|
1
|
#System aliases
|
|
2
|
|
|
3
|
loopback = "{ lo0 }"
|
|
4
|
WAN = "{ re1 }"
|
|
5
|
LAN = "{ re0 }"
|
|
6
|
OPT1 = "{ re2 }"
|
|
7
|
|
|
8
|
#SSH Lockout Table
|
|
9
|
table <sshlockout> persist
|
|
10
|
#Snort2C table
|
|
11
|
table <snort2c>
|
|
12
|
|
|
13
|
table <virusprot>
|
|
14
|
|
|
15
|
# User Aliases
|
|
16
|
|
|
17
|
# Gateways
|
|
18
|
GWMgmtNetworkGateway = " route-to ( re0 10.110.0.4 ) "
|
|
19
|
GWwan = " "
|
|
20
|
|
|
21
|
|
|
22
|
set loginterface re1
|
|
23
|
set loginterface re0
|
|
24
|
set loginterface re2
|
|
25
|
set optimization normal
|
|
26
|
set limit states 198000
|
|
27
|
|
|
28
|
set skip on pfsync0
|
|
29
|
|
|
30
|
scrub in on $WAN all max-mss -39 fragment reassemble
|
|
31
|
scrub in on $LAN all fragment reassemble
|
|
32
|
scrub in on $OPT1 all fragment reassemble
|
|
33
|
|
|
34
|
|
|
35
|
nat-anchor "natearly/*"
|
|
36
|
nat-anchor "natrules/*"
|
|
37
|
|
|
38
|
|
|
39
|
# Outbound NAT rules
|
|
40
|
|
|
41
|
# Subnets to NAT
|
|
42
|
tonatsubnets = "{ 10.110.0.0/24 10.110.19.0/24 }"
|
|
43
|
nat on $WAN from $tonatsubnets port 500 to any port 500 -> 10.110.119.7/32 port 500
|
|
44
|
nat on $WAN from $tonatsubnets port 5060 to any port 5060 -> 10.110.119.7/32 port 5060
|
|
45
|
nat on $WAN from $tonatsubnets to any -> 10.110.119.7/32 port 1024:65535
|
|
46
|
|
|
47
|
|
|
48
|
# Load balancing anchor
|
|
49
|
rdr-anchor "relayd/*"
|
|
50
|
# TFTP proxy
|
|
51
|
rdr-anchor "tftp-proxy/*"
|
|
52
|
table <direct_networks> { 10.110.119.0/24 10.110.0.0/24 10.110.19.0/24 }
|
|
53
|
# UPnPd rdr anchor
|
|
54
|
rdr-anchor "miniupnpd"
|
|
55
|
|
|
56
|
anchor "relayd/*"
|
|
57
|
anchor "firewallrules"
|
|
58
|
#---------------------------------------------------------------------------
|
|
59
|
# default deny rules
|
|
60
|
#---------------------------------------------------------------------------
|
|
61
|
block in log all label "Default deny rule"
|
|
62
|
block out log all label "Default deny rule"
|
|
63
|
|
|
64
|
# We use the mighty pf, we cannot be fooled.
|
|
65
|
block quick proto { tcp, udp } from any port = 0 to any
|
|
66
|
block quick proto { tcp, udp } from any to any port = 0
|
|
67
|
|
|
68
|
# Block all IPv6
|
|
69
|
block in quick inet6 all
|
|
70
|
block out quick inet6 all
|
|
71
|
|
|
72
|
# snort2c
|
|
73
|
block quick from <snort2c> to any label "Block snort2c hosts"
|
|
74
|
block quick from any to <snort2c> label "Block snort2c hosts"
|
|
75
|
|
|
76
|
# package manager early specific hook
|
|
77
|
anchor "packageearly"
|
|
78
|
|
|
79
|
# carp
|
|
80
|
anchor "carp"
|
|
81
|
|
|
82
|
# SSH lockout
|
|
83
|
block in log quick proto tcp from <sshlockout> to any port 22 label "sshlockout"
|
|
84
|
block in quick from <virusprot> to any label "virusprot overload table"
|
|
85
|
table <bogons> persist file "/etc/bogons"
|
|
86
|
# block bogon networks
|
|
87
|
# http://www.cymru.com/Documents/bogon-bn-nonagg.txt
|
|
88
|
anchor "wanbogons"
|
|
89
|
block in log quick on $WAN from <bogons> to any label "block bogon networks from WAN"
|
|
90
|
antispoof for re1
|
|
91
|
antispoof for re0
|
|
92
|
antispoof for re2
|
|
93
|
anchor "spoofing"
|
|
94
|
|
|
95
|
# loopback
|
|
96
|
anchor "loopback"
|
|
97
|
pass in on $loopback all label "pass loopback"
|
|
98
|
pass out on $loopback all label "pass loopback"
|
|
99
|
|
|
100
|
anchor "firewallout"
|
|
101
|
# let out anything from the firewall host itself and decrypted IPsec traffic
|
|
102
|
pass out all keep state allow-opts label "let out anything from firewall host itself"
|
|
103
|
# make sure the user cannot lock himself out of the webConfigurator or SSH
|
|
104
|
anchor "anti-lockout"
|
|
105
|
pass in quick on re0 from any to (re0) keep state label "anti-lockout rule"
|
|
106
|
# NAT Reflection rules
|
|
107
|
|
|
108
|
# User-defined rules follow
|
|
109
|
pass in quick on $LAN from 10.110.0.0/24 to any keep state label "USER_RULE: Default allow LAN to any rule"
|
|
110
|
|
|
111
|
# VPN Rules
|
|
112
|
# package manager late specific hook
|
|
113
|
anchor "packagelate"
|
|
114
|
|
|
115
|
anchor "tftp-proxy/*"
|
|
116
|
|
|
117
|
anchor "limitingesr"
|
|
118
|
|
|
119
|
# uPnPd
|
|
120
|
anchor "miniupnpd"
|