# Firewall on FreeBSD with PF: The OpenBSD Packet Filter # # How-tos: # FreeBSD http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ # PF: The OpenBSD Packet Filter http://www.openbsd.org/faq/pf/index.html # # Conexion Monopuesto: # En este caso el router es simplemente utilizado como un Modem, ya que es el # FreeBSD quien envia el usuario y la contrasena a nuestro ISP para solicitar # conexion (esto genera la interface tun0 y se configura PPPoE en FreeBSD). # En este caso ext_if = "tun0" # # The network is setup like this: # # ISP---ADSL---(ext_if)-[FreeBSD]-(int_if)---Suiche---LAN # \ # '-(dmz_if) # # Conexion Multipuesto: # En este caso es el router quien envia el nombre de usuario y la contrasena a # nuestro ISP y los equipos conectados a este router lo utilizan como puerta # de enlace (gateway) para obtener una salida a internet. # En este caso ext_if = "bge0" # # The network is setup like this: # # ISP---ADSL---(ext_if)-[FreeBSD]-(int_if)---Suiche---LAN # \ # '-(dmz_if) # # Fibra Optica # En este caso al servidor le entra un pacth cord y la IP publica se le pone a # la tarjeta de red del servidor. # # The network is setup like this: # # ISP----------(ext_if)-[FreeBSD]-(int_if)---Suiche---LAN # \ # '-(dmz_if) # # Historial de cambios: # # * 13-01-2010 Historial de cambios # * 16-04-2010 Se retoca la parte de P2P para agregar un puerto para kademlia # * 06-05-2010 Se agregan los puertos TCP 3493 y 3551 de NUT y APC respectivamente # * 28-05-2010 Se agrega el puerto TCP 3306 de MySQL para Control tiempo # * 04-06-2010 Se agrega redireccion a la UPS APC SURT10000XLT-1TF10K # * 21-09-2010 Se abren puertos para Transmission net-p2p y desactivamos MLDonkey # * 03-02-2011 Cambios en comentarios # * 23-02-2011 La conexion a internet queda en modo multipuesto ext_if = "bge0" # Actualizar el contenido de: # /etc/hosts para que tenga las IPs correctas # /etc/hosts.allow # /usr/local/etc/smb.conf # * 25-02-2011 Se cambia el diagrama para mostrar ADSL y FIBRA # * 06-03-2011 Se configura OpenVPN (tap0) y se abren puertos (1194UDP) # * 12-05-2011 Se agrega redireccion a Ekiga y se abren puertos #------------------------------------------------------------------------------- # PF: List and Macros #------------------------------------------------------------------------------- logopt = "log" # Interfaces ext_if = "bge0" # Internet Interface (bge0 o tun0) int_if = "bge1" # Network Interface LAN #dmz_if = "bge2" # Network Interface DMZ vpn_if = "tap0" # OpenVPN Interface # External services serv_tcp = "{ 5432, 667 }" serv_udp = "{ 1194 }" # Internal services lanserv_tcp = "{ 21, 22, 37, 53, 80, 443, 110, 995, 993, 25, 465, 518, 587, \ 1626, 1723, 2082, 2095, 8080, 8083, 4080, 8090, 8091, 8092, 7777, \ 5432, 5999, 9339, 1935, 8021, 3128, 6667, 8030, 8443, 993, 587, \ 3306, 7780, 7778, 81, 8001, 8099, 5900, 2628, 7781, 3493, 3551, \ 8443, 1025, 8060, 2083, 9091, 6969, 667, 8082, 11371 }" lanserv_udp = "{ 53, 67, 68, 69, 123, 1194 }" # Ekiga http://wiki.ekiga.org/index.php/Enable_port_forwarding_manually # http://wiki.ekiga.org/index.php/Internet_ports_used_by_Ekiga ekiga_host = "{ 192.168.1.244 }" ekiga_tcp = "{ 1720, 30000:30010 }" ekiga_udp = "{ 3478, 3479, 5000:5100 }" # Samba service # If you are setting up a firewall, you need to know what TCP and UDP ports to # allow and block. Samba uses the following: # Port 135/TCP - used by smbd loc-srv # Port 137/UDP - used by nmbd netbios-ns # Port 138/UDP - used by nmbd netbios-dgm # Port 139/TCP - used by smbd netbios-ssn # Port 445/TCP - used by smbd microsoft-ds # no se requiere y da error en logs # Port 901/TCP - used by swat smb_tcp = "{ loc-srv, netbios-ssn, swat }" smb_udp = "{ netbios-ns, netbios-dgm }" # Las direcciones IPs de algunos dominios HTTPS bloqueados # para saber la ip del dominio... $ host imo.im # IP del dominio: imo.im HTTPS_sites = "{ 64.13.161.61 }" # P2P # # Transmission Port: /usr/ports/net-p2p/transmission-daemon # Transmission (tcp 51413 defaul or range 49152:65535) i have open this range for ftp service >49151 # (firewall and p2p in same computer) rpc_port_tcp = "9091" # Control web http://ipserver:9091 #peer_port_tcp = "51413" # Para el servicio de ftp esta abierto >49151 #peer_port_range_tcp = "{ 49152:65535 }" # Para el servicio de ftp esta abierto >49151 # # MLDonkey Port: /usr/ports/net-p2p/mldonkey-core (port roto! Estoy usando Transmission) # (firewall and p2p in same computer) # #donkey_ctl_tcp = "4080" # Control web http://ipserver:4080 # # .mldonkey/downloads.ini # # section Interfaces # # allowed_ips = ["127.0.0.1"; # # "0.0.0.0/0";] <- Adicionar # # # Ports for BitTorrent and Donkey # .mldonkey/donkey.ini #bittorrent_tcp = "{ 6880:6889 }" # #donkey_tcp = "11632" # section Donkey (TCP) port = 11632 <- Verificar #donkey_udp = "11636" # (UDP) port = (donkey tcp port + 4) => 11636 <- Auto # # # Port for Kademlia (udp only) # .mldonkey/donkey.ini #kademlia_udp = "15759" # section Kademlia port => 15759 <- Verificar # # #overnet = "7453" # .mldonkey/donkey.ini # # section Overnet (TCP+UDP) = 7453 # # For view the ports used in web interface Help+ / Sysinfo # # Network Port Type # BitTorrent 6882 client_port TCP # BitTorrent 6881 tracker_port TCP # Core 4080 http_port TCP # Core 4000 telnet_port TCP # Core 4001 gui_port TCP # Donkey 11632 client_port TCP # Donkey 11636 client_port UDP # Donkey 7453 overnet_port TCP+UDP # Donkey 15759 kademlia_port UDP # # Becoming more secure web interface # telnet ipserver 4000 # MLdonkey command-line: # > useradd admin MYPASSWORD # > q # # ON THE WEB INTERFACE SET # # Speed parameters: Upload Download # Options max_hard_upload_rate 30 max_hard_download_rate 500 # # Adding another p2p network (kademlia) # Options / Net enable_kademlia true # Externally permitted inbound icmp types icmp_types= "echoreq" # STREAMING # # IPs de los streamers (requerido para protocolo mms) # Carlos D Jaime S Gerente Charlie Delta Web DELL W HP 2510p #streamers = "{ 192.168.1.223, 192.168.1.224, 192.168.1.225, 192.168.1.250, 192.168.1.244, 192.168.1.221, 192.168.1.226, 192.168.1.216 }" # Jorge Valencia BlackBerry streamers = "{ 192.168.1.169 }" # # Using Windows Media Player with Firewalls # http://www.microsoft.com/windows/windowsmedia/forpros/serve/firewall.aspx#Unicast # Delivering a unicast stream WMP_tcp = "{ 554, 1755 }" WMP_udp = "{ 5004, 5005, 1755, 1024:5000 }" # # Using RealPlayer with Firewalls # http://service.real.com/help/library/guides/helixuniversalproxy/htmfiles/firewall.htm # Media Player Default Ports ROP_tcp = "{ 554, 1090, 7878 }" ROP_udp = "{ 554, 6970:32000 }" # IPs de algunos que salen a ftp, es que tengo bloqueados los .exe y otros # archivos peligrosos en el proxy WWW (squid) y por el proxy FTP (ftp-proxy) se pasan # Carlos D Jaime S Bravo Charlie Delta Digiweb Juan Carlos Victor #2020 Yan Pruebas usuarios_ftp = "{ 192.168.1.223, 192.168.1.224, 192.168.1.250, 192.168.1.250, 192.168.1.244, 192.168.1.221, 192.168.1.8, 192.168.1.63, 192.168.1.174, 192.168.1.119, 192.168.1.178, 192.168.1.194 }" #------------------------------------------------------------------------------- # PF: Tables #------------------------------------------------------------------------------- # RFC 1918 addresses that just shouldn't be floating around the Internet, and # when they are, are usually trying to cause trouble table { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 } #table persist file "/etc/pf.blocked.ip.conf" # Manipulating with pfctl # pfctl -t spammers -T show # pfctl -t spammers -T add 218.70.0.0/16 # pfctl -t spammers -T delete 218.70.0.0/16 #------------------------------------------------------------------------------- # PF: Options #------------------------------------------------------------------------------- set block-policy return set loginterface $ext_if set optimization aggressive # Every Unix system has a "loopback" interface. It's a virtual network interface that # is used by applications to talk to each other inside the system. On OpenBSD, the # loopback interface is lo(4). It is considered best practice to disable all # filtering on loopback interfaces. Using set skip will accomplish this. set skip on lo #------------------------------------------------------------------------------- # PF: Scrub (Packet Normalization) #------------------------------------------------------------------------------- scrub all reassemble tcp no-df random-id #------------------------------------------------------------------------------- # PF: Packet Queueing and Priorization #------------------------------------------------------------------------------- # http://www.openbsd.org/faq/pf/queueing.html#example2 # http://www.openbsd.org/faq/pf/es/queueing.html#example2 # # enable queueing on the external interface to queue packets going out # to the Internet. use the cbq scheduler so that the bandwidth use of # each queue can be controlled. the max outgoing bandwidth is 1.5Mbps. #altq on $ext_if cbq bandwidth 1.5Mb queue { std_ext, www_ext, boss_ext } # define the parameters for the child queues. # std_ext - the standard queue. also the default queue for # outgoing traffic on $ext_if. # www_ext - container queue for WWW server queues. limit to # 500Kbps. # www_ext_http - http traffic from the WWW server; higher priority. # www_ext_misc - all non-http traffic from the WWW server. # boss_ext - traffic coming from the boss's computer. #queue std_ext bandwidth 500Kb cbq(default borrow) #queue www_ext bandwidth 500Kb { www_ext_http, www_ext_misc } # queue www_ext_http bandwidth 50% priority 3 cbq(red borrow) # queue www_ext_misc bandwidth 50% priority 1 cbq(borrow) #queue boss_ext bandwidth 500Kb priority 3 cbq(borrow) # enable queueing on the internal interface to control traffic coming # from the Internet or the DMZ. use the cbq scheduler to control the # bandwidth of each queue. bandwidth on this interface is set to the # maximum. traffic coming from the DMZ will be able to use all of this # bandwidth while traffic coming from the Internet will be limited to # 1.0Mbps (because 0.5Mbps (500Kbps) is being allocated to $dmz_if). #altq on $int_if cbq bandwidth 100% queue { net_int, www_int } # define the parameters for the child queues. # net_int - container queue for traffic from the Internet. bandwidth # is 1.0Mbps. # std_int - the standard queue. also the default queue for outgoing # traffic on $int_if. # it_int - traffic to the IT Dept network; reserve them 500Kbps. # boss_int - traffic to the boss's PC; assign a higher priority. # www_int - traffic from the WWW server in the DMZ; full speed. #queue net_int bandwidth 1.0Mb { std_int, it_int, boss_int } # queue std_int bandwidth 250Kb cbq(default borrow) # queue it_int bandwidth 500Kb cbq(borrow) # queue boss_int bandwidth 250Kb priority 3 cbq(borrow) #queue www_int bandwidth 99Mb cbq(red borrow) # enable queueing on the DMZ interface to control traffic destined for # the WWW server. cbq will be used on this interface since detailed # control of bandwidth is necessary. bandwidth on this interface is set # to the maximum. traffic from the internal network will be able to use # all of this bandwidth while traffic from the Internet will be limited # to 500Kbps. #altq on $dmz_if cbq bandwidth 100% queue { internal_dmz, net_dmz } # define the parameters for the child queues. # internal_dmz - traffic from the internal network. # net_dmz - container queue for traffic from the Internet. # net_dmz_http - http traffic; higher priority. # net_dmz_misc - all non-http traffic. this is also the default queue. #queue internal_dmz bandwidth 99Mb cbq(borrow) #queue net_dmz bandwidth 500Kb { net_dmz_http, net_dmz_misc } # queue net_dmz_http bandwidth 50% priority 3 cbq(red borrow) # queue net_dmz_misc bandwidth 50% priority 1 cbq(default borrow) #------------------------------------------------------------------------------- # PF: Netkwork Address Translation (NAT) and Packet Redirection #------------------------------------------------------------------------------- # Translation rule exceptions #no nat on $ext_if from 192.168.1.250 to any # Network address translation nat on $ext_if from !($ext_if) -> ($ext_if:0) # En caso de requerir todo el canal para un solo equipo temporalmente debemos: # Parar el squid # Comentar la primera linea de nat y activar la segunda # Poner la IP del equipo que tendra todo el canal # Comentar la redireccion al proxy # Recargar el firewall #nat on $ext_if from 192.168.1.244 -> ($ext_if:0) # OpenVPN # NAT the VPN connections (for access to the remote secure networks) nat on $vpn_if from !($ext_if) -> ($vpn_if:0) # FTP-Proxy nat-anchor "ftp-proxy/*" rdr-anchor "ftp-proxy/*" # Redirect ftp traffic to proxy (ftp-proxy) rdr pass on $int_if proto tcp from any to port ftp \ -> 127.0.0.1 port 8021 # Redirect ftp traffic to proxy (ftp-proxy) only from $usuarios_ftp #rdr pass on $int_if proto tcp from $usuarios_ftp to port ftp \ -> 127.0.0.1 port 8021 # Redirect ftp traffic to proxy (ftp-proxy) puerto fuera del estandar (CNTV) rdr pass on $int_if proto tcp from any to port 18124 \ -> 127.0.0.1 port 8021 # Excepcion a la redireccion del WWW -> Squid para alguna IP #no rdr on $int_if proto tcp from 192.168.1.244 to !$int_if port www #no rdr on $int_if proto tcp from 192.168.1.96 to !$int_if port www # Redirect and allow outgoing to WWW requests to the squid, but not from LAN to my server rdr pass on $int_if proto tcp from any to !$int_if port www \ -> 127.0.0.1 port 3128 # Redirect and allow remote administration with SSH # Echo (ssh user@alpha.telemedellin.tv -p 2222) rdr pass on $ext_if proto tcp from any to port 2222 -> 192.168.1.180 \ port 22 # Pruebas (ssh user@alpha.telemedellin.tv -p 2223) rdr pass on $ext_if proto tcp from any to port 2223 -> 192.168.1.178 \ port 22 # Redirect and allow remote administration with RealVNC # Bravo rdr pass on $ext_if proto tcp from any to port 5900 -> 192.168.1.251 \ port 5900 # Charlie rdr pass on $ext_if proto tcp from any to port 5901 -> 192.168.1.250 \ port 5900 # Delta rdr pass on $ext_if proto tcp from any to port 5903 -> 192.168.1.244 \ port 5900 # Echo rdr pass on $ext_if proto tcp from any to port 5904 -> 192.168.1.180 \ port 5901 # Algun equipo temporalmente #rdr pass on $ext_if proto tcp from any to port 5905 -> 192.168.1.96 \ port 5900 # Redirect and allow remote administration whit web browser # UPS Alphasys (puerto 80) rdr pass on $ext_if proto tcp from any to port 81 -> 192.168.1.252 port 80 # UPS MinuteMan (puerto 82) rdr pass on $ext_if proto tcp from any to port 82 -> 192.168.1.251 port 82 # Control Encoder (puerto 80) rdr pass on $ext_if proto tcp from any to port 83 -> 192.168.1.247 port 80 # Control Modulator (puerto 80) rdr pass on $ext_if proto tcp from any to port 84 -> 192.168.1.248 port 80 # Control TANDBERG Encoder 8040 rdr pass on $ext_if proto tcp from any to port 85 -> 192.168.1.192 port 80 # Control TANDBERG 8092 rdr pass on $ext_if proto tcp from any to port 86 -> 192.168.1.193 port 80 # TANDERG RX8200 rdr pass on $ext_if proto tcp from any to port 87 -> 192.168.1.191 port 80 # UPS APC SURT10000XLT-1TF10K rdr pass on $ext_if proto tcp from any to port 88 -> 192.168.1.187 port 80 # Dell PowerEdge R610 iDRAC6 rdr pass on $ext_if proto tcp from any to port 89 -> 192.168.1.179 port 80 # Dell PowerConnect 5424 #rdr pass on $ext_if proto tcp from any to port 90 -> 192.168.1.184 port 80 # Circuito Camaras rdr pass on $ext_if proto tcp from any to port 91 -> 192.168.1.171 port 80 # TANDBERG Reciver rdr pass on $ext_if proto tcp from any to port 92 -> 192.168.1.193 port 80 # Miranda Kaleido Model: X16-D S/N:086999-r45263010 rdr pass on $ext_if proto tcp from any to port 93 -> 192.168.1.170 port 80 # DarkStat rdr pass on $ext_if proto tcp from any to port 668 -> 192.168.1.180 port 667 # # Redirect and allow remote administration whit others # Control HPA (puerto 2000) rdr pass on $ext_if proto tcp from any to port 2000 -> 192.168.1.246 port 2000 # Camaras OLD (puerto 554:557) #rdr pass on $ext_if proto tcp from any to port 554:557 -> 192.168.1.243 port 554:* # examples # Redirect range to one port... port 2000:2999 -> 4000 #rdr pass on $ext_if proto tcp from any to port 2000:2999 -> $host port 4000 # Redirect range to another range... port 2000 to 4000, 2001 to 4001,.. 2999 to 4999 #rdr pass on $ext_if proto tcp from any to port 2000:2999 -> $host port 4000:* # Redirection # Ekiga rdr pass on $ext_if proto tcp from any to port $ekiga_tcp -> $ekiga_host rdr pass on $ext_if proto udp from any to port $ekiga_udp -> $ekiga_host # Redirection and Reflection # Ekiga #rdr pass on $ext_if proto tcp from any to ($ext_if) port $ekiga_tcp -> $ekiga_host #rdr pass on $ext_if proto udp from any to ($ext_if) port $ekiga_udp -> $ekiga_host #------------------------------------------------------------------------------- # PF: Packet Filtering #------------------------------------------------------------------------------- # Restrictive default rules block all # Block packets and reply with a TCP RST or ICMP Unreachable response #block return # FTP-Proxy # We need to have an anchor for ftp-proxy anchor "ftp-proxy/*" # Blocking Spoofed Packets (Paquetes Falsificados) antispoof quick for {lo0 $int_if } # Regla especial para poder hacer ping al ADSL que esta conectado en bge0 #pass out on bge0 keep state # VPN connections inbound pass in on $ext_if proto udp from any to port 1194 keep state pass quick on $vpn_if #------------------------------------------------------------------------------- # Filter rules for $ext_if inbound # Toy with script kiddies scanning us (nmap os detection block) block in $logopt quick proto tcp flags FUP/WEUAPRSF block in $logopt quick proto tcp flags WEUAPRSF/WEUAPRSF block in $logopt quick proto tcp flags SRAFU/WEUAPRSF block in $logopt quick proto tcp flags /WEUAPRSF block in $logopt quick proto tcp flags SR/SR block in $logopt quick proto tcp flags SF/SF block drop in on $ext_if from { , } to any block drop in on $ext_if from $HTTPS_sites to any # Bloquar alguna IP #block in quick on $ext_if from # Allow permitted icmp (ping) #pass in on $ext_if inet proto icmp all icmp-type $icmp_types keep state # PF "Self-Protecting" an FTP Server (pasv) pass in on $ext_if proto tcp from any to any port { ftp, > 49151 } \ keep state # Special rule for www (Block DDoS attempts to Apache) table persist pass in on $ext_if proto tcp from any to port www \ flags S/SA keep state \ (max-src-conn 100, max-src-conn-rate 15/5, overload flush global) block in log quick on $ext_if proto tcp from to any port www # SSH Script # table persist file "/root/list.txt" block in log quick on $ext_if proto tcp from to any port ssh #pass in on $ext_if proto tcp from any to any port ssh keep state # in crontab add this line: # */2 * * * * /usr/home/hd1/backups/scripts/SSH-Script.sh >/dev/null 2>&1 # # SSH Number Connections # table persist pass in on $ext_if proto tcp from any to port ssh \ flags S/SA keep state \ (max-src-conn 100, max-src-conn-rate 2/5, overload flush global) block in log quick on $ext_if proto tcp from to any port ssh # Manipulating with pfctl # pfctl -t bruteforce2 -T show # pfctl -t bruteforce2 -T add 58.242.248.19 # pfctl -t bruteforce2 -T delete 58.242.248.19 # Block in by O.S #block drop in log quick on $ext_if proto { tcp, udp } from any os Linux \ to port ssh label "Block ssh from Linux host" # Special rule for ssh (Only allow some host) #table persist file "/var/db/allowed-ips" #pass in on $ext_if proto tcp from to port ssh \ flags S/SA keep state # serv_tcp pass in on $ext_if proto tcp from any to any port $serv_tcp \ flags S/SA keep state # serv_udp #pass in on $ext_if proto udp from any to any port $serv_udp # P2P # # Transmission (tcp 51413 defaul or range 49152:65535) i have open this range for ftp service >49151 pass in on $ext_if proto tcp from any to ($ext_if) port $rpc_port_tcp \ flags S/SA keep state #pass in on $ext_if proto tcp from any to ($ext_if) port $peer_port_tcp \ flags S/SA keep state #pass in on $ext_if proto tcp from any to ($ext_if) port $peer_port_range_tcp \ flags S/SA keep state # # MLDonkey #pass in on $ext_if proto tcp from any to ($ext_if) port $donkey_ctl_tcp \ # flags S/SA keep state #pass in on $ext_if proto tcp from any to ($ext_if) port $bittorrent_tcp \ # flags S/SA keep state #pass in on $ext_if proto tcp from any to ($ext_if) port $donkey_tcp \ # keep state #pass in on $ext_if proto udp from any to ($ext_if) port $donkey_udp # Port for Kademlia (udp only) #pass in on $ext_if proto udp from any to ($ext_if) port $kademlia_udp # Port for Overnet #pass in on $ext_if proto {tcp, udp} from any to ($ext_if) port $overnet \ # flags S/SA keep state #------------------------------------------------------------------------------- # Filter rules for $ext_if outbound pass out on $ext_if keep state block drop out on $ext_if from any to { , } block drop out on $ext_if from any to $HTTPS_sites #------------------------------------------------------------------------------- # Filter rules for $int_if inbound # Para pruebas, dejo pasar todo #pass in on $int_if keep state # Bloquear alguna IP (que por ejemplo este cargando el Squid) #block in quick on $int_if from 192.168.1.11 # Bloqueo una IP de iLO que intenta actualizar el DNS constantemente block in quick on $int_if from 192.168.1.172 # Temporalmente dejo salir a una IP a todos los puertos superiores a 1024 #pass in on $int_if proto tcp from 192.168.1.244 to any port >1024 \ keep state # Allow permitted icmp (ping) Tracert usa ping! pass in on $int_if inet proto icmp all icmp-type $icmp_types keep state # Permitimos los puertos de Traceroute para tests #pass in on $int_if proto udp from any to any port 33433:33626 # Network time protocol pass in on $int_if proto udp from any to any port ntp # STREMING # Using Windows Media Player with Firewalls pass in on $int_if proto tcp from $streamers to any port $WMP_tcp \ flags S/SA keep state pass in on $int_if proto udp from $streamers to any port $WMP_udp # Using RealOne Player with Firewalls pass in on $int_if proto tcp from $streamers to any port $ROP_tcp \ flags S/SA keep state pass in on $int_if proto udp from $streamers to any port $ROP_udp # Icecast2 from lan pass in on $int_if proto tcp from !($ext_if) to 192.168.1.1 port 8000 \ keep state # NTOP from lan #pass in on $int_if proto tcp from !($ext_if) to 192.168.1.1 port 3000 \ keep state # lanserv_tcp pass in on $int_if proto tcp from !($ext_if) to any port $lanserv_tcp \ keep state # lanserv_udp pass in on $int_if proto udp from !($ext_if) to any port $lanserv_udp # Permitimos los puertos de SAMBA a la LAN pass in on $int_if proto tcp from !($ext_if) to any port $smb_tcp \ keep state pass in on $int_if proto udp from !($ext_if) to any port $smb_udp # PF "Self-Protecting" an FTP Server #pass in on $int_if proto tcp from !($ext_if) to $int_if port {ftp, \ > 49151 } keep state # Ekiga pass in on $int_if proto tcp from $ekiga_host to port $ekiga_tcp keep state pass in on $int_if proto udp from $ekiga_host to any port $ekiga_udp #------------------------------------------------------------------------------- # Filter rules for $int_if outbound pass out on $int_if keep state #------------------------------------------------------------------------------- # Filter rules for $dmz_if inbound #------------------------------------------------------------------------------- # Filter rules for $int_if_dmz outbound #------------------------------------------------------------------------------- # Filter rules for $vpn_if inbound pass in on $vpn_if keep state #------------------------------------------------------------------------------- # Filter rules for $vpn_if outbound pass out on $vpn_if keep state # NOTAS: # # * El firewall en FreeBSD bloquea la entrada de todo por defecto. # * FreeBSD puede salir a todo, excepto a algunas direcciones IPs listadas en: # y $HTTPS_sites. # * Las peticiones de FTP las resuelve el proxy ftp-proxy. # * Las peticiones de WWW las resuelve el proxy Squid-cache. # * El control para la LAN se hace en la $lan_if1. # # Network UPS Tools requiere el puerto TCP 3493 # Nmap + PF http://forums.freebsd.org/showthread.php?t=3420 # Firewalls usually modify packets, hence nmap will not function properly. # Nmap relies on odd/strange packets. Firewalls don't like that. Turn the firewall # off when scanning. # Nmap Changelog: http://nmap.org/changelog.html # HOW-TOs: # # FTP-Proxy # How-to: http://www.cyberciti.biz/faq/freebsd-opebsd-pf-firewall-ftp-configuration/ # # Step # 1: Turn on ftp-proxy under FreeBSD # # Turn on ftp-proxy under FreeBSD # Open /etc/rc.conf file under FreeBSD # # vi /etc/rc.conf # Append following line: # ftpproxy_enable="YES" # # Step # 2: Configure pf and ftp-proxy # # Open your /etc/pf.conf file and add following into your NAT section: # To activate it, put something like this in the NAT section of pf.conf: # nat-anchor "ftp-proxy/*" # rdr-anchor "ftp-proxy/*" # rdr pass proto tcp from any to any port ftp -> 127.0.0.1 port 8021 # # All three rules required, even if your setup does not use NAT. Find your filtering # rule and append the following rules: # anchor "ftp-proxy/*" # Save and close the file. # # Step # 3: Restart PF firewall # # Type the following command under FreeBSD: # # /etc/rc.d/pf restart # # Step # 4: Start ftp-proxy # # Type the following command to start ftp-proxy under, FreeBSD: # # /etc/rc.d/ftp-proxy start # # For view the connections, type the following command under FreeBSD: # # sockstat -4 |grep ftp-proxy # proxy ftp-proxy 79457 3 tcp4 127.0.0.1:8021 *:* # # FTP SERVER PASV # http://slacksite.com/other/ftp.html#passive