diff options
author | mlaier <mlaier@FreeBSD.org> | 2007-11-11 01:16:51 +0000 |
---|---|---|
committer | mlaier <mlaier@FreeBSD.org> | 2007-11-11 01:16:51 +0000 |
commit | 439399edf83695101aa71cf53c06c52d7ffa7eb9 (patch) | |
tree | 107db76477a50666618c07f3792898601748b344 /share/examples/pf/faq-example1 | |
parent | 10e9042adf470ef6aa9ff73f8e0fa5a48d2139b3 (diff) | |
download | FreeBSD-src-439399edf83695101aa71cf53c06c52d7ffa7eb9.zip FreeBSD-src-439399edf83695101aa71cf53c06c52d7ffa7eb9.tar.gz |
Update pf examples from OpenBSD to catch up with new stateful defaults and
other syntax changes. Move pf.conf from /etc to examples, too.
Diffstat (limited to 'share/examples/pf/faq-example1')
-rw-r--r-- | share/examples/pf/faq-example1 | 47 |
1 files changed, 25 insertions, 22 deletions
diff --git a/share/examples/pf/faq-example1 b/share/examples/pf/faq-example1 index 2981203..91942f6 100644 --- a/share/examples/pf/faq-example1 +++ b/share/examples/pf/faq-example1 @@ -1,5 +1,5 @@ # $FreeBSD$ -# $OpenBSD: faq-example1,v 1.2 2003/08/06 16:04:45 henning Exp $ +# $OpenBSD: faq-example1,v 1.5 2006/10/07 04:48:01 mcbride Exp $ # # Firewall for Home or Small Office @@ -8,41 +8,44 @@ # macros -int_if = "fxp0" -ext_if = "ep0" +ext_if="fxp0" +int_if="xl0" -tcp_services = "{ 22, 113 }" -icmp_types = "echoreq" +tcp_services="{ 22, 113 }" +icmp_types="echoreq" + +comp3="192.168.0.3" -priv_nets = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }" - # options set block-policy return set loginterface $ext_if +set skip on lo + # scrub -scrub in all +scrub in # nat/rdr -nat on $ext_if from $int_if:network to any -> ($ext_if) -rdr on $int_if proto tcp from any to any port 21 -> 127.0.0.1 \ - port 8021 +nat on $ext_if from !($ext_if) -> ($ext_if:0) +nat-anchor "ftp-proxy/*" +rdr-anchor "ftp-proxy/*" + +rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021 +rdr on $ext_if proto tcp from any to any port 80 -> $comp3 # filter rules -block all +block in -pass quick on lo0 all +pass out -block drop in quick on $ext_if from $priv_nets to any -block drop out quick on $ext_if from any to $priv_nets +anchor "ftp-proxy/*" +antispoof quick for { lo $int_if } -pass in on $ext_if inet proto tcp from any to ($ext_if) \ - port $tcp_services flags S/SA keep state +pass in on $ext_if inet proto tcp from any to ($ext_if) port $tcp_services -pass in inet proto icmp all icmp-type $icmp_types keep state +pass in on $ext_if inet proto tcp from any to $comp3 port 80 \ + synproxy state -pass in on $int_if from $int_if:network to any keep state -pass out on $int_if from any to $int_if:network keep state +pass in inet proto icmp all icmp-type $icmp_types -pass out on $ext_if proto tcp all modulate state flags S/SA -pass out on $ext_if proto { udp, icmp } all keep state +pass quick on $int_if no state |