install it. This is fine if you are happy with your firewall as is. Try it out–you should be able to surf, send/receive email, and do most of the things you normally do on the internet.

However, if you find you need to add more rules, you must start with a rule that allows the firewall to install a policy. Click on the number 0 in the first rule, go to the Rules menu, and select Insert Rule. Because the firewall needs to access the loopback management interface over ssh, it makes sense to have the rule look like this:

Source:        my_firewall Destination:    my_firewall:lo0:ip    (you'll find this if you click the +                       by your loopback object)  Service:    ssh Action:        Accept Options:    Logging On Comment:    allow firewall to install policy

You haven’t made a ssh object yet, so do so now. Click + next to Services to expand its tree. Right-click TCP and select New TCP Service. Under Name:, enter ssh. Under Destination Port Range Start, enter 22 and click the Apply Changes button. When finished, your firewall rules should resemble Figure 3.

Figure 3. Firewall rules that allow ssh (Click for full-size image)

Before you can install the new rule, you will have to temporarily stop the firewall–remember, it currently doesn’t allow any connections to itself.

# pfctl -d

Install the rulebase as usual; it will restart the firewall for you. You should be able to see your new rule if you type:

# pfctl -s rules

My new rule looks like:

pass out log quick inet proto tcp from (xl0) to 127.0.0.1 port = ssh keep  state label "RULE 0 -- ACCEPT "

Conclusion

Today, I’ve demonstrated how to make a personal firewall that protects your system while allowing you to access the internet. My next article will show you how to install a NAT policy with fwbuilder and explore some of its other features.

Dru Lavigne is a network and systems administrator, IT instructor, author and international speaker. She has over a decade of experience administering and teaching Netware, Microsoft, Cisco, Checkpoint, SCO, Solaris, Linux, and BSD systems. A prolific author, she pens the popular FreeBSD Basics column for O’Reilly and is author of BSD Hacks and The Best of FreeBSD Basics.