DragonFlyBSD

#       $DragonFly: src/etc/pf.conf,v 1.2 2005/12/13 08:38:55 swildner Exp $

#

# See pf.conf(5) and /usr/share/examples/pf for syntax and examples.

# Macros: define common values, so they can be referenced and changed easily.

int_if=sk0

ext_if=sk1

tcp_opts="flags S/SA modulate state"

table <intnet> {160.114.118.128/26, 160.114.118.192/27}

table <NotUsed> {}

table <Banned> {}

table <Switches> {160.114.118.205, 160.114.118.206, 160.114.118.207}

# Options: tune the behavior of pf, default values are given.

set timeout { interval 10, frag 30 }

set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }

set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }

set timeout { udp.first 60, udp.single 30, udp.multiple 60 }

set timeout { icmp.first 20, icmp.error 10 }

set timeout { other.first 60, other.single 30, other.multiple 60 }

set timeout { adaptive.start 0, adaptive.end 0 }

set limit { states 30000, frags 15000 }

set loginterface $ext_if

set optimization conservative

set block-policy return

set require-order yes

set fingerprints "/etc/pf.os"

scrub all no-df random-id

# ftp-proxy S01E01

rdr on $int_if inet proto tcp from <intnet> to any port ftp -> ($int_if) port 8021

block in log all

block out log all

block out quick on $ext_if from <Banned> to any

block in quick on $ext_if from any to <Banned>

# ftp-proxy S01E02

pass out quick on $ext_if route-to ( lo0 127.0.0.1 ) proto tcp from <intnet> to ($int_if) port 8021 allow-opts

#any port 21 keep state

pass in quick on $ext_if inet proto tcp from port 20 to ($int_if) user proxy keep state

pass out quick on $ext_if proto tcp from <intnet> to any keep state allow-opts

pass out quick on $ext_if proto udp from <intnet> to any keep state allow-opts

pass in quick on $ext_if proto tcp from any to <intnet> port 22 keep state

pass in quick on $ext_if from any to <Switches> keep state

pass in quick on $ext_if proto tcp from any to <intnet> port {4662,4565,5555,6789,16881:16891,25489,26314} keep state

pass in quick on $ext_if proto udp from any to <intnet> port {4672,5555,25506,26314} keep state

#running ftp servers is allowed, but reachable only from the campus subnet :)

pass in quick on $ext_if proto tcp from 160.114.118.0/24 to <intnet> port 21 keep state

pass in quick on $ext_if inet proto icmp from any to <intnet> icmp-type 0 code 0 keep state

pass out quick on $ext_if inet proto icmp from <intnet> to any icmp-type 8 code 0 keep state

pass in quick on $ext_if inet proto icmp from any to <intnet> icmp-type 8 code 0 keep state

pass out quick on $ext_if inet proto icmp from <intnet> to any icmp-type 0 code 0 keep state

pass quick on {$int_if,lo0,bridge0} all