pf.conf.txt

bastyaelvtars, 10/27/2006 06:07 PM

Download (2.61 KB)

 
1
#       $DragonFly: src/etc/pf.conf,v 1.2 2005/12/13 08:38:55 swildner Exp $
2
#
3
# See pf.conf(5) and /usr/share/examples/pf for syntax and examples.
4
# Macros: define common values, so they can be referenced and changed easily.
5

    
6
int_if=sk0
7
ext_if=sk1
8
tcp_opts="flags S/SA modulate state"
9
table <intnet> {160.114.118.128/26, 160.114.118.192/27}
10
table <NotUsed> {}
11
table <Banned> {}
12
table <Switches> {160.114.118.205, 160.114.118.206, 160.114.118.207}
13

    
14
# Options: tune the behavior of pf, default values are given.
15
set timeout { interval 10, frag 30 }
16
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
17
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
18
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
19
set timeout { icmp.first 20, icmp.error 10 }
20
set timeout { other.first 60, other.single 30, other.multiple 60 }
21
set timeout { adaptive.start 0, adaptive.end 0 }
22
set limit { states 30000, frags 15000 }
23
set loginterface $ext_if
24
set optimization conservative
25
set block-policy return
26
set require-order yes
27
set fingerprints "/etc/pf.os"
28
scrub all no-df random-id
29

    
30
# ftp-proxy S01E01
31
rdr on $int_if inet proto tcp from <intnet> to any port ftp -> ($int_if) port 8021
32

    
33
block in log all
34
block out log all
35

    
36
block out quick on $ext_if from <Banned> to any
37
block in quick on $ext_if from any to <Banned>
38

    
39

    
40
# ftp-proxy S01E02
41
pass out quick on $ext_if route-to ( lo0 127.0.0.1 ) proto tcp from <intnet> to ($int_if) port 8021 allow-opts
42
#any port 21 keep state
43
pass in quick on $ext_if inet proto tcp from port 20 to ($int_if) user proxy keep state
44

    
45
pass out quick on $ext_if proto tcp from <intnet> to any keep state allow-opts
46
pass out quick on $ext_if proto udp from <intnet> to any keep state allow-opts
47

    
48
pass in quick on $ext_if proto tcp from any to <intnet> port 22 keep state
49

    
50
pass in quick on $ext_if from any to <Switches> keep state
51

    
52
pass in quick on $ext_if proto tcp from any to <intnet> port {4662,4565,5555,6789,16881:16891,25489,26314} keep state
53
pass in quick on $ext_if proto udp from any to <intnet> port {4672,5555,25506,26314} keep state
54

    
55
#running ftp servers is allowed, but reachable only from the campus subnet :)
56
pass in quick on $ext_if proto tcp from 160.114.118.0/24 to <intnet> port 21 keep state
57

    
58
pass in quick on $ext_if inet proto icmp from any to <intnet> icmp-type 0 code 0 keep state
59
pass out quick on $ext_if inet proto icmp from <intnet> to any icmp-type 8 code 0 keep state
60
pass in quick on $ext_if inet proto icmp from any to <intnet> icmp-type 8 code 0 keep state
61
pass out quick on $ext_if inet proto icmp from <intnet> to any icmp-type 0 code 0 keep state
62

    
63
pass quick on {$int_if,lo0,bridge0} all
64

    
65