# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # This configuration is set for use on a machine that is a router with # three (3) network cards: # ext_if - connects to the upstream link (cable/dsl modem, WAN, etc.) # wifi_if - wireless card for internal network # (if none present, remove all references to it in this file) # lan_if - wired card for internal network # (if none present, remove all references to it in this file) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #------------------------------------------------------------------------ # macros #------------------------------------------------------------------------ logopt = "log" # interfaces ext_if = "bge0" wifi_if = "ath0" #lan_if = "fxp1" # publically accesible services (transport layer neutral) pubserv = "{ 80 }" # internally accessible services (transport layer neutral) lanserv = "{ 22, 53, 67, 80, 443, 8118 }" # samba ports (transport layer neutral) #samba_ports = "{ 137, 138, 139 }" # externally permitted inbound icmp types icmp_types = "echoreq" # internal network lan_net = "192.168.1.0/24" # hosts granted acces to samba (cifs/smb) shares smb_net = "{ 192.168.0.0/24, 71.222.203.202, 65.19.5.204, 81.22.244.181, 81.22.244.182 }" # block these networks table { 0.0.0.0/8, 10.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8, \ 169.254.0.0/16, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, \ 224.0.0.0/3, 255.255.255.255 } #------------------------------------------------------------------------ # options #------------------------------------------------------------------------ # config set skip on ath0 set block-policy return set loginterface $ext_if set skip on lo0 # scrub #scrub all reassemble tcp no-df #scrub in all fragment reassemble scrub out all random-id scrub in on $ext_if all no-df min-ttl 100 max-mss 1440 fragment reassemble scrub in on $ext_if all no-df min-ttl 100 max-mss 1440 fragment crop #scrub in on $ext_if from $ext_ad to $prv_ad no-df min-ttl 100 max-mss 1440 fragment drop-ovl #------------------------------------------------------------------------ # redirection (and nat, too!) #------------------------------------------------------------------------ # network address translation nat on $ext_if from $lan_net to any -> ($ext_if) #------------------------------------------------------------------------ # firewall policy #------------------------------------------------------------------------ # restrictive default rules #block all pass in quick on bge0 inet from 192.168.0.64 to any keep state label "RULE 0 -- ACCEPT " #pass in quick on bge0 inet from 192.168.1.0/24 to any keep state label "RULE 0 -- ACCEPT " block return-rst in $logopt on $ext_if proto tcp all block return-icmp in $logopt on $ext_if proto udp all block in $logopt on $ext_if proto icmp all #block in quick from uprf-failed label uPRF #block out $logopt on $ext_if all # trust localhost pass in quick on lo0 all pass out quick on lo0 all # anti spoofing block drop in $logopt quick on $ext_if from to any block drop out $logopt quick on $ext_if from any to antispoof for { $wifi_if, $ext_if } # anti fake return-scans block return-rst out on $ext_if proto tcp all block return-rst in on $ext_if proto tcp all block return-icmp out on $ext_if proto udp all block return-icmp in on $ext_if proto udp all # toy with script kiddies scanning us block in on $ext_if from any os unknown block in $logopt quick proto tcp flags FUP/WEUAPRSF block in $logopt quick proto tcp flags WEUAPRSF/WEUAPRSF block in $logopt quick proto tcp flags SRAFU/WEUAPRSF block in $logopt quick proto tcp flags /WEUAPRSF block in $logopt quick proto tcp flags SR/SR block in $logopt quick proto tcp flags SF/SF # open firewall fully # warning: insecure. 'nuff said. pass in quick all pass out quick all # allow permitted icmp pass in inet proto icmp all icmp-type $icmp_types keep state # allow permitted services pass in on $ext_if inet proto tcp from any to any port $pubserv flags S/SA synproxy state pass in on {$wifi_if} inet proto {tcp udp} from $lan_net to any port $lanserv keep state pass in on {$ext_if $wifi_if} inet proto {tcp udp} from $smb_net to any port $lanserv synproxy state # permit access between LAN hosts #pass in from $lan_net to $lan_net keep state #pass out from $lan_net to $lan_net keep state # permit full outbound access # warning: potentially insecure. you may wish to lock down outbound access. pass out from any to any keep state Internet: Destination Gateway Flags Refs Use Netif Expire default home UGS 0 9321 bge0 localhost localhost UH 0 15243 lo0 192.168.0 link#1 UC 0 0 bge0 home 00:14:95:c1:fd:d1 UHLW 2 4229 bge0 1200 chi 00:13:20:c1:d6:64 UHLW 1 9 lo0 192.168.1 link#2 UC 0 0 ath0 192.168.1.64 00:13:02:22:4c:11 UHLW 1 5717 ath0 1191