|
# $DragonFly: src/etc/pf.conf,v 1.2 2005/12/13 08:38:55 swildner Exp $
|
|
#
|
|
# See pf.conf(5) and /usr/share/examples/pf for syntax and examples.
|
|
# Macros: define common values, so they can be referenced and changed easily.
|
|
|
|
int_if=sk0
|
|
ext_if=sk1
|
|
tcp_opts="flags S/SA modulate state"
|
|
table <intnet> {160.114.118.128/26, 160.114.118.192/27}
|
|
table <NotUsed> {}
|
|
table <Banned> {}
|
|
table <Switches> {160.114.118.205, 160.114.118.206, 160.114.118.207}
|
|
|
|
# Options: tune the behavior of pf, default values are given.
|
|
set timeout { interval 10, frag 30 }
|
|
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
|
|
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
|
|
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
|
|
set timeout { icmp.first 20, icmp.error 10 }
|
|
set timeout { other.first 60, other.single 30, other.multiple 60 }
|
|
set timeout { adaptive.start 0, adaptive.end 0 }
|
|
set limit { states 30000, frags 15000 }
|
|
set loginterface $ext_if
|
|
set optimization conservative
|
|
set block-policy return
|
|
set require-order yes
|
|
set fingerprints "/etc/pf.os"
|
|
scrub all no-df random-id
|
|
|
|
# ftp-proxy S01E01
|
|
rdr on $int_if inet proto tcp from <intnet> to any port ftp -> ($int_if) port 8021
|
|
|
|
block in log all
|
|
block out log all
|
|
|
|
block out quick on $ext_if from <Banned> to any
|
|
block in quick on $ext_if from any to <Banned>
|
|
|
|
|
|
# ftp-proxy S01E02
|
|
pass out quick on $ext_if route-to ( lo0 127.0.0.1 ) proto tcp from <intnet> to ($int_if) port 8021 allow-opts
|
|
#any port 21 keep state
|
|
pass in quick on $ext_if inet proto tcp from port 20 to ($int_if) user proxy keep state
|
|
|
|
pass out quick on $ext_if proto tcp from <intnet> to any keep state allow-opts
|
|
pass out quick on $ext_if proto udp from <intnet> to any keep state allow-opts
|
|
|
|
pass in quick on $ext_if proto tcp from any to <intnet> port 22 keep state
|
|
|
|
pass in quick on $ext_if from any to <Switches> keep state
|
|
|
|
pass in quick on $ext_if proto tcp from any to <intnet> port {4662,4565,5555,6789,16881:16891,25489,26314} keep state
|
|
pass in quick on $ext_if proto udp from any to <intnet> port {4672,5555,25506,26314} keep state
|
|
|
|
#running ftp servers is allowed, but reachable only from the campus subnet :)
|
|
pass in quick on $ext_if proto tcp from 160.114.118.0/24 to <intnet> port 21 keep state
|
|
|
|
pass in quick on $ext_if inet proto icmp from any to <intnet> icmp-type 0 code 0 keep state
|
|
pass out quick on $ext_if inet proto icmp from <intnet> to any icmp-type 8 code 0 keep state
|
|
pass in quick on $ext_if inet proto icmp from any to <intnet> icmp-type 8 code 0 keep state
|
|
pass out quick on $ext_if inet proto icmp from <intnet> to any icmp-type 0 code 0 keep state
|
|
|
|
pass quick on {$int_if,lo0,bridge0} all
|
|
|
|
|