root@amazonas# cat pf.conf ### Interfaces if_wan = "sis0" if_dmz = "xl0" if_anca = "xl1" if_bdf = "xl2" if_all = "{" $if_wan $if_dmz $if_anca $if_bdf "}" ### Networks ... ### Hosts # Firewall's Hosts table const { self } ... # Local Hosts ... # Remote Hosts .... ### Protocols proto_all = "{ tcp, udp, icmp }" ### Groups trusted1 = "{" $host_weber $host_ancabsb "}" trusted2 = "{" $host_weber "}" host_avg_all = "{" $host_avg1 $host_avg2 "}" host_voip_all = "{" $host_voipgvt $host_voipstelecom $host_voipfwd1 $host_voipfwd2 "}" set loginterface $if_wan scrub in on $if_wan all # queue: destino_origem_{tipo} altq on $if_wan cbq bandwidth 1.0Mb queue { inet_std, inet_dmz } altq on $if_anca cbq bandwidth 100Mb queue { anca_inet, anca_internal } altq on $if_bdf cbq bandwidth 100Mb queue { bdf_inet, bdf_internal } altq on $if_dmz cbq bandwidth 100Mb queue { dmz_inet, dmz_internal } queue inet_std bandwidth 500Kb cbq(default) queue inet_dmz bandwidth 500Kb priority 1 cbq { inet_dmz_std, inet_dmz_mail, inet_dmz_voip } queue inet_dmz_std bandwidth 50Kb cbq queue inet_dmz_mail bandwidth 400Kb priority 2 cbq queue inet_dmz_voip bandwidth 50Kb priority 3 cbq queue anca_inet bandwidth 250Kb cbq(default) queue anca_internal bandwidth 99Mb cbq queue bdf_inet bandwidth 250Kb cbq(default) queue bdf_internal bandwidth 99Mb cbq queue dmz_inet bandwidth 500Kb priority 1 cbq { dmz_inet_std, dmz_inet_mail, dmz_inet_voip } queue dmz_inet_std bandwidth 50Kb cbq(default) queue dmz_inet_mail bandwidth 400Kb priority 2 cbq queue dmz_inet_voip bandwidth 50Kb priority 3 cbq queue dmz_internal bandwidth 99Mb cbq nat on $if_wan from $if_anca:network to any -> ($if_wan) nat on $if_wan from $if_bdf:network to any -> ($if_wan) pass quick on lo0 all antispoof log quick for $if_wan inet antispoof log quick for $if_dmz inet antispoof log quick for $if_anca inet antispoof log quick for $if_bdf inet ### trafego udp entre tapajos e madeira - p/ politica de backup pass in quick on $if_dmz proto udp from $host_tapajos to $host_madeira queue bdf_internal pass out quick on $if_bdf proto udp from $host_tapajos to $host_madeira queue bdf_internal pass in quick on $if_bdf proto udp from $host_madeira to $host_tapajos queue dmz_internal pass out quick on $if_dmz proto udp from $host_madeira to $host_tapajos queue dmz_internal ### trafego udp entre tapajos e xingu - p/ politica de backup pass in quick on $if_dmz proto udp from $host_tapajos to $host_xingu queue anca_internal pass out quick on $if_anca proto udp from $host_tapajos to $host_xingu queue anca_internal pass in quick on $if_anca proto udp from $host_xingu to $host_tapajos queue dmz_internal pass out quick on $if_dmz proto udp from $host_xingu to $host_tapajos queue dmz_internal ### trafego de tapajos para internet - libera trafego pass in quick on $if_dmz proto $proto_all from $host_tapajos to any modulate state queue dmz_inet_std pass out quick on $if_wan proto $proto_all from $host_tapajos to any modulate state queue dmz_inet_std ### trafego entre uatuma e provedores voip - prioridade maxima pass in quick on $if_dmz proto $proto_all from $host_uatuma to $host_voip_all queue inet_dmz_voip pass out quick on $if_wan proto $proto_all from $host_uatuma to $host_voip_all queue inet_dmz_voip pass in quick on $if_wan proto $proto_all from $host_voip_all to $host_uatuma queue dmz_inet_voip pass out quick on $if_dmz proto $proto_all from $host_voip_all to $host_uatuma queue dmz_inet_voip ### trafego entre uatuma e rede anca pass in quick on $if_anca proto $proto_all from $net_anca to $host_uatuma queue dmz_internal pass out quick on $if_dmz proto $proto_all from $net_anca to $host_uatuma queue dmz_internal pass in quick on $if_dmz proto $proto_all from $host_uatuma to $net_anca queue anca_internal pass out quick on $if_anca proto $proto_all from $host_uatuma to $net_anca queue anca_internal ### trafego entre uatuma e rede bdf pass in quick on $if_bdf proto $proto_all from $net_bdf to $host_uatuma queue dmz_internal pass out quick on $if_dmz proto $proto_all from $net_bdf to $host_uatuma queue dmz_internal pass in quick on $if_dmz proto $proto_all from $host_uatuma to $net_bdf queue bdf_internal pass out quick on $if_bdf proto $proto_all from $host_uatuma to $net_bdf queue bdf_internal ### trafego de uatuma para internet pass in quick on $if_dmz proto $proto_all from $host_uatuma to any modulate state queue inet_dmz_std pass out quick on $if_wan proto $proto_all from $host_uatuma to any modulate state queue inet_dmz_std ### trafego de trusted1 para uatuma pass in quick on $if_wan proto tcp from $trusted1 to $host_uatuma port 80 modulate state queue dmz_inet_std pass out quick on $if_dmz proto tcp from $trusted1 to $host_uatuma port 80 modulate state queue dmz_inet_std ### trafego entre solimoes e rede anca pass in quick on $if_anca proto tcp from $net_anca to $host_solimoes port { 25, 80 } queue dmz_internal pass out quick on $if_dmz proto tcp from $net_anca to $host_solimoes port { 25, 80 } queue dmz_internal pass in quick on $if_dmz proto tcp from $host_solimoes port { 25, 80 } to $net_anca queue anca_internal pass out quick on $if_anca proto tcp from $host_solimoes port { 25, 80 } to $net_anca queue anca_internal ### trafego entre solimoes e rede bdf pass in quick on $if_bdf proto tcp from $net_bdf to $host_solimoes port { 25, 80 } queue dmz_internal pass out quick on $if_dmz proto tcp from $net_bdf to $host_solimoes port { 25, 80 } queue dmz_internal pass in quick on $if_dmz proto tcp from $host_solimoes port { 25, 80 } to $net_bdf queue bdf_internal pass out quick on $if_bdf proto tcp from $host_solimoes port { 25, 80 } to $net_bdf queue bdf_internal ### trafego entre solimoes e internet pass in quick on $if_dmz proto tcp from $host_solimoes to any port 25 modulate state queue inet_dmz_mail pass out quick on $if_wan proto tcp from $host_solimoes to any port 25 modulate state queue inet_dmz_mail pass in quick on $if_wan proto tcp from any to $host_solimoes port { 25, 80 } queue dmz_inet_mail pass out quick on $if_dmz proto tcp from any to $host_solimoes port { 25, 80 } queue dmz_inet_mail pass in quick on $if_dmz proto $proto_all from $host_solimoes to any modulate state queue inet_dmz_std pass out quick on $if_wan proto $proto_all from $host_solimoes to any modulate state queue inet_dmz_std ### trafego do firewall para outras redes pass out quick on $if_anca proto $proto_all from to $net_anca modulate state queue anca_internal pass out quick on $if_bdf proto $proto_all from to $net_bdf modulate state queue bdf_internal pass out quick on $if_dmz proto $proto_all from to $net_dmz modulate state queue dmz_internal pass out quick on $if_wan proto $proto_all from to any modulate state queue inet_std ### trafego da internet para o firewall pass in quick log on $if_wan proto tcp from any to $host_fw_wan port 22 modulate state queue inet_std ### trafego de redes/hosts confiaveis para o firewall pass in quick log on $if_wan proto tcp from $trusted1 to $host_fw_wan port { 80, 10000 } modulate state queue inet_std pass in quick log on $if_wan proto tcp from $trusted2 to $host_fw_wan port 1241 modulate state queue inet_std ### bloqueia trafego na interface DMZ block quick on $if_dmz ### trafego da rede anca para firewall pass in quick on $if_anca proto udp from $net_anca to $host_fw_anca port { 53, 67 } modulate state queue anca_internal pass in quick on $if_anca proto tcp from $net_anca to $host_fw_anca port { 22, 80, 3128 } modulate state queue anca_internal ### trafego da rede anca para internet pass in quick on $if_anca proto tcp from $net_anca to any port { 25, 110, 143 } modulate state queue inet_std ### trafego da rede anca para AVG pass in quick on $if_anca proto $proto_all from $net_anca to $host_avg_all modulate state queue inet_std ### bloqueia trafego de xingu para outras redes block in quick on $if_anca proto $proto_all from $host_xingu to { $net_dmz, $net_bdf } ### trafego de xingu para internet pass in quick on $if_anca proto $proto_all from $host_xingu to any modulate state queue inet_std ### trafego especifico da rede pass in quick on $if_anca proto tcp from { $host_maira $host_cris } to { $host_webmst $host_webmstlocaweb } modulate state queue inet_std pass in quick on $if_anca proto tcp from $host_felipenotebook to any port { 22, 6667 } modulate state queue inet_std pass in quick on $if_anca proto tcp from $host_zenaide to $host_fw_wan port 10000 modulate state queue anca_internal ### bloqueia trafego na interface ANCA block quick on $if_anca ### trafego da rede bdf para firewall pass in quick on $if_bdf proto udp from $net_bdf to $host_fw_bdf port { 53, 67 } modulate state queue bdf_internal pass in quick on $if_bdf proto tcp from $net_bdf to $host_fw_bdf port { 22, 80, 3180 } modulate state queue bdf_internal ### trafego da rede bdf para internet pass in quick on $if_bdf proto tcp from $net_bdf to any port { 25, 110, 143 } modulate state queue inet_std ### trafego da rede bdf para AVG pass in quick on $if_bdf proto $proto_all from $net_bdf to $host_avg_all modulate state queue inetd_std ### bloqueia trafego de madeira para outras redes block in quick on $if_bdf proto $proto_all from $host_madeira to { $net_dmz, $net_anca } ### trafego de madeira para internet pass in quick on $if_bdf proto $proto_all from $host_madeira to any modulate state queue inet_std ### trafego especifico da rede pass in quick on $if_bdf proto tcp from $host_macdiagramacao to any port { 80, 443 } modulate state queue inet_std pass in quick on $if_bdf proto tcp from $host_niltonviana to $host_gazetamercantil modulate state queue inet_std pass in quick on $if_bdf proto tcp from $host_jorgeosoris to { $host_webbdf $host_iespana $host_jubileubrasil } modulate state queue inet_std pass in quick on $if_bdf proto tcp from $host_edmilson to $host_fw_wan port 10000 modulate state queue bdf_internal ### bloqueia trafego na interface BDF block quick on $if_bdf ### bloqueia tudo block quick all root@amazonas#