# MACROS AND DEFINITIONS ext_if="vr0" int_if="dc0" tcp_services = "{ ftp, ssh, domain, http, pop3, imap, auth, pop3s }" udp_services = "{ domain, ntp }" Ori = "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 0.0.0.0/8, 240.0.0.0/4 }" omg_hax = "{ 135, 139, 445 }" good_icmp = "{ echoreq, unreach }" scelestus = "192.168.0.187" lilith = "192.168.0.2" finalpc = "192.168.0.3" marianne = "192.168.0.5" scelestus_ports = "{ ftp, http, https, domain }" lilith_ports = "{ 10000:19999, auth }" finalpc_ports = "20000:29999" marianne_ports = "30000:39999" table persist # OPTIONS set skip on lo0 set block-policy drop # NORMALIZATION scrub in all scrub on $ext_if all random-id reassemble tcp # QUEUEING # I'm assuming you're only interested in shaping your outgoing/upload bandwidth. # If you're interested in shaping incoming/download bandwidth, then you will need # altq enabled on the internal interface. # # Unless you have 100Mb upload from your isp (I'm assuming your $ext_if is connected # to an isp), that 100Mb value is probably WAAAAY too large. The total bandwidth # alloted to the queues on the interface should not exceed the upload bandwidth. # In fact, it should be less (perhaps around 80% of your upload) to allow for # protocol overhead. (If you do set up altq on $int_if, that one can and should # have a much higher value in keeping with your internal network's bandwidth.) # # Keep in mind that queueing only works on outbound traffic. cheggit the second # paragraph of http://www.openbsd.org/faq/pf/queueing.html and http://www.benzedrine.cx/ackpri.html # for some good info on queueing. altq on $ext_if cbq bandwidth 100Mb queue { lilith, finalpc, ssh, other, synack } queue lilith bandwidth 3Mb cbq(borrow red) queue finalpc bandwidth 3Mb cbq(borrow red) queue ssh bandwidth 1Mb cbq(borrow red) { ssh_interactive, ssh_bulk } queue other bandwidth 1Mb cbq(default borrow red) queue synack bandwidth 1Mb cbq(borrow red) priority 7 queue ssh_interactive bandwidth 256Kb cbq(borrow red) priority 6 queue ssh_bulk bandwidth 256Kb cbq(borrow red) priority 1 # TRANSLATION nat pass on $ext_if from $int_if:network to any -> ($ext_if) # If $scelestus_ports, $lilith_ports, $finalpc_ports, $marianne_ports only accept incoming # tcp connections, then it would be best to remove udp from these rules. rdr on $ext_if proto { tcp, udp } from any to ($ext_if) port $scelestus_ports -> $scelestus rdr on $ext_if proto { tcp, udp } from any to ($ext_if) port $lilith_ports -> $lilith rdr on $ext_if proto { tcp, udp } from any to ($ext_if) port $finalpc_ports -> $finalpc rdr on $ext_if proto { tcp, udp } from any to ($ext_if) port $marianne_ports -> $marianne # FILTERING block all block in quick on $ext_if from to any block in quick on $ext_if from any to any port $omg_hax block in quick on $ext_if from $Ori to any block out quick on $ext_if from any to $Ori antispoof quick for $ext_if antispoof quick for $int_if # Because of block all, we need to specifically allow for traffic to traverse the internal interface. pass in quick on $int_if from $int_if:network to any keep state pass out quick on $int_if from any to $int_if:network keep state # It wasn't possible to make out from your original ruleset which hosts were # running sshd, so I assumed that external ssh connections are only allowed # to the firewall itself. If that assumption is erroneous, modify the following # rule to suit your needs. But it seems a reasonable supposition given the # absence of ssh ports in the rdr rules. pass in log quick on $ext_if inet proto tcp from any to ($ext_if) port ssh flags S/SA keep state (max-src-conn 15, max-src-conn-rate 5/3, overload flush global) queue (ssh_bulk, ssh_interactive) pass out log quick on $ext_if inet proto tcp from any to any port 22 flags S/SA keep state queue (ssh_bulk, ssh_interactive) # You didn't have any pass rules specific to $scelestus and $marianne. I added them to the following # two groups of rules on $ext_if. I assumed you would want that since you have rdr rules set up # for those hosts. If that's not the case, simply delete or comment out. pass in quick on $ext_if proto { tcp, udp } from any to $lilith port $lilith_ports keep state queue lilith pass in quick on $ext_if proto { tcp, udp } from any to $finalpc port $finalpc_ports keep state queue finalpc pass in quick on $ext_if proto { tcp, udp } from any to $scelestus port $scelestus_ports keep state pass in quick on $ext_if proto { tcp, udp } from any to $marianne port $marianne_ports keep state pass in quick on $ext_if proto { tcp, udp } from any to ($ext_if) keep state queue synack pass out quick on $ext_if proto { tcp, udp } from $lilith to any keep state queue lilith pass out quick on $ext_if proto { tcp, udp } from $finalpc to any keep state queue finalpc pass out quick on $ext_if proto { tcp, udp } from $scelestus to any keep state pass out quick on $ext_if proto { tcp, udp } from $marianne to any keep state pass out quick on $ext_if proto { tcp, udp } from ($ext_if) to any keep state queue synack pass out quick on $ext_if proto icmp all keep state queue synack pass out on $ext_if proto { tcp, udp } all keep state