# ipf.rules # http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipf.html ################################################################# # No restrictions on Inside LAN Interface for private network # Not needed unless you have LAN ################################################################# pass out quick on bge1 all pass in quick on bge1 all ################################################################# # No restrictions on Loopback Interface ################################################################# pass in quick on lo0 all pass out quick on lo0 all ################################################################# # Interface facing Public Internet (Outbound Section) # Interrogate session start requests originating from behind the # firewall on the private network # or from this gateway server destine for the public Internet. ################################################################# # Allow out access to my ISP's Domain name server. # xxx must be the IP address of your ISP's DNS. # Dup these lines if your ISP has more than one DNS server # Get the IP addresses from /etc/resolv.conf file #pass out quick on bge0 proto tcp from any to xxx port = 53 flags S keep state #pass out quick on bge0 proto udp from any to xxx port = 53 keep state pass out quick on bge0 proto tcp from any to 0.0.0.0/0 port = 53 flags S keep state pass out quick on bge0 proto udp from any to 0.0.0.0/0 port = 53 keep state # Allow out access to my ISP's DHCP server for cable or DSL networks. # This rule is not needed for 'user ppp' type connection to the # public Internet, so you can delete this whole group. # Use the following rule and check log for IP address. # Then put IP address in commented out rule & delete first rule pass out log quick on bge0 proto udp from any to any port = 67 keep state #pass out quick on bge0 proto udp from any to z.z.z.z port = 67 keep state # Allow out non-secure standard www function pass out quick on bge0 proto tcp from any to any port = 80 flags S keep state # Allow out secure www function https over TLS SSL pass out quick on bge0 proto tcp from any to any port = 443 flags S keep state # Allow out send & get email function pass out quick on bge0 proto tcp from any to any port = 110 flags S keep state pass out quick on bge0 proto tcp from any to any port = 25 flags S keep state # Gmail pop 995 pass out quick on bge0 proto tcp from any to any port = 995 flags S keep state # Gmail smtp 587 pass out quick on bge0 proto tcp from any to any port = 587 flags S keep state # Allow out Time pass out quick on bge0 proto tcp from any to any port = 37 flags S keep state # Allow out nntp news pass out quick on bge0 proto tcp from any to any port = 119 flags S keep state # Allow out gateway & LAN users non-secure FTP ( both passive & active modes) # This function uses the IPNAT built in FTP proxy function coded in # the nat rules file to make this single rule function correctly. # If you want to use the pkg_add command to install application packages # on your gateway system you need this rule. pass out quick on bge0 proto tcp from any to any port = 21 flags S keep state # Allow out non-secure ftp pass out quick on bge0 proto tcp from any port = 20 to any flags S keep state # Allow out secure FTP, Telnet, and SCP # This function is using SSH (secure shell) pass out quick on bge0 proto tcp from any to any port = 22 flags S keep state # Allow out non-secure Telnet pass out quick on bge0 proto tcp from any to any port = 23 flags S keep state # Allow out FBSD CVSUP function pass out quick on bge0 proto tcp from any to any port = 5999 flags S keep state # Allow out ping to public Internet pass out quick on bge0 proto icmp from any to any icmp-type 8 keep state # Allow out whois for LAN PC to public Internet pass out quick on bge0 proto tcp from any to any port = 43 flags S keep state # Allow out Cpanel pass out quick on bge0 proto tcp from any to any port = 2082 flags S keep state # Allow out Webmail pass out quick on bge0 proto tcp from any to any port = 2095 flags S keep state # Allow out Correo Remoto EPM pass out quick on bge0 proto tcp from any to any port = 8080 flags S keep state # Allow out Comision Nacional del Servicio Civil pass out quick on bge0 proto tcp from any to any port = 8090 flags S keep state pass out quick on bge0 proto tcp from any to any port = 8100 flags S keep state pass out quick on bge0 proto tcp from any to any port = 8102 flags S keep state pass out quick on bge0 proto tcp from any to any port = 8096 flags S keep state pass out quick on bge0 proto tcp from any to any port = 8091 flags S keep state pass out quick on bge0 proto tcp from any to any port = 8092 flags S keep state # Allow out XChat pass out quick on bge0 proto tcp from any to any port = 6667 flags S keep state # Allow out aMule (4661 TCP outgoing, 4662 TCP outgoing, 4665 UDP outgoing, 4672 UDP outgoing) pass out quick on bge0 proto tcp from any to any port = 4661 flags S keep state pass out quick on bge0 proto tcp from any to any port = 4662 flags S keep state pass out quick on bge0 proto udp from any to any port = 4665 keep state pass out quick on bge0 proto udp from any to any port = 4672 keep state # Allow out Azureus #pass out quick on bge0 proto tcp from any to any port = 16163 Flags S keep state #pass out quick on bge0 proto udp from any to any port = 16163 keep state # Block and log only the first occurrence of everything # else that's trying to get out. # This rule enforces the block all by default logic. block out log first quick on bge0 all ################################################################# # Interface facing Public Internet (Inbound Section) # Interrogate packets originating from the public Internet # destine for this gateway server or the private network. ################################################################# # Block all inbound traffic from non-routable or reserved address spaces block in quick on bge0 from 192.168.0.0/16 to any #RFC 1918 private IP block in quick on bge0 from 172.16.0.0/12 to any #RFC 1918 private IP block in quick on bge0 from 10.0.0.0/8 to any #RFC 1918 private IP block in quick on bge0 from 127.0.0.0/8 to any #loopback block in quick on bge0 from 0.0.0.0/8 to any #loopback block in quick on bge0 from 169.254.0.0/16 to any #DHCP auto-config block in quick on bge0 from 192.0.2.0/24 to any #reserved for docs block in quick on bge0 from 204.152.64.0/23 to any #Sun cluster interconnect block in quick on bge0 from 224.0.0.0/3 to any #Class D & E multicast ##### Block a bunch of different nasty things. ############ # That I do not want to see in the log # Block frags block in quick on bge0 all with frags # Block short tcp packets block in quick on bge0 proto tcp all with short # block source routed packets block in quick on bge0 all with opt lsrr block in quick on bge0 all with opt ssrr # Block nmap OS fingerprint attempts # Log first occurrence of these so I can get their IP address block in log first quick on bge0 proto tcp from any to any flags FUP # Block anything with special options block in quick on bge0 all with ipopts # Block public pings block in quick on bge0 proto icmp all icmp-type 8 # Block ident block in quick on bge0 proto tcp from any to any port = 113 # Block all Netbios service. 137=name, 138=datagram, 139=session # Netbios is MS/Windows sharing services. # Block MS/Windows hosts2 name server requests 81 block in log first quick on bge0 proto tcp/udp from any to any port = 137 block in log first quick on bge0 proto tcp/udp from any to any port = 138 block in log first quick on bge0 proto tcp/udp from any to any port = 139 block in log first quick on bge0 proto tcp/udp from any to any port = 81 # Allow traffic in from ISP's DHCP server. This rule must contain # the IP address of your ISP's DHCP server as it's the only # authorized source to send this packet type. Only necessary for # cable or DSL configurations. This rule is not needed for # 'user ppp' type connection to the public Internet. # This is the same IP address you captured and # used in the outbound section. pass in quick on bge0 proto udp from 0.0.0.0/0 to any port = 68 keep state # Allow in standard www function because I have apache server pass in quick on bge0 proto tcp from any to any port = 80 flags S keep state # Allow in non-secure Telnet session from public Internet # labeled non-secure because ID/PW passed over public Internet as clear text. # Delete this sample group if you do not have telnet server enabled. #pass in quick on bge0 proto tcp from any to any port = 23 flags S keep state # Allow in non-secure FTP active/pasive # ftp server: # ftp session pass in quick on bge0 proto tcp from any to any port = 21 flags S keep state # passive ftp-data pass in quick on bge0 proto tcp from any to any port > 49151 flags S keep state # active ftp-data # pass out quick on bge0 proto tcp from any port = 20 to any flags S keep state # end ftp-server # Allow in secure FTP, Telnet, and SCP from public Internet # This function is using SSH (secure shell) pass in quick on bge0 proto tcp from any to any port = 22 flags S keep state # Allow in aMule (4662 TCP incoming, 4672 UDP incoming, 4711 TCP incoming) pass in quick on bge0 proto tcp from any to any port = 4672 flags S keep state pass in quick on bge0 proto udp from any to any port = 4711 keep state # Allow in Azureus #pass in quick on bge0 proto tcp from any to 192.168.7.100 port = 16163 flags S keep state #pass in quick on bge0 proto udp from any to 192.168.7.100 port = 16163 keep state # Block and log only first occurrence of all remaining traffic # coming into the firewall. The logging of only the first # occurrence stops a .denial of service. attack targeted # at filling up your log file space. # This rule enforces the block all by default logic. block in log first quick on bge0 all ################### End of rules file ##################################### # ipnat.rules #-------------------------------------------------------------------- # Do 'normal' IP address translation. This line will take all packets # going out on your external NIC (bge0) that have a source address coming # from your internal network (192.168.1.0), and translate it to whatever # IP address your external NIC happens to have at that time #-------------------------------------------------------------------- # FTP map bge0 0.0.0.0/0 -> 0/32 proxy port 21 ftp/tcp # NAT map bge0 192.168.1.0/24 -> 0.0.0.0/32 portmap tcp/udp auto map bge0 192.168.1.0/24 -> 0.0.0.0/32 #-------------------------------------------------------------------- # If you have a system on your internal network that needs to be # 'reachable' by external systems on the internet, you'll need a rule # similar to the one below. This one takes all inbound http traffic # (TCP port 80) that hits the firewall's external interface (rl0) and # redirects it to port 80 on the 192.168.1.50 system on the internal network. # Simply uncomment the rule, change the IP address and port number so that # it does what you need. Remember that you have to enable the corresponding # inbound filter in your /etc/ipf.rules file, too. #-------------------------------------------------------------------- # rdr rl0 0.0.0.0/0 port 80 -> 192.168.1.50 port 80 tcp # Redireccion para el Squid # bge0 Internet # Inseguro www 80 rdr bge1 0.0.0.0/0 port 80 -> 127.0.0.1 port 3128 tcp # Seguro www 443 (esto no deja entrar a gmail.com, hotmail, etc) #rdr bge1 0.0.0.0/0 port 443 -> 127.0.0.1 port 3128 tcp # Redireccion para el aMule rdr bge0 0.0.0.0/0 port 4661 -> 192.168.7.100 port 4661 tcp rdr bge0 0.0.0.0/0 port 4662 -> 192.168.7.100 port 4662 tcp rdr bge0 0.0.0.0/0 port 4711 -> 192.168.7.100 port 4711 tcp rdr bge0 0.0.0.0/0 port 4672 -> 192.168.7.100 port 4672 udp rdr bge0 0.0.0.0/0 port 4665 -> 192.168.7.100 port 4665 udp # Redireccion para el Azureus rdr bge0 0.0.0.0/0 port 16163 -> 192.168.7.100 port 16163 tcp rdr bge0 0.0.0.0/0 port 16163 -> 192.168.7.100 port 16163 udp