### Copyright (C) 1998 John D. Hardin
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software
### Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

### $Id: isp.template,v 2.29 1999-05-24 12:33:31-07 jhardin Exp $

proc isp {} {
    # ISP Settings

    Desc "Internet Service Provider settings"

    ShortDesc "ISP settings"

    global LocalEth
    global InetEth

    Header head1 -text "ISP settings"\
	    -background gray\
	    -help "How you obtain your Internet access."

    Label label1 -packFrame:anchor center

    CheckBox on_internet -text "Connected to the Internet or acting as an internetwork firewall"\
	    -default 1\
	    -packFrame:anchor center \
	    -help "Uncheck this box if this system is a standalone server on your private network or"\
                  "boundary network or is otherwise not directly connected to the Internet.\n\n"\
                  "The firewall will protect this server only, and certain Internet-specific"\
                  "features (i.e. anti-spoofing, Private Network IP filtering and Masquerading)"\
                  "will not be generated."

    Menu connection_type -text "I connect to the Internet using"\
	    -packFrame:anchor center \
	    -help "There are several ways to connect your computer to the Internet.\n\n"\
	    "If you're lucky, you have a direct connection over Ethernet (perhaps via an ISDN router,"\
	    "Frame Relay router, or some other high-speed link). If this is the case, your"\
	    "firewall really should be set up so that the Ethernet is on a different network adapter than"\
	    "your local network. This allows you to isolate your local network and control access much more easily."\
	    "Having multiple network adapters in one computer is called \"Multihoming\".\n\n"\
	    "Otherwise, you probably have a dialup connection (perhaps via an ISDN modem) using PPP."\
	    "If this is the case, you must consider the following factors:\n"\
	    "1. Do you establish the connection manually or do you use the Diald demand-dialer?\n"\
	    "Using Diald causes some extra configuration for proper handling of masquerading."\
	    "This is handled automatically if you select one of the Diald options.\n"\
	    "2. Do you have users connecting to the firewall system via PPP?\n"\
	    "If you do, your PPP link is not guaranteed to use the ppp0 network device."\
	    "PPP network devices are allocated on an on-demand basis. Depending on the mix of"\
	    "inbound and outbound traffic, your Internet connection might be on ppp0 once, then on ppp1 the"\
	    "next time. If you have any inbound PPP connections, select one of the \"ip-up\" PPP options."\
	    -defaultIndex 0\
	    -entryhelp {\
	    "PPP (ppp0)" "Point-to-Point Protocol, permanently up or manually dialed. Dynamic IP address. No other PPP traffic."\
	    "PPP + diald (sl0, ppp0)" "Demand-dialed PPP using the diald daemon. Dynamic IP address. No other PPP traffic."\
	    "PPP (ip-up)" "Modem or ISDN Point-to-Point Protocol, permanently up or manually dialed. Dynamic or static IP address (as determined by pppd configuration). There may be other PPP traffic."\
	    "PPP + diald (sl0, ip-up)" "Demand-dialed Modem or ISDN PPP using the diald daemon. Dynamic or static IP address (as determined by pppd configuration). There may be other PPP traffic."\
	    "Static PPP (ppp0)" "Point-to-Point Protocol, permanently up or manually dialed. Static IP address. No other PPP traffic."\
	    "Static PPP + diald (sl0, ppp0)" "Demand-dialed PPP using the diald daemon. Static IP address. No other PPP traffic."\
	    "Multihomed Ethernet" "Local network on one ethernet device, the Internet on another. If you choose this option you may have to edit main.template in the module sources."\
	    "ISDN PPP (ippp0)" "ISDN Point-to-Point Protocol, permanently up or manually dialed. Dynamic IP address. No other PPP traffic."\
	    "ISDN PPP + diald (sl0, ippp0)" "Demand-dialed ISDN PPP using the diald daemon. Dynamic IP address. No other PPP traffic."\
	    "Static ISDN PPP (ippp0)" "ISDN Point-to-Point Protocol, permanently up or manually dialed. Static IP address. No other PPP traffic."\
	    "Static ISDN PPP + diald (sl0, ippp0)" "Demand-dialed ISDN PPP using the diald daemon. Static IP address. No other PPP traffic."\
	    "Static SLIP (sl0)" "Serial Link IP, permanently up or manually dialed. Static IP address. No other SLIP traffic."\
	    "Static SLIP + diald (sl0, sl1)" "Demand-dialed Serial Link IP using the diald daemon. Static IP address. No other SLIP traffic."\
	    }

    Entry ISPIP -text "Static PPP IP address"\
            -help "If your Internet IP address is permanently assigned (rather than determined dynamically"\
	    "every time you dial in) enter that address here."

    CheckBox ISPisDHCP -text "ISP IP address is assigned using DHCP"\
	    -default 0\
    	    -help "If your Internet IP address is dynamically assigned using DHCP, check this checkbox."

    Line line1

    Header head2 -text "Private Network IP filtering"\
	    -background gray\
	    -help "One way to provide secure access to the Internet is to assign your IP"\
                  "addresses from blocks of addresses reserved for private networks (see RFC1597). These"\
                  "addresses must not be transmitted over the Internet, so the Internet cannot be used to"\
                  "directly access hosts on your private network. This also means that your hosts cannot"\
                  "directly access the Internet.\n\n"\
                  "In order to access the Internet, a network with public IP addresses (assigned to you by"\
                  "the InterNIC) and proxy servers is placed between the Internet and your local network."\
                  "A firewall is placed between this \"boundary network\" and the Internet, and another"\
                  "firewall is placed between the boundary network and your private network.\n\n"\
                  "The Internet firewall must block the Private Network IP addresses. The internal firewall"\
                  "must not, or your private hosts won't be able to communicate with the proxy servers"\
                  "on the boundary network."

    CheckBox internal_firewall -text "Internal firewall on Boundary or Private Network"\
	    -default 0\
	    -packFrame:anchor center \
	    -help "Check this box if this system is a firewall between your private network and"\
                  "your boundary network, or between segments of your private network."\
                  "This will allow you to suppress Private Network IP filtering"\
                  "so your Private Network hosts can communicate with your Boundary Network hosts."

    CheckBox allow_10_net -text "Allow 10-net traffic through."\
	    -default 0\
	    -packFrame:anchor center \
	    -help "Check this box if your private network uses the reserved IP address space 10.0.0.0/8\n\n"\
                  "This will allow your Private Network hosts to communicate with your Boundary Network hosts."\
                  "Other filtering rules apply, so you can still control access to your Boundary Network hosts."

    CheckBox allow_172_net -text "Allow 172-net traffic through."\
	    -default 0\
	    -packFrame:anchor center \
	    -help "Check this box if your private network uses the reserved IP address space 172.16.0.0/12\n\n"\
                  "This will allow your Private Network hosts to communicate with your Boundary Network hosts."\
                  "Other filtering rules apply, so you can still control access to your Boundary Network hosts."

    CheckBox allow_192_net -text "Allow 192-net traffic through."\
	    -default 0\
	    -packFrame:anchor center \
	    -help "Check this box if your private network uses the reserved IP address space 192.168.0.0/16\n\n"\
                  "This will allow your Private Network hosts to communicate with your Boundary Network hosts."\
                  "Other filtering rules apply, so you can still control access to your Boundary Network hosts."

    Line line2

    ShowPage {
      if {$on_internet} {
        Enable connection_type
        Enable internal_firewall
        global PS
        if {[regexp {[0-9]:[0-9][0-9] diald} $PS]} {
	  if {$label1 == ""} {
	    set label1 "diald daemon detected"
	    Help label1 "The diald demand-dialing daemon has been detected."\
	      "If you intend to masquerade hosts on the local network you should select one of the \"diald\" options."
	  }
        }
        if {($connection_type(index) > 3 && $connection_type(index) < 6) ||
            ($connection_type(index) > 8 && $connection_type(index) < 13)} {
          Enable ISPIP
        } else {
      	  Disable ISPIP
	  set ISPIP ""
          if {($connection_type(index) == 6)} {
	    # multihomed - offer DHCP
	    Enable ISPisDHCP
	  } else {
	    Disable ISPisDHCP
	    set ISPisDHCP 0
	  }
        }
        if {$internal_firewall} {
          Enable allow_10_net
          Enable allow_172_net
          Enable allow_192_net
        } else {
          Disable allow_10_net
          Disable allow_172_net
          Disable allow_192_net
        }
      } else {
        Disable connection_type
        Disable ISPIP
        Disable internal_firewall
        Disable allow_10_net
        Disable allow_172_net
        Disable allow_192_net
      }
    }

    Change {
      if {$on_internet} {
        Enable connection_type
        Enable internal_firewall
        if {($connection_type(index) > 3 && $connection_type(index) < 6) ||
            ($connection_type(index) > 8 && $connection_type(index) < 13)} {
          Enable ISPIP
        } else {
      	  Disable ISPIP
	  set ISPIP ""
          if {($connection_type(index) == 6)} {
	    # multihomed - offer DHCP
	    Enable ISPisDHCP
	  } else {
	    Disable ISPisDHCP
	    set ISPisDHCP 0
	  }
        }
        if {$internal_firewall} {
          Enable allow_10_net
          Enable allow_172_net
          Enable allow_192_net
        } else {
          Disable allow_10_net
          Disable allow_172_net
          Disable allow_192_net
        }
      } else {
        Disable connection_type
        Disable ISPIP
        Disable internal_firewall
        Disable allow_10_net
        Disable allow_172_net
        Disable allow_192_net
      }
    }

    PageEnd {
      if {$on_internet} {
        if {($connection_type(index) > 3 && $connection_type(index) < 6) ||
            ($connection_type(index) > 8 && $connection_type(index) < 13)} {
          if {[regexp {^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$} $ISPIP]} {
	    # probably okay
	  } else {
	    error "Static PPP IP address not correctly entered."
	  }
        }
      }
    }

    Save {
      global IPFWADM
      global InetIPValid
      global LocalNetIP
      if {$IPFWADM == "" || $ISPPort == ""} {
        # nothing
      } else {
        print
        print "# Prevent loopback attacks"
        print $IPFWADM "-I -a deny -o \$INET -S 127.0.0.0/8"
        print $IPFWADM "-I -a deny -o \$INET -D 127.0.0.0/8"
        print $IPFWADM "-I -a deny \$LETH -S 127.0.0.0/8"
        print $IPFWADM "-I -a deny \$LETH -D 127.0.0.0/8"
        print $IPFWADM "-O -a deny \$INET -S 127.0.0.0/8"
        print $IPFWADM "-O -a deny \$INET -D 127.0.0.0/8"
        print $IPFWADM "-O -a deny \$LETH -S 127.0.0.0/8"
        print $IPFWADM "-O -a deny \$LETH -D 127.0.0.0/8"
        print
        print "# Prevent certain ping attacks"
        print $IPFWADM "-I -a deny -o \$INET -P icmp -S \$ANY 8 -D 255.255.255.255/32"
        print $IPFWADM "-I -a deny -o \$INET -P icmp -S \$ANY 8 -D 0.0.0.0/32"
        print
        print "# block port zero attacks"
        print $IPFWADM "-I -a deny -o \$INET -P tcp -S \$ANY 0 -D \$ANY"
        print $IPFWADM "-I -a deny -o \$INET -P tcp -S \$ANY -D \$ANY 0"
        print $IPFWADM "-I -a deny -o \$INET -P udp -S \$ANY 0 -D \$ANY"
        print $IPFWADM "-I -a deny -o \$INET -P udp -S \$ANY -D \$ANY 0"
        print
        print "# block icmp redirect attacks"
        if {$InetIPValid == 1} {
          print $IPFWADM "-I -a accept \$INET -P icmp -S \$ANY 5 -D \$INET_IP"
          print $IPFWADM "-I -a deny -o \$INET -P icmp -S \$ANY 5 -D \$ANY"
        }
        print $IPFWADM "-F -a deny -o \$LETH -P icmp -S \$ANY 5"
        print $IPFWADM "-F -a deny -o \$INET -P icmp -S \$ANY 5"
        print
        print "# Anti-Spoofing"
	if { $LocalNetIP != "" } {
          print $IPFWADM "-I -a deny -o \$LETH -S \$FWALL"
        }
        if {$InetIPValid == 1} {
          print $IPFWADM "-I -a deny -o \$INET -S \$INET_IP"
	  if { $LocalNetIP != "" } {
            print $IPFWADM "-I -a deny -o \$LETH -S \$INET_IP"
          }
        }
        if {$on_internet} {
          # if lnet is private, the PNA blocks below will take care of things
          # unless we're an internal firewall
          if { ! [IsAddressPrivate $LocalNetIP] || $internal_firewall != 0 } {
            # lnet is valid IP or we're an internal firewall
            # block spoofs of our lnet interface address
            print $IPFWADM "-I -a deny -o \$INET -S \$FWALL"
            if {${general@antispoof} && $internal_firewall == 0} {
              # antispoof our lnet network addresses
              print $IPFWADM "-I -a deny -o \$INET -S \$LNET"
            }
          }

	  if {$ISPisDHCP} {
              # Permit DHCP traffic
	      print
	      print "# DHCP configuration traffic"
              print $IPFWADM "-O -a accept \$INET -S 0.0.0.0/32"
              print $IPFWADM "-I -a accept \$INET -P udp -S \$ANY 67 -D \$INET_NET 68"
	  }

          if {$internal_firewall == 0 || $allow_10_net == 0 || $allow_172_net == 0 || $allow_192_net == 0} {
            print
            print "# per RFC1597 (see http://andrew2.andrew.cmu.edu/rfc/rfc1597.html)"
            print "# the following Private Network addresses must not be routed to the Internet:"
            print "# 10.0.0.0/8"
            if {$internal_firewall == 0 || $allow_10_net == 0} {
              print $IPFWADM "-O -a reject \$INET -S 10.0.0.0/8"
              print $IPFWADM "-O -a reject \$INET -D 10.0.0.0/8"
              print $IPFWADM "-I -a deny -o \$INET -S 10.0.0.0/8"
              print $IPFWADM "-I -a deny -o \$INET -D 10.0.0.0/8"
            } else {
              print "# Internal firewall, permitting traffic to/from 10.0.0.0/8"
            }
            print "# 172.16.0.0/12"
            if {$internal_firewall == 0 || $allow_172_net == 0} {
              print $IPFWADM "-O -a reject \$INET -S 172.16.0.0/12"
              print $IPFWADM "-O -a reject \$INET -D 172.16.0.0/12"
              print $IPFWADM "-I -a deny -o \$INET -S 172.16.0.0/12"
              print $IPFWADM "-I -a deny -o \$INET -D 172.16.0.0/12"
            } else {
              print "# Internal firewall, permitting traffic to/from 172.16.0.0/12"
            }
            print "# 192.168.0.0/16"
            if {$internal_firewall == 0 || $allow_192_net == 0} {
              print $IPFWADM "-O -a reject \$INET -S 192.168.0.0/16"
              print $IPFWADM "-O -a reject \$INET -D 192.168.0.0/16"
              print $IPFWADM "-I -a deny -o \$INET -S 192.168.0.0/16"
              print $IPFWADM "-I -a deny -o \$INET -D 192.168.0.0/16"
            } else {
              print "# Internal firewall, permitting traffic to/from 192.168.0.0/16"
            }
          }

	  if { $LocalNetIP != "" } {
            if { ! [IsAddressPrivate $LocalNetIP] } {
              print "\n# Prevent all Internet hosts from pinging the local network broadcast address"
              print $IPFWADM "-I -a deny -o \$INET -P icmp -S \$ANY 8 -D \$LBC"
            }
          }

          if {${general@blockXall} != 0} {
            print
            print "# Block all Internet access to local network X servers"
            print $IPFWADM "-I -a deny -o \$INET -P tcp \$OpenNewConn -S \$ANY -D \$ANY 6000:6005"
          } else {
            if {${general@blockXftp} != 0} {
              print
              print "# Block all Internet access from ftp-data port to local network X servers"
              print $IPFWADM "-I -a deny -o \$INET -P tcp \$OpenNewConn -S \$ANY ftp-data -D \$ANY 6000:6005"
            }
          }

        } else {
	  if {$ISPisDHCP} {
              # Permit DHCP traffic
	      print
	      print "# DHCP configuration traffic"
              print $IPFWADM "-O -a accept \$INET -S 0.0.0.0/32"
              print $IPFWADM "-I -a accept \$INET -P udp -S \$ANY 67 -D \$INET_NET 68"
	  }
	}
      }
    }
}
