|
1
|
set limit table-entries 400000
|
|
2
|
set optimization normal
|
|
3
|
set limit states 44000
|
|
4
|
set limit src-nodes 44000
|
|
5
|
|
|
6
|
#System aliases
|
|
7
|
|
|
8
|
loopback = "{ lo0 }"
|
|
9
|
WAN = "{ em0 }"
|
|
10
|
LAN = "{ em1 }"
|
|
11
|
OPT1 = "{ em2 }"
|
|
12
|
IPsec = "{ enc0 }"
|
|
13
|
|
|
14
|
#SSH Lockout Table
|
|
15
|
table <sshguard> persist
|
|
16
|
#Snort tables
|
|
17
|
table <snort2c>
|
|
18
|
table <virusprot>
|
|
19
|
table <bogons> persist file "/etc/bogons"
|
|
20
|
table <negate_networks>
|
|
21
|
|
|
22
|
# User Aliases
|
|
23
|
|
|
24
|
# Gateways
|
|
25
|
GWWAN_DHCP = " route-to ( em0 10.0.2.2 ) "
|
|
26
|
GWWAN_DHCP6 = " route-to ( em0 10.0.2.2 ) "
|
|
27
|
|
|
28
|
|
|
29
|
set loginterface em1
|
|
30
|
|
|
31
|
set skip on pfsync0
|
|
32
|
set keepcounters
|
|
33
|
|
|
34
|
scrub on $WAN inet all fragment reassemble
|
|
35
|
scrub on $WAN inet6 all fragment reassemble
|
|
36
|
scrub on $LAN inet all fragment reassemble
|
|
37
|
scrub on $LAN inet6 all fragment reassemble
|
|
38
|
scrub on $OPT1 inet all fragment reassemble
|
|
39
|
scrub on $OPT1 inet6 all fragment reassemble
|
|
40
|
|
|
41
|
|
|
42
|
no nat proto carp
|
|
43
|
no rdr proto carp
|
|
44
|
nat-anchor "natearly/*"
|
|
45
|
nat-anchor "natrules/*"
|
|
46
|
|
|
47
|
binat on em1 inet from any to any -> 50.50.50.111
|
|
48
|
|
|
49
|
# Outbound NAT rules (automatic)
|
|
50
|
|
|
51
|
# Subnets to NAT
|
|
52
|
table <tonatsubnets> { 127.0.0.0/8 ::1/128 192.168.11.0/24 172.17.99.0/24 60.60.60.0 30.30.30.1 10.10.10.1 }
|
|
53
|
nat on $WAN inet from <tonatsubnets> to any port 500 -> 10.0.2.15/32 static-port
|
|
54
|
nat on $WAN inet6 from <tonatsubnets> to any port 500 -> (em0) static-port
|
|
55
|
nat on $WAN inet from <tonatsubnets> to any -> 10.0.2.15/32 port 1024:65535
|
|
56
|
nat on $WAN inet6 from <tonatsubnets> to any -> (em0) port 1024:65535
|
|
57
|
# TFTP proxy
|
|
58
|
rdr-anchor "tftp-proxy/*"
|
|
59
|
# NAT Inbound Redirects
|
|
60
|
rdr on em0 inet proto tcp from any to 10.0.2.15 port 21 -> 192.168.11.112
|
|
61
|
rdr on em0 inet proto tcp from any to 10.0.2.15 port 21 -> 192.168.11.114
|
|
62
|
rdr pass on em0 inet proto tcp from any to 10.0.2.15 port 21 -> 192.168.11.113
|
|
63
|
# UPnPd rdr anchor
|
|
64
|
rdr-anchor "miniupnpd"
|
|
65
|
|
|
66
|
anchor "openvpn/*"
|
|
67
|
anchor "ipsec/*"
|
|
68
|
# block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by a routing device,
|
|
69
|
# and clients "MUST NOT" send such packets to a router. FreeBSD won't route 169.254./16, but
|
|
70
|
# route-to can override that, causing problems such as in redmine #2073
|
|
71
|
block in log quick from 169.254.0.0/16 to any tracker 1000105581 label "Block IPv4 link-local"
|
|
72
|
block in log quick from any to 169.254.0.0/16 tracker 1000105582 label "Block IPv4 link-local"
|
|
73
|
#---------------------------------------------------------------------------
|
|
74
|
# default deny rules
|
|
75
|
#---------------------------------------------------------------------------
|
|
76
|
block in log inet all tracker 1000105583 label "Default deny rule IPv4"
|
|
77
|
block out log inet all tracker 1000105584 label "Default deny rule IPv4"
|
|
78
|
block in log inet6 all tracker 1000105585 label "Default deny rule IPv6"
|
|
79
|
block out log inet6 all tracker 1000105586 label "Default deny rule IPv6"
|
|
80
|
|
|
81
|
# IPv6 ICMP is not auxiliary, it is required for operation
|
|
82
|
# See man icmp6(4)
|
|
83
|
# 1 unreach Destination unreachable
|
|
84
|
# 2 toobig Packet too big
|
|
85
|
# 128 echoreq Echo service request
|
|
86
|
# 129 echorep Echo service reply
|
|
87
|
# 133 routersol Router solicitation
|
|
88
|
# 134 routeradv Router advertisement
|
|
89
|
# 135 neighbrsol Neighbor solicitation
|
|
90
|
# 136 neighbradv Neighbor advertisement
|
|
91
|
pass quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,135,136} tracker 1000105587 keep state
|
|
92
|
|
|
93
|
# Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq, echorep)
|
|
94
|
pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,135,136} tracker 1000105588 keep state
|
|
95
|
pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {129,133,134,135,136} tracker 1000105589 keep state
|
|
96
|
pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128,133,134,135,136} tracker 1000105590 keep state
|
|
97
|
pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type {128,133,134,135,136} tracker 1000105591 keep state
|
|
98
|
pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} tracker 1000105592 keep state
|
|
99
|
pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type {128,133,134,135,136} tracker 1000105593 keep state
|
|
100
|
# We use the mighty pf, we cannot be fooled.
|
|
101
|
block log quick inet proto { tcp, udp } from any port = 0 to any tracker 1000105594 label "Block traffic from port 0"
|
|
102
|
block log quick inet proto { tcp, udp } from any to any port = 0 tracker 1000105595 label "Block traffic to port 0"
|
|
103
|
block log quick inet6 proto { tcp, udp } from any port = 0 to any tracker 1000105596 label "Block traffic from port 0"
|
|
104
|
block log quick inet6 proto { tcp, udp } from any to any port = 0 tracker 1000105597 label "Block traffic to port 0"
|
|
105
|
|
|
106
|
# Snort package
|
|
107
|
block log quick from <snort2c> to any tracker 1000105598 label "Block snort2c hosts"
|
|
108
|
block log quick from any to <snort2c> tracker 1000105599 label "Block snort2c hosts"
|
|
109
|
|
|
110
|
# CARP rules
|
|
111
|
block in log quick proto carp from (self) to any tracker 1000105681
|
|
112
|
pass quick proto carp tracker 1000105682 no state
|
|
113
|
|
|
114
|
# SSH lockout
|
|
115
|
block in log quick proto tcp from <sshguard> to (self) port 22 tracker 1000105781 label "sshguard"
|
|
116
|
|
|
117
|
# webConfigurator lockout
|
|
118
|
block in log quick proto tcp from <sshguard> to (self) port 80 tracker 1000105831 label "GUI Lockout"
|
|
119
|
block in log quick from <virusprot> to any tracker 1000000400 label "virusprot overload table"
|
|
120
|
# allow our DHCP client out to the WAN
|
|
121
|
pass in quick on $WAN proto udp from any port = 67 to any port = 68 tracker 1000106041 label "allow dhcp client out WAN"
|
|
122
|
pass out quick on $WAN proto udp from any port = 68 to any port = 67 tracker 1000106042 label "allow dhcp client out WAN"
|
|
123
|
# Not installing DHCP server firewall rules for WAN which is configured for DHCP.
|
|
124
|
# allow our DHCPv6 client out to the WAN
|
|
125
|
pass in quick on $WAN proto udp from fe80::/10 port = 546 to fe80::/10 port = 546 tracker 1000106043 label "allow dhcpv6 client in WAN"
|
|
126
|
pass in quick on $WAN proto udp from any port = 547 to any port = 546 tracker 1000106044 label "allow dhcpv6 client in WAN"
|
|
127
|
# Add Priority to dhcp6c packets if enabled
|
|
128
|
pass out quick on $WAN proto udp from any port = 546 to any port = 547 tracker 1000106045 label "allow dhcpv6 client out WAN"
|
|
129
|
antispoof log for $WAN tracker 1000107050
|
|
130
|
antispoof log for $LAN tracker 1000108100
|
|
131
|
# allow access to DHCPv6 server on LAN
|
|
132
|
# We need inet6 icmp for stateless autoconfig and dhcpv6
|
|
133
|
pass quick on $LAN inet6 proto udp from fe80::/10 to fe80::/10 port = 546 tracker 1000108131 label "allow access to DHCPv6 server"
|
|
134
|
pass quick on $LAN inet6 proto udp from fe80::/10 to ff02::/16 port = 546 tracker 1000108132 label "allow access to DHCPv6 server"
|
|
135
|
pass quick on $LAN inet6 proto udp from fe80::/10 to ff02::/16 port = 547 tracker 1000108133 label "allow access to DHCPv6 server"
|
|
136
|
pass quick on $LAN inet6 proto udp from ff02::/16 to fe80::/10 port = 547 tracker 1000108134 label "allow access to DHCPv6 server"
|
|
137
|
antispoof log for $OPT1 tracker 1000109150
|
|
138
|
|
|
139
|
# loopback
|
|
140
|
pass in on $loopback inet all tracker 1000110241 label "pass IPv4 loopback"
|
|
141
|
pass out on $loopback inet all tracker 1000110242 label "pass IPv4 loopback"
|
|
142
|
pass in on $loopback inet6 all tracker 1000110243 label "pass IPv6 loopback"
|
|
143
|
pass out on $loopback inet6 all tracker 1000110244 label "pass IPv6 loopback"
|
|
144
|
# let out anything from the firewall host itself and decrypted IPsec traffic
|
|
145
|
pass out inet all keep state allow-opts tracker 1000110245 label "let out anything IPv4 from firewall host itself"
|
|
146
|
pass out inet6 all keep state allow-opts tracker 1000110246 label "let out anything IPv6 from firewall host itself"
|
|
147
|
|
|
148
|
pass out route-to ( em0 10.0.2.2 ) from 10.0.2.15 to !10.0.2.0/24 tracker 1000110341 keep state allow-opts label "let out anything from firewall host itself"
|
|
149
|
pass out on $IPsec all tracker 1000110641 tracker 1000110642 keep state label "IPsec internal host to host"
|
|
150
|
# make sure the user cannot lock himself out of the webConfigurator or SSH
|
|
151
|
pass in quick on em1 proto tcp from any to (em1) port { 80 22 } tracker 10002 keep state label "anti-lockout rule"
|
|
152
|
|
|
153
|
# User-defined rules follow
|
|
154
|
|
|
155
|
anchor "userrules/*"
|
|
156
|
pass in quick on $LAN inet from 192.168.11.0/24 to any tracker 0100000101 keep state label "USER_RULE: Default allow LAN to any rule"
|
|
157
|
# source address is empty. label "USER_RULE: Default allow LAN IPv6 to any rule"
|
|
158
|
pass in quick on $OPT1 inet from any to any tracker 1628368685 keep state label "USER_RULE"
|
|
159
|
|
|
160
|
# VPN Rules
|
|
161
|
pass in on $WAN proto udp from 0.0.0.0/0 to (self) port = 500 tracker 1000210781 keep state label "IPsec: test12262 - inbound isakmp"
|
|
162
|
pass in on $WAN proto udp from 0.0.0.0/0 to (self) port = 4500 tracker 1000210782 keep state label "IPsec: test12262 - inbound nat-t"
|
|
163
|
|
|
164
|
anchor "tftp-proxy/*"
|
|
165
|
|