# http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipf.html ################################################################# # No restrictions on Inside LAN Interface for private network # Not needed unless you have LAN ################################################################# pass out quick on bge1 all pass in quick on bge1 all ################################################################# # No restrictions on Loopback Interface ################################################################# pass in quick on lo0 all pass out quick on lo0 all ################################################################# # Interface facing Public Internet (Outbound Section) # Interrogate session start requests originating from behind the # firewall on the private network # or from this gateway server destine for the public Internet. ################################################################# # Allow out access to my ISP's Domain name server. # xxx must be the IP address of your ISP's DNS. # Dup these lines if your ISP has more than one DNS server # Get the IP addresses from /etc/resolv.conf file #pass out quick on bge0 proto tcp from any to xxx port = 53 flags S keep state #pass out quick on bge0 proto udp from any to xxx port = 53 keep state pass out quick on bge0 proto tcp from any to 0.0.0.0/0 port = 53 flags S keep state pass out quick on bge0 proto udp from any to 0.0.0.0/0 port = 53 keep state # Allow out access to my ISP's DHCP server for cable or DSL networks. # This rule is not needed for 'user ppp' type connection to the # public Internet, so you can delete this whole group. # Use the following rule and check log for IP address. # Then put IP address in commented out rule & delete first rule #pass out quick on bge0 proto udp from any to z.z.z.z port = 67 keep state pass out log quick on bge0 proto udp from any to any port = 67 keep state # Allow out non-secure standard www function pass out quick on bge0 proto tcp from any to any port = 80 flags S keep state # Allow out secure www function https over TLS SSL pass out quick on bge0 proto tcp from any to any port = 443 flags S keep state # Allow out send & get email function pass out quick on bge0 proto tcp from any to any port = 110 flags S keep state pass out quick on bge0 proto tcp from any to any port = 25 flags S keep state # Allow out send & get Gmail (pop 995, smtp 587) pass out quick on bge0 proto tcp from any to any port = 995 flags S keep state pass out quick on bge0 proto tcp from any to any port = 587 flags S keep state # Allow out Time pass out quick on bge0 proto tcp from any to any port = 37 flags S keep state # Allow out nntp news pass out quick on bge0 proto tcp from any to any port = 119 flags S keep state # Allow out ntp pass out quick on bge0 proto udp from any to any port = 123 keep state # 28.5.21.2 IPNAT FTP Filter Rules # Allow out LAN PC client FTP to public Internet # Active and passive modes pass out quick on bge0 proto tcp from any to any port = 21 flags S keep state # # Allow out passive mode data channel high port numbers #pass out quick on bge0 proto tcp from any to any port > 1024 flags S keep state ## Carlos Duque pass out quick on bge0 proto tcp from 192.168.1.120 to any port > 1024 flags S keep state ## Jaime Saldarriaga pass out quick on bge0 proto tcp from 192.168.1.121 to any port > 1024 flags S keep state ## Algun equipo temporal pass out quick on bge0 proto tcp from 192.168.1.29 to any port > 1024 flags S keep state # Allow out secure FTP, Telnet, and SCP # This function is using SSH (secure shell) pass out quick on bge0 proto tcp from any to any port = 22 flags S keep state # Allow out non-secure Telnet pass out quick on bge0 proto tcp from any to any port = 23 flags S keep state # Allow out FBSD CVSUP function pass out quick on bge0 proto tcp from any to any port = 5999 flags S keep state # Allow out ping to public Internet pass out quick on bge0 proto icmp from any to any icmp-type 8 keep state # Allow out whois for LAN PC to public Internet pass out quick on bge0 proto tcp from any to any port = 43 flags S keep state # Allow out Cpanel pass out quick on bge0 proto tcp from any to any port = 2082 flags S keep state # Allow out Webmail Telemedellin pass out quick on bge0 proto tcp from any to any port = 2095 flags S keep state # Allow out Webmail Coldecon pass out quick on bge0 proto tcp from any to any port = 8083 flags S keep state # Allow out Correo Remoto EPM y Programa SCHIP Contaduria General pass out quick on bge0 proto tcp from any to any port = 8080 flags S keep state # Allow out Comision Nacional del Servicio Civil pass out quick on bge0 proto tcp from any to any port = 8090 flags S keep state #pass out quick on bge0 proto tcp from any to any port = 8100 flags S keep state pass out quick on bge0 proto tcp from any to any port = 8102 flags S keep state pass out quick on bge0 proto tcp from any to any port = 8096 flags S keep state pass out quick on bge0 proto tcp from any to any port = 8091 flags S keep state pass out quick on bge0 proto tcp from any to any port = 8092 flags S keep state # Salida temporal a algun puerto #pass out quick on bge0 proto tcp from any to any port = 8300 flags S keep state # Allow out Web Politecnico pass out quick on bge0 proto tcp from any to any port = 7777 flags S keep state # Allow out XChat pass out quick on bge0 proto tcp from any to any port = 6667 flags S keep state # Allow out UPS Alphasys (81 -> 80) pass out quick on bge0 proto tcp from any to any port = 81 flags S keep state # Allow out 82 UPS MinuteMan (82 -> 81) pass out quick on bge0 proto tcp from any to any port = 82 flags S keep state # Allow out 83 Camaras pass out quick on bge0 proto tcp from any to any port = 83 flags S keep state # Allow out VNC pass out quick on bge0 proto tcp from any to any port = 5900 flags S keep state pass out quick on bge0 proto tcp from any to any port = 5901 flags S keep state # Allow out PostgreSQL (5432) pass out quick on bge0 proto tcp from any to any port = 5432 flags S keep state # Allow out Windows Media Player ## RTSP out 554 TCP y 5004, 5005 UDP #pass out quick on bge0 proto tcp from any to any port = 554 flags S keep state #pass out quick on bge0 proto udp from any to any port = 5004 keep state #pass out quick on bge0 proto udp from any to any port = 5005 keep state ## MMS out 1755 TCP UDP y 1024-5000 UDP #pass out quick on bge0 proto tcp from any to any port = 1755 flags S keep state #pass out quick on bge0 proto udp from any to any port = 1755 keep state #pass out quick on bge0 proto udp from any to any port 1024 >< 5000 keep state ## Carlos Duque # RTSP pass out quick on bge0 proto tcp from 192.168.1.120 to any port = 554 flags S keep state pass out quick on bge0 proto udp from 192.168.1.120 to any port = 5004 keep state pass out quick on bge0 proto udp from 192.168.1.120 to any port = 5005 keep state # MMS pass out quick on bge0 proto tcp from 192.168.1.120 to any port = 1755 flags S keep state pass out quick on bge0 proto udp from 192.168.1.120 to any port = 1755 keep state pass out quick on bge0 proto udp from 192.168.1.120 to any port 1024 >< 5000 keep state ## Jaime Saldarriaga # RTSP pass out quick on bge0 proto tcp from 192.168.1.121 to any port = 554 flags S keep state pass out quick on bge0 proto udp from 192.168.1.121 to any port = 5004 keep state pass out quick on bge0 proto udp from 192.168.1.121 to any port = 5005 keep state # MMS pass out quick on bge0 proto tcp from 192.168.1.121 to any port = 1755 flags S keep state pass out quick on bge0 proto udp from 192.168.1.121 to any port = 1755 keep state pass out quick on bge0 proto udp from 192.168.1.121 to any port 1024 >< 5000 keep state ## Gerencia # RTSP pass out quick on bge0 proto tcp from 192.168.1.122 to any port = 554 flags S keep state pass out quick on bge0 proto udp from 192.168.1.122 to any port = 5004 keep state pass out quick on bge0 proto udp from 192.168.1.122 to any port = 5005 keep state # MMS pass out quick on bge0 proto tcp from 192.168.1.122 to any port = 1755 flags S keep state pass out quick on bge0 proto udp from 192.168.1.122 to any port = 1755 keep state pass out quick on bge0 proto udp from 192.168.1.122 to any port 1024 >< 5000 keep state ## Portatil Dell # RTSP pass out quick on bge0 proto tcp from 192.168.1.123 to any port = 554 flags S keep state pass out quick on bge0 proto udp from 192.168.1.123 to any port = 5004 keep state pass out quick on bge0 proto udp from 192.168.1.123 to any port = 5005 keep state # MMS pass out quick on bge0 proto tcp from 192.168.1.123 to any port = 1755 flags S keep state pass out quick on bge0 proto udp from 192.168.1.123 to any port = 1755 keep state pass out quick on bge0 proto udp from 192.168.1.123 to any port 1024 >< 5000 keep state ## Portatil presario Wireless # RTSP pass out quick on bge0 proto tcp from 192.168.1.128 to any port = 554 flags S keep state pass out quick on bge0 proto udp from 192.168.1.128 to any port = 5004 keep state pass out quick on bge0 proto udp from 192.168.1.128 to any port = 5005 keep state # MMS pass out quick on bge0 proto tcp from 192.168.1.128 to any port = 1755 flags S keep state pass out quick on bge0 proto udp from 192.168.1.128 to any port = 1755 keep state pass out quick on bge0 proto udp from 192.168.1.128 to any port 1024 >< 5000 keep state ## Financiera # RTSP pass out quick on bge0 proto tcp from 192.168.1.130 to any port = 554 flags S keep state pass out quick on bge0 proto udp from 192.168.1.130 to any port = 5004 keep state pass out quick on bge0 proto udp from 192.168.1.130 to any port = 5005 keep state # MMS pass out quick on bge0 proto tcp from 192.168.1.130 to any port = 1755 flags S keep state pass out quick on bge0 proto udp from 192.168.1.130 to any port = 1755 keep state pass out quick on bge0 proto udp from 192.168.1.130 to any port 1024 >< 5000 keep state ## Director Noticias # RTSP pass out quick on bge0 proto tcp from 192.168.1.131 to any port = 554 flags S keep state pass out quick on bge0 proto udp from 192.168.1.131 to any port = 5004 keep state pass out quick on bge0 proto udp from 192.168.1.131 to any port = 5005 keep state # MMS pass out quick on bge0 proto tcp from 192.168.1.131 to any port = 1755 flags S keep state pass out quick on bge0 proto udp from 192.168.1.131 to any port = 1755 keep state pass out quick on bge0 proto udp from 192.168.1.131 to any port 1024 >< 5000 keep state # Allow out aMule Web Control Panel pass out quick on bge0 proto tcp from any to any port = 4711 flags S keep state # Allow out aMule #4661 out (edonkey TCP para conectar a los servidores) #4662 out/in (edonkey TCP) #4665 out/in (edonkey UDP, which is TCP + 3 ie 4662+3 = 4665) #4672 out (Kad? UDP) #4711 in (webserver port TCP) #4712 out (Accept external conections TCP) #65535 in (ServerUDPPort UDP) ## (4661 TCP outgoing, 4662 TCP outgoing, 4712 TCP outgoing, 4665 UDP outgoing, 4672 UDP outgoing) # (4662 TCP incoming ,4711 TCP incoming,4665 UDP incoming, 4672 UDP incoming, 65535 UDP incoming(ServerUDPPort)) # http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=122 # http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=121 # http://tdn.no-ip.org/connection_test?port=4662 # ID edonkey -> IP http://lugdunum2k.free.fr/id.html#recup # Nodes para ED2K (por defecto) http://ocbmaurice.dyns.net/pl/slist.pl?download/server-best.met # Nodes para kad (cambiarlo por esto) http://www.emule-inside.net/nodes.dat pass out quick on bge0 proto tcp from 192.168.7.100 to any port = 4661 flags S keep state pass out quick on bge0 proto tcp from 192.168.7.100 to any port = 4662 flags S keep state pass out quick on bge0 proto tcp from 192.168.7.100 to any port = 4712 flags S keep state pass out quick on bge0 proto udp from 192.168.7.100 to any port = 4665 keep state pass out quick on bge0 proto udp from 192.168.7.100 to any port = 4672 keep state # Allow out Azureus # Incoming TCP listen port 6882 -> 38789 TCP/UDP, UDP listen port 6882 -> 38789 # Distributed DB dht.aelities.com 6883 -> 38790 TCP/UDP # Tracker Server HTTP port 6969 -> 38790 UDP pass out quick on bge0 proto tcp from 192.168.7.100 to any port = 38789 flags S keep state pass out quick on bge0 proto udp from 192.168.7.100 to any port = 38789 keep state pass out quick on bge0 proto tcp from 192.168.7.100 to any port = 38790 flags S keep state pass out quick on bge0 proto udp from 192.168.7.100 to any port = 38790 keep state # Allow out BitTorrent # TCP/UDP 6880, 6881, 6882, 6883, 6884, 6885, 6886, 6887, 6888, 6889, 6890 pass out quick on bge0 proto tcp from 192.168.7.100 to any port 6880 >< 6890 flags S keep state pass out quick on bge0 proto udp from 192.168.7.100 to any port 6880 >< 6890 keep state # Allow out BitTorrent Tracker pass out quick on bge0 proto tcp from 192.168.7.100 to any port > 1024 flags S keep state #pass out quick on bge0 proto tcp from 192.168.7.100 to any flags S keep state # Block and log only the first occurrence of everything # else that's trying to get out. # This rule enforces the block all by default logic. block out log first quick on bge0 all ################################################################# # Interface facing Public Internet (Inbound Section) # Interrogate packets originating from the public Internet # destine for this gateway server or the private network. ################################################################# # Block all inbound traffic from non-routable or reserved address spaces block in quick on bge0 from 192.168.0.0/16 to any #RFC 1918 private IP block in quick on bge0 from 172.16.0.0/12 to any #RFC 1918 private IP block in quick on bge0 from 10.0.0.0/8 to any #RFC 1918 private IP block in quick on bge0 from 127.0.0.0/8 to any #loopback block in quick on bge0 from 0.0.0.0/8 to any #loopback block in quick on bge0 from 169.254.0.0/16 to any #DHCP auto-config block in quick on bge0 from 192.0.2.0/24 to any #reserved for docs block in quick on bge0 from 204.152.64.0/23 to any #Sun cluster interconnect block in quick on bge0 from 224.0.0.0/3 to any #Class D & E multicast ##### Block a bunch of different nasty things. ############ # That I do not want to see in the log # Block frags block in quick on bge0 all with frags # Block short tcp packets block in quick on bge0 proto tcp all with short # block source routed packets block in quick on bge0 all with opt lsrr block in quick on bge0 all with opt ssrr # Block nmap OS fingerprint attempts # Log first occurrence of these so I can get their IP address block in log first quick on bge0 proto tcp from any to any flags FUP # Block anything with special options block in quick on bge0 all with ipopts # Block public pings block in quick on bge0 proto icmp all icmp-type 8 # Block ident block in quick on bge0 proto tcp from any to any port = 113 # Block all Netbios service. 137=name, 138=datagram, 139=session # Netbios is MS/Windows sharing services. # Block MS/Windows hosts2 name server requests 81 block in log first quick on bge0 proto tcp/udp from any to any port = 137 block in log first quick on bge0 proto tcp/udp from any to any port = 138 block in log first quick on bge0 proto tcp/udp from any to any port = 139 block in log first quick on bge0 proto tcp/udp from any to any port = 81 # Allow traffic in from ISP's DHCP server. This rule must contain # the IP address of your ISP's DHCP server as it's the only # authorized source to send this packet type. Only necessary for # cable or DSL configurations. This rule is not needed for # 'user ppp' type connection to the public Internet. # This is the same IP address you captured and # used in the outbound section. pass in quick on bge0 proto udp from 0.0.0.0/0 to any port = 68 keep state # Allow in standard www function because I have apache server pass in quick on bge0 proto tcp from any to any port = 80 flags S keep state # Allow in stream server #pass in quick on bge0 proto tcp from any to any port = 8000 flags S keep state # Allow in non-secure Telnet session from public Internet # labeled non-secure because ID/PW passed over public Internet as clear text. # Delete this sample group if you do not have telnet server enabled. #pass in quick on bge0 proto tcp from any to any port = 23 flags S keep state # Allow in non-secure FTP active/pasive # http://asyd.net/home/docs/firewall/ipf/ftp # bge0 is the Public Interface, bge2 is the DMZ One. 83.xxx.104.34 is the public FTP?s address # Configuration sample (proftpd) # PassivePorts 64000 65000 # IdentLookups off #pass in quick on bge0 proto tcp from any to any port = 21 keep state # FTP Cmd #pass in quick on bge0 proto tcp from any to any port 64000 >< 65000 flags S keep state # FTP #Passive #pass in quick on bge0 proto tcp from any to any port = 20 to any keep state # FTP Data (Active) # 28.5.21.2 IPNAT FTP Filter Rules # Active mode let data channel in from FTP server pass in quick on bge0 proto tcp from any to any port = 20 flags S keep state # Allow in secure FTP, Telnet, and SCP from public Internet # This function is using SSH (secure shell) pass in quick on bge0 proto tcp from any to any port = 22 flags S keep state # Allow in VNC #pass in quick on bge0 proto tcp from any to any port = 5900 flags S keep state # Allow in UPS Alphasys (81 -> 80) pass in quick on bge0 proto tcp from any to any port = 81 flags S keep state # Allow in UPS MinuteMan (82 -> 82) pass in quick on bge0 proto tcp from any to any port = 82 flags S keep state # Allow in Camaras (83 -> 554:557) pass in quick on bge0 proto tcp from any to any port = 83 flags S keep state # Allow in Impresora Kyocera FS-2000d2 (84 -> 80) #pass in quick on bge0 proto tcp from any to any port = 84 flags S keep state # Allow in Impresora Kyocera FS-2000d (85 -> 80) #pass in quick on bge0 proto tcp from any to any port = 85 flags S keep state # Allow in Impresora Dell 5100cn (Contabilidad) (86 -> 80) #pass in quick on bge0 proto tcp from any to any port = 86 flags S keep state # Allow in Impresora Dell 5100cn2 (Graficacion) (87 -> 80) #pass in quick on bge0 proto tcp from any to any port = 87 flags S keep state # Allow in PostgreSQL (5432) pass in quick on bge0 proto tcp from any to any port = 5432 flags S keep state # Allow in aMule # (4662 TCP incoming ,4711 TCP incoming,4665 UDP incoming, 4672 UDP incoming, 65535 UDP incoming(ServerUDPPort)) # http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=122 # http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=121 # http://tdn.no-ip.org/connection_test?port=4662 # ID edonkey -> IP http://lugdunum2k.free.fr/id.html#recup pass in quick on bge0 proto tcp from any to 192.168.7.100 port = 4662 flags S keep state pass in quick on bge0 proto tcp from any to 192.168.7.100 port = 4711 flags S keep state pass in quick on bge0 proto udp from any to 192.168.7.100 port = 4665 keep state pass in quick on bge0 proto udp from any to 192.168.7.100 port = 4672 keep state pass in quick on bge0 proto udp from any to 192.168.7.100 port = 65535 keep state # Allow in Azureus # Incoming TCP listen port 6882 -> 38789 TCP/UDP, UDP listen port 6882 -> 38789 # Incoming Distributed DB dht.aelities.com 6883 -> 38790 TCP/UDP # Tracker Server HTTP port 6969 UDP # HTML WebUI port 6886 UDP pass in quick on bge0 proto tcp from any to 192.168.7.100 port = 38789 flags S keep state pass in quick on bge0 proto udp from any to 192.168.7.100 port = 38789 keep state pass in quick on bge0 proto tcp from any to 192.168.7.100 port = 38790 flags S keep state pass in quick on bge0 proto udp from any to 192.168.7.100 port = 38790 keep state pass in quick on bge0 proto udp from any to 192.168.7.100 port = 6969 keep state # Allow in BitTorrent # TCP/UDP 6880, 6881, 6882, 6883, 6884, 6885, 6886, 6887, 6888, 6889 pass in quick on bge0 proto tcp from any to 192.168.7.100 port 6880 >< 6890 flags S keep state pass in quick on bge0 proto udp from any to 192.168.7.100 port 6880 >< 6890 keep state # Block and log only first occurrence of all remaining traffic # coming into the firewall. The logging of only the first # occurrence stops a .denial of service. attack targeted # at filling up your log file space. # This rule enforces the block all by default logic. block in log first quick on bge0 all ################### End of rules file #####################################