68 lines
2.9 KiB
Plaintext
68 lines
2.9 KiB
Plaintext
##############################################################################################
|
|
# TRS_NBTEVO_System (2500)
|
|
# A firewall shall be implemented that prevents incoming/outgoing ports on the OBD connection.
|
|
# The following listed ports shall be open, all other ports not listed shall be closed
|
|
# * Telnet (port 23/tcp) server on the HU/RSE (Development) - see TRS-NBTEVO-SYS-426
|
|
# * SSH (port 22/tcp) server on the HU/RSE (Development) - see TRS-NBTEVO-SYS-426
|
|
# * qconnd (port 8000/tcp) server on the HU/RSE (Development) - see TRS-NBTEVO-SYS-426
|
|
# * HTTP (port 80/tcp) server on the HU/RSE (TraceServer)
|
|
# * HTTP (port 80/tcp, 81/tcp) client on the HU/RSE (HTTP update Navi Database)
|
|
# * Diagnostics (port 6801/tcp, 6811/tcp) server on the HU/RSE
|
|
# * NetBIOS SMB (port 137/udp, 138/udp, 139/tcp, 445/tcp) server on the HU/RSE
|
|
# * BOOTP/DHCP (port 67/udp, 68/udp as defined for NBT) client on the HU/RSE
|
|
# * GnLogger (port 851/tcp/udp) server on the HU/RSE
|
|
# * In addition, ICMP is passed through to allow for PING requests for the factory.
|
|
# For E-Sys flashing the following ports are required to be open:
|
|
# * 8000, 8080, 8888, 12000-13000 (TCP server on HU)
|
|
##############################################################################################
|
|
|
|
# definition of ext obd interface
|
|
obd_if = "dwc0"
|
|
vlan_ifx49 = "vlan73"
|
|
vlan_ifx4D = "vlan77"
|
|
vlan_ifx56 = "vlan86"
|
|
|
|
block on $obd_if all
|
|
#pass quick on $obd_if
|
|
pass on $vlan_ifx49
|
|
pass on $vlan_ifx4D
|
|
pass quick on $vlan_ifx56
|
|
|
|
# SSH
|
|
pass quick on $obd_if proto tcp from any to any port 22 keep state
|
|
# Telnet
|
|
pass quick on $obd_if proto tcp from any to any port 23 keep state
|
|
|
|
# bootp/dhcp
|
|
pass quick on $obd_if proto {tcp,udp} from {0.0.0.0,(self)} port 68 to 255.255.255.255 port 67 keep state
|
|
pass quick on $obd_if proto {tcp,udp} from any port 67 to{255.255.255.255,(self)} port 68 keep state
|
|
# TraceServer RSE
|
|
pass quick on $obd_if proto tcp from any to any port 80 keep state
|
|
# update NaviDB over http
|
|
pass out quick on $obd_if proto tcp from any to any port 81 keep state
|
|
# NETBios
|
|
pass quick on $obd_if proto udp from any to any port 137
|
|
pass quick on $obd_if proto udp from any to any port 138
|
|
pass out quick on $obd_if proto tcp from any to any port 139 keep state
|
|
|
|
# Windows ActiveDirectory
|
|
pass out quick on $obd_if proto tcp from any to any port 445 keep state
|
|
|
|
# ???
|
|
# pass quick on $obd_if proto {tcp,udp} from any to any port 3804 keep state
|
|
|
|
# GNLogger
|
|
pass quick on $obd_if proto {tcp,udp} from any to any port 851 keep state
|
|
# Diagnosis/SWDL
|
|
pass quick on $obd_if proto tcp from any to any port 6801 keep state
|
|
pass quick on $obd_if proto tcp from any to any port 6811 keep state
|
|
pass quick on $obd_if proto tcp from any to any port 8000 keep state
|
|
pass quick on $obd_if proto tcp from any to any port 8080 keep state
|
|
pass quick on $obd_if proto tcp from any to any port 8888 keep state
|
|
# from 12000 to 13000
|
|
pass quick on $obd_if proto tcp from any to any port 12000:13000 keep state
|
|
# ping
|
|
pass quick on $obd_if proto icmp
|
|
|
|
# end
|