Date: Mon, 12 Oct 2015 23:51:47 -0400 From: David Mehler <dave.mehler@gmail.com> To: freebsd-pf@freebsd.org Subject: Rules sanity check Message-ID: <CAPORhP7GxqYGmzk1ZT7sAzMMze3CEwkWUCC2zDWRLNJZC=RH9Q@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
Hello,
I'm back to pf after a number of years with mainly Linux servers. I'm
running FreeBSD 10 on a machine with pf. I'm hoping someone can give
my rules such as they are a sanity check?
Some things I know definitely aren't working is the ipv6 allowing of
ssh and http, ipv6 ping doesn't work gives a udp error, ftp from the
machine the data connection doesn't come through, i'm assuming i'll
have that same problem when I set up a jailed ftp server as well.
Sanity check appreciated.
Thanks.
Dave.
[-- Attachment #2 --]
#
# pf.conf rules
# Establish a block by default firewall, allow all outbound traffic, b ut only allow ports on the list inbound
#
# define the external interface
ext_if="vtnet0"
# Set options
# block-policy can be either drop or return
set block-policy drop
# Avoid doing anything with the lo0 loopback interface
set skip on lo0
scrub on $ext_if all reassemble tcp no-df random-id max-mss 1440
antispoof quick for ($ext_if)
# Set up tables for IP blocking
table <childrens> persist
table <chuugoku> persist file "/etc/pf/zones/cn.zone"
table <ru> persist file "/etc/pf/zones/ru.zone"
icmp_types = "echoreq"
icmp6_types = "ipv6-icmp"
# Define services we want to allow out
tcp_services = "{ ftp-data, ftp, ntp, bootpc, domain, ssh, smtp, www, https, imap, imaps }"
udp_services = "{ bootpc, domain, ntp }"
# block by default
block all
# Block anything in the childrens table
block in quick proto tcp from <childrens> to any
block in quick proto tcp from <chuugoku> to any port { 80 22 25 }
block in quick proto tcp from <ru> to any port { 80 22 25 }
# pass out any traffic from the host
pass out proto tcp to any port $tcp_services keep state
pass proto udp to any port $udp_services keep state
# Allow ssh connections in from the internet
pass in inet proto tcp to $ext_if port ssh flags S/SA keep state (max-src-conn 5, max-src-conn-rate 5/5, overload <childrens> flush global)
# Pass in http traffic from the internet
pass in inet proto tcp to $ext_if port 80 flags S/SA keep state (max-src-conn 5, max-src-conn-rate 5/5, overload <childrens> flush global)
# Allow selected icmp types
#pass in inet proto icmp all icmp-type $icmp_types keep state
# Allow pings out
pass out inet proto icmp all icmp-type $icmp_types keep state
# and for ipv6
#pass out inet6 proto icmpv6-icmp all icmp-type $icmp6_types keep state
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAPORhP7GxqYGmzk1ZT7sAzMMze3CEwkWUCC2zDWRLNJZC=RH9Q>